{ "Event": { "published": true, "date": "2026-07-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-26", "timestamp": 1785110581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "77cebaec-285d-438f-a83a-99820dff9878", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe40140-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067724, "uuid": "e8e08c00-a9f1-48f9-9d0d-2016f6ab41f0", "comment": "Malware payload (Mirai)", "value": "8c50ff327dd728b8686e940f9edafec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067724, "uuid": "9b0f657d-5354-464a-b93e-f733b38e8b81", "comment": "Malware payload (Mirai)", "value": "01858dbbc8b78043f8c43f32e8ad0c5fc9a02ddfb18d1842939e77fb6faa8698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067724, "uuid": "9a9eb9d4-1c24-4610-9aae-2363d7c8e185", "comment": "Malware payload (Mirai)", "value": "b2da4c81f1a91ea39b994693507d3eb735dbd7e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067724, "uuid": "bb3b02a1-3fdb-4d7b-9d3d-4c6281601cb2", "comment": "Malware payload (Mirai)", "value": "c1ee58483077e7462d29079a4a29d707eda1338448340162274ac98dea9dfc44fecea70309fd22ccaea651721d6e8398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067724, "uuid": "b230bb5e-1f84-409f-8cd2-edacbbc61dab", "value": "T11E14C50AAD21CF2EF32D873147F74A25D35AA6C217E2C646D59CD5105E203CEB85FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067724, "uuid": "758406ca-1157-4e0a-b9e0-b090f4fe66f3", "value": "1536:D8x5Gt9vlzQJAFM10zE2RQdBsUo79axHZcoQTetheLQm/MzrYVnQkjttea/Q:gfAeAJE2RQjq2OfTsK0zrYVnQkjtteaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067724, "uuid": "df111fd9-f7e6-445e-8ab4-74379a5db157", "value": 206424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067724, "uuid": "92b3f7a0-479d-49b4-be79-5733b5b7919e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067724, "uuid": "f677e6f5-4817-4a62-b019-c419f15c5813", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1bd1a0-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066856, "uuid": "1909c49b-50dd-406b-aa3e-0cabe5d429df", "comment": "Malware payload (Mirai)", "value": "1439cc7d54804b21bf624e565bcdcf98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066856, "uuid": "33ad2495-0343-49ae-8f33-8e7c4c09cae2", "comment": "Malware payload (Mirai)", "value": "01f5e1162bd1d78186f201b9c4ef17eabdd08767aced74b0888f6a20d6a66156", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066856, "uuid": "7c03ce6b-a6bb-4472-9b5c-ee87ca8b203b", "comment": "Malware payload (Mirai)", "value": "ea302c5c560a04f66e67d146d7e33839b37aa92c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066856, "uuid": "6010f963-a918-4075-b6e1-40b16e6e5457", "comment": "Malware payload (Mirai)", "value": "d189da9cf5834d623f04a800605a33f0fd838d00b9c0e5a0178643d7fef5ca2f313a248bbd0341e42608843c8d7af5df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066856, "uuid": "4d6793e6-c163-4a9a-8365-b65a148355f8", "value": "T1BB53F1FD604736A6CFDD643A649F67A2A848D8E173972B7063290CE0DA7D199F48C078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066856, "uuid": "6dcba882-4f9a-449d-a32e-05aead03b123", "value": "1536:r3ScpdAfPagnovtgU7tBOYVBYTA/xKNTMgqdy:Oc/wn+tP7tBLBOAZKZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066856, "uuid": "791b6d7e-55c0-42d4-a3d6-c41f925a1283", "value": 64260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066856, "uuid": "6729cdb0-c06e-4d53-91e4-cc2b5eaf107f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066856, "uuid": "7cd8a53f-b128-4d55-8136-cf4c745e695f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e94e7f3-88fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785076205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076205, "uuid": "cbee8945-8c9d-463a-9e36-18d3e1823457", "comment": "Malware payload", "value": "977f85907b2f077249026b139ecde0f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076205, "uuid": "8e0caa76-4a93-419e-8554-25a123401acb", "comment": "Malware payload", "value": "025930176d45d2726ec0a7d275da6969be1bd47fbc9ad9ec41a505fb91d5f3f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076205, "uuid": "6b856d85-2210-4efc-98c1-09763572ab50", "comment": "Malware payload", "value": "8cfc74fe840a847df9b555f4e925db93ead6b6aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076205, "uuid": "188b5eae-2431-4d37-a040-5dd0eadd5207", "comment": "Malware payload", "value": "77ede01773ed3367b08443d8f5b50c4f8b49d00ed9c8ac7a14f75ec191201f615787b5abdeb004df69c4957ab8bad463", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076205, "uuid": "76f18f67-0532-49a6-b4cd-85c3e17986f7", "value": "T19FD73333D0CD423AC5E70432DA1922251EE8F5641B7298A8D78CDCEC2FAD5D366B3796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076205, "uuid": "6267bc71-b26c-41e7-a810-832d590475a3", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076205, "uuid": "e0080bc6-0da1-4b18-8e93-40cfa3b4bb76", "value": "786432:8oFqMc5n6YTqW6/7GJJ7pXcrOP44N1JV/y6awttVqhQodDkauZ136Y71qhtaJjY0:rc18N/7Gz7pspyJV/JJtM81KIQhSck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785076205, "uuid": "a4041302-86c8-4a58-94ec-88c937854e71", "value": 59600513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785076205, "uuid": "0c625de2-5937-4fce-87da-6e8ef8310c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076205, "uuid": "03e2c91b-5d8c-44ed-9ef1-f11dd68fa160", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b999e538-88ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785041514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041514, "uuid": "736247bb-f442-4224-998f-04cf04341ca4", "comment": "Malware payload (Mirai)", "value": "ec45d1d448f164129ec8d15d998df730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041514, "uuid": "7c9d6554-e674-4170-90e1-c5baaac3f443", "comment": "Malware payload (Mirai)", "value": "061c72a8e7fc2957d388b5f0e5458064e40b1e82d1ff0ccb67a09959d4bcb5a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041514, "uuid": "af16a7ee-0076-4f70-a841-9abb202e3207", "comment": "Malware payload (Mirai)", "value": "e395df64e71403251056b6793bedd663fca5ddbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041514, "uuid": "2acf7960-d248-447d-bc84-33a1caafac5c", "comment": "Malware payload (Mirai)", "value": "63fee4914ff3e1f2d9207ef07947aec923313d56ba2f0406dda60df826df165f77ccc27a595f3ba0690336cdf294564d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041514, "uuid": "7e67aeb9-105c-48c4-bdff-4b5fddc130b3", "value": "T173434950F8819623C6D1137BFA6E468D3B2613E8E2DBB3079D225F2037C686B0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041514, "uuid": "69f95b3d-176e-4d11-9365-2d1617006070", "value": "1536:Fj7QguzvcqIMhqzU+c1YHeVT5iCsqXv+nc:FjQc/c+H2d9R+nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785041514, "uuid": "800818b8-4e63-4bd0-a9c7-607e95366341", "value": 59636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785041514, "uuid": "fcf1e1d7-7edf-448c-8052-aec8dccdb21d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041514, "uuid": "e11d0b61-aa9d-4c7c-80a8-8ba432cb7c25", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a8054a-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081214, "uuid": "f694e423-6622-44a2-9471-fdb84689ac79", "comment": "Malware payload (Mirai)", "value": "44b6ef124fb3c1dbce6ce61762f595d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081214, "uuid": "61b3977e-5af5-4ad8-b347-c8d5b25d6944", "comment": "Malware payload (Mirai)", "value": "061f153472fd6d03d7821319a06fd4bd5fcbf7a5e769758ab71556de7262343b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081214, "uuid": "ecf67763-ac01-44a8-8942-37d6d165d660", "comment": "Malware payload (Mirai)", "value": "9db6fe16417a22f28e876ede86f0a0b2d539454e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081214, "uuid": "f5a408b1-f829-4cad-8c20-d9594bc813e1", "comment": "Malware payload (Mirai)", "value": "c4780a2aff13d0bcf3935993061ea699f8be24426d959bcc115c1a9ef708686dc66b238ff8b346b62b7504bf8439bb36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081214, "uuid": "cbe845bd-748a-45c4-8f12-34c918f8eeba", "value": "T149148D317B264953C7621BB4896B17B0E7A1549100B4E62B2F09BB132EF377768CFB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081214, "uuid": "97d5313c-f8dc-4f1e-9c84-5b10df1fd8e5", "value": "3072:tFe8y0Zwo2q76sO3XsGlT27PZ4v0ViC0LCW42g+IB1zmjXzIiCFNPfoKagVCT18V:tFe8IxVcD2CeGaXz6OMV4i0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081214, "uuid": "56f0a17b-427e-4420-bad8-53b40cacaf40", "value": 198392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081214, "uuid": "8309791c-6fd6-480b-8b94-ede07d1f87da", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081214, "uuid": "12aecae9-3295-496a-826f-cf2c4b80bf86", "value": "flutter.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa1d5f5-88c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785050992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050992, "uuid": "5ef0aa0c-4a99-4be3-a40a-73d555e99c64", "comment": "Malware payload (JackSkid)", "value": "b0ae6ca69c37cde9cfac380e677f044e", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050992, "uuid": "3b9aafa7-7ace-4b36-81d5-5fcb863f329e", "comment": "Malware payload (JackSkid)", "value": "071ff332e77bc80d4e43660d73792af2e73e0442c66d74edfec3740b7691b299", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050992, "uuid": "5011704a-321e-4af1-949a-a232cf0eb749", "comment": "Malware payload (JackSkid)", "value": "f078aa075d12497c4070b2468c668ddbd1c0a567", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050992, "uuid": "4a192f74-6cc6-4043-9a07-8ee6fa68c4a3", "comment": "Malware payload (JackSkid)", "value": "d2b25b654efc97d6fb930a0ac60f8829699957d981d81505547cff157f9c9eba50394f650939a36e77e2657d5ffcf75b", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785050992, "uuid": "beefe11c-7deb-4e28-bd44-7735bfe481bf", "value": "T160A42955FC809B91DAD12ABEFF2E824973131B78F2EE72119D155B3067CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785050992, "uuid": "de254d5c-5d16-4aa1-aa10-5735f4428f05", "value": "12288:srcasVbAST0KkhgE8iZfOax7WyQmGYbOTgl5AHaMzo80offeBx:qcCphh8aQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785050992, "uuid": "70c4df3d-efd9-4a7c-8fff-d99bb22bbadc", "value": 485060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785050992, "uuid": "48c1980a-6997-406d-b84d-c6c6853080f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785050992, "uuid": "df3f1569-7895-4b2b-86aa-977984ddb750", "value": "lol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d2214d-88d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785060346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060346, "uuid": "2f4a7935-1026-4ef6-83f8-90c8955ed460", "comment": "Malware payload (Vidar)", "value": "bb32b5cfeeaaa49eca3943a2e2bd07ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060346, "uuid": "8f8d6d73-8003-48fb-b140-26981feaf33f", "comment": "Malware payload (Vidar)", "value": "07f53dbaccf650bf676c1352c6887edf10f3e8e790c8367b892c06a062ca1950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060346, "uuid": "dec06f08-0a0e-43d8-a137-cece116a05b5", "comment": "Malware payload (Vidar)", "value": "9413e180ce290b64371692c8c50c166dcb139f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060346, "uuid": "c1e7a8aa-6e06-48b8-ad8b-be29feeaf940", "comment": "Malware payload (Vidar)", "value": "6ffd75e4d29b1ab357378cee974394904e66417df062fc7177e5227e31d3dcc19b0d15ce4f2f15f00e01100b52c50a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060346, "uuid": "b4866a9a-31ef-4fee-88e2-29595a3ea361", "value": "T198167C07BDA944E5C1A9E73288B74152BB34BC4C4B3133E72E90AA382F727D15E75B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060346, "uuid": "9ce78612-2298-4dd7-bd95-18fda9c1b921", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060346, "uuid": "410a9e29-d6bf-43d3-87bb-12fe6e278fb0", "value": "98304:a/3IywUxQjc0Kh939XkUJWTZDow/YxTWaft:a5BxQjc0KhzXkUg1ow/YxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785060346, "uuid": "1343c158-f303-44b7-9846-c7a60db86f17", "value": 4406088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785060346, "uuid": "5e4e544e-8c83-440f-b0a9-14bcc1b36e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060346, "uuid": "fbee185a-5073-4f4b-98d4-b46a452c4fd6", "value": "07f53dbaccf650bf676c1352c6887edf10f3e8e790c8367b892c06a062ca1950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28113ff-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066897, "uuid": "427bd27a-ae84-4ae4-8d28-10a64bb8cb6a", "comment": "Malware payload (Mirai)", "value": "ccc49eb46ccf301a7926dd5aaf440c2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066897, "uuid": "c8899493-b0bc-4b49-9196-47af0d2cc431", "comment": "Malware payload (Mirai)", "value": "0800de5614a55e3a22717453b38aaf03ffd95c36e148131af3bef580f37dc137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066897, "uuid": "10beb44c-556a-4f59-a8b5-2183f2f6d860", "comment": "Malware payload (Mirai)", "value": "400bdea7f85f11537081d121a8bf341bbd3c047a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066897, "uuid": "9b2ba6a7-30e0-4e10-b6a0-c60167dc5a77", "comment": "Malware payload (Mirai)", "value": "3f4fb9304953fa70bd46c95a6761cf8339fb94c01a3d645ff84344b7b3bed2961facb45b10ec385ceb294ae81feb20c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066897, "uuid": "40d7cd34-3504-4669-94a8-f99cee24b888", "value": "T18E24B80E6E228F7DF6B9C73547B78E24975823D627E1D650E1ACD2102E2025E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066897, "uuid": "4bbc3c83-78d2-4619-acec-7d4d51274f47", "value": "3072:bhVcOPJqSUp2vIXMxps8WehuM2A25Eqb9LXUdtV+6hh1/3JI:bhVcOPJqSUp2vIUB8fzbJatj3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066897, "uuid": "dad8412c-b95c-4beb-9fc9-5e9364ed29b5", "value": 220264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066897, "uuid": "7d2ba4d6-4a05-493e-ab51-6337ea118fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066897, "uuid": "e44fa909-9815-4d96-8659-d8cbc0780465", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ada9a8-88e5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785065578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065578, "uuid": "6af9569d-da5d-4acf-9d83-489a3d5af4f9", "comment": "Malware payload", "value": "62e745f1fd1add79a0a6d57265a4be00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065578, "uuid": "cfac36b7-f636-416c-baf2-6d70ce148111", "comment": "Malware payload", "value": "08a81b03ff59173a87b21f36778be50e1100865edc6723fa73e2654f611a8954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065578, "uuid": "f179e4fd-b5ee-4ed5-9a2a-df8ae4655076", "comment": "Malware payload", "value": "51433761d35d623e4088f615914dafd159463176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065578, "uuid": "027f1d68-b4f1-414b-95f2-761559808b0e", "comment": "Malware payload", "value": "ecd879ce5950b0c6be80f5468324d768171dbdcde5677afa28c19ac6e60cdca78d73aa7a0ad8112c69bb3be9c4e1a852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065578, "uuid": "6b71fed4-06b1-4b58-88ee-6c3c06e9729d", "value": "T1DB18332189120ABEDF549F3494B1A33641BFBF76AF70A13F09A6B54DAD3794B9030C16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065578, "uuid": "6cbef421-2eb8-494a-9fd5-43d678099af2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065578, "uuid": "f492388b-f154-490a-b0c9-02303386b601", "value": "1572864:7fe4hdV6xf9GD/DDnFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzM:7fe4Doxf9GfDnF7z3V7vl385ySor0TzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065578, "uuid": "31f015dc-3b3f-413f-9fcf-39d0ec528c96", "value": 90484250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065578, "uuid": "5b74e174-3f92-4435-97e4-5b215cd73e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065578, "uuid": "10ff03a9-fd00-48f5-9516-49de15cd50a0", "value": "Windows_Update_Assistant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eef67c-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066149, "uuid": "55b82717-1168-400f-ba6f-6903f02a3676", "comment": "Malware payload (Mirai)", "value": "3b15ce3c04698acf2ee09643e7ea45be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066149, "uuid": "5fe34576-e606-4ee5-a1b2-4bdbfcbdfeb8", "comment": "Malware payload (Mirai)", "value": "0910d4ada193732713fbc69f5a8c81db8e304ceb9fc6d151c349b71fb7933e04", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066149, "uuid": "ee33d44b-ddb3-4705-a459-a974f0cad085", "comment": "Malware payload (Mirai)", "value": "8a57a5d4c3f152eb14a928966f38a91ef8660172", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066149, "uuid": "2cbff1ca-80bd-491e-87d1-3465a12fcc53", "comment": "Malware payload (Mirai)", "value": "63feef5062de29d1e028820d07fc99f2e90ed216c03a4833b050cf07e9250caa0829c34cd4c5424ee9121aa768583393", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066149, "uuid": "6ce43d43-b11c-4757-bb8f-d834a4fb6201", "value": "T136A33A82BC819A11C6C51777FA2F108D330267ADF2DE7263CD151F647B8A81F0E6BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066149, "uuid": "6dfff44f-adde-4060-870d-e5d86d13da67", "value": "1536:oNnc97o17akFF1HsPlbBjoS9tK7BVpPiv1bhYzJjR+J70q5dn7X6Uz3MIqivNzw0:l9s1DF7Hu1bIDpP61keYq5F7Zzw/m2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066149, "uuid": "90d7af38-a98a-4a36-8143-1cf7c6177a91", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066149, "uuid": "92e056a0-15bc-4a05-936d-44e60d5bd0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066149, "uuid": "27da9a3a-6d6b-4102-b743-b8c0bd489cd0", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8903ccfa-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088248, "uuid": "a90899e7-3455-4b42-bb63-c929358bf159", "comment": "Malware payload (Mirai)", "value": "31d24fb2bf8d7b6e022cb609bbd1fff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088248, "uuid": "0c7aee68-5fa7-4dfc-a2f9-40acc13a1ae2", "comment": "Malware payload (Mirai)", "value": "094fa6d0cb7ead6c425ad9d25d5619c322445f6a32578c973a668322d0f8ba8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088248, "uuid": "7532f85d-c173-470e-87d2-dccb4563b57f", "comment": "Malware payload (Mirai)", "value": "1165df194fd60c2bc8d9ef8c5d7272b49ec35c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088248, "uuid": "8d40cd60-2e62-4002-97d3-ba73474d49be", "comment": "Malware payload (Mirai)", "value": "579a8a5745a18042401b37c870433e40be89f0f5a4e2b5ae84e029183652b55787f6da4d1e054043665189508cbdb80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088248, "uuid": "0e01c532-0bab-4511-910d-d2b4658272d7", "value": "T18223F135C7E20DF5BBDE9DA9AD55C3D823310E2BA653DA8769A5DB90031B8D11C880B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088248, "uuid": "5e43e461-b010-4ad8-8095-a24320921039", "value": "768:gdn84tDxeOI2Oelv0S5+Wgp04a5nU2LOf3iob21YtbJKJH6ZIyOo/jTGN4uVcqgZ:+8KYO/d8SEWgp0tU2i3tb2eUBRyPC4uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088248, "uuid": "966c141f-ae23-4296-9ecf-60092d3a4075", "value": 47452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088248, "uuid": "7f2db89c-d892-48fc-8735-2b4b2a007bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088248, "uuid": "447a0afb-029c-461d-8360-5559951add1f", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72a78c5-888c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785027364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027364, "uuid": "88fe269d-005e-47cf-8f9c-9bf94f04ddcd", "comment": "Malware payload (Phorpiex)", "value": "c3884d3a6319f468c296a90668f127d4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027364, "uuid": "d0e193ba-2215-4b77-ba25-bcd53f784d74", "comment": "Malware payload (Phorpiex)", "value": "09b7fa9a1bc1c3f34bcca306c1f9e3971083ebf265adf5f7684e4a320b5d562e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027364, "uuid": "79fb0101-d52a-4466-b760-f2c7f6ab4b09", "comment": "Malware payload (Phorpiex)", "value": "eaec84b9becc94401a51ef501247022b39460e86", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027364, "uuid": "4ea82fce-abb7-4eed-a988-c614472ceefa", "comment": "Malware payload (Phorpiex)", "value": "ff2ba561bf871cd5c3692e0bcdb1473635421a9c764728a0eb18d535b91038a1bd52b6b94d98cbf0ee4223c14b020d41", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027364, "uuid": "b943aa4b-333b-4a2e-8a9e-63bc0c11821a", "value": "T14E624C0BA4808035EBF14474827F526644FEADB623C5F9DBF7E0648A5AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027364, "uuid": "d57ec9e9-082e-45e8-9491-a0b0572c021c", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027364, "uuid": "396759fa-eee7-449c-8a06-50c02f34081f", "value": "192:AWEsGnjXgjk8LcRI+gRdjMlIfeF5oIV1BKUSfEzQLd1gJxTmv8U9cthK9ik:A5ScS9feroFE+yav8U9csX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785027364, "uuid": "ba5a4ddd-ab3b-4ce4-9d1f-de35a429b526", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785027364, "uuid": "b4ddd081-ed8b-49b0-ac3f-a9c5aa6b72ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027364, "uuid": "dde3d289-cef3-44bf-a8eb-03925920a738", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c8466f-8916-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785086494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086494, "uuid": "786561a5-7e72-4ead-bd5f-c06c0af50b1c", "comment": "Malware payload (SalatStealer)", "value": "032b0d1866ccc6ed84cdbf93dc68ef78", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086494, "uuid": "601ec990-7975-49ea-a18c-4d29ecbff5a2", "comment": "Malware payload (SalatStealer)", "value": "09fead34d9a7f79dd16f54beba2d201fb55da5b6f8bb77d29011e937530a201e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086494, "uuid": "eaab8bf8-40a9-4128-bd41-3fbfeef7e319", "comment": "Malware payload (SalatStealer)", "value": "4e681c52c304ac68ecb8be4564f11a7d62fd8406", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086494, "uuid": "4ebe174c-1883-4c78-99cd-f8e049fb6be8", "comment": "Malware payload (SalatStealer)", "value": "a647649370cd11715d64a40129a5c00cc43352728ab0a18b4682022272bf31d8197282c853341483b1b41f4e43f49012", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086494, "uuid": "91c6c270-f172-4945-8c84-df55a54dcde9", "value": "T139F533DE37183789C1C0F638DE489965D1BA1D3DF2CABA912BA5E1AE83F20035D45DA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086494, "uuid": "f9b9fd84-60d9-45e2-a75e-b8973aebbc93", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086494, "uuid": "f19bbea9-d632-442e-b000-f9f9dac13f92", "value": "49152:217kD8xTOYjo28+/UkCv0Wi57XwqOKUR56yxtA7ttZmKTR5kTXqUgKWDqnb3jkrQ:ulTtjBNMkhWiRSEtIW2WGnb3jAnZUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785086494, "uuid": "3ee523d2-3a91-4f35-accd-46be3abecc13", "value": 3592192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785086494, "uuid": "a99eb427-8f3f-4890-bc02-137c503cfc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086494, "uuid": "4b9c120d-8899-43d6-830e-b74a25d073fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda50fb-8938-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785101035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785101035, "uuid": "4f936192-45b8-4c1c-be3d-36502cb220aa", "comment": "Malware payload", "value": "ce67f463c3459693c3934737bdcce0f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785101035, "uuid": "6501ecd3-ab10-4bde-855a-406b87d9c398", "comment": "Malware payload", "value": "0a0b01867e41bbd7e9863cbf839efb3a2f0963c2ccedd06c22c22beda6aafa19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785101035, "uuid": "264d6bfd-157b-46aa-9217-aa2d288a3864", "comment": "Malware payload", "value": "d95e0e95aaa5bd035ad7cd1b24b5de03cb9d735d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785101035, "uuid": "782238af-0e22-4fe7-b038-ebad82b7cd87", "comment": "Malware payload", "value": "0765479ec6c6095b79a38e032de9dcbff0efad42de72f68d7d4e1041a845dfb911e6460ff2894526daecc37604ffa06c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785101035, "uuid": "7b6c1dcf-316c-4aa0-ac3f-242cfbaa7f4f", "value": "T1FF335B4EB2C314FCC52FC0B985D68B76AA71B8211124AF3E769CDA301F10D646F3AE56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785101035, "uuid": "e8607511-31bf-4d85-bd8f-e8931fa5fd06", "value": "51a80ea29674dca0d37bdf9bcafa7a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785101035, "uuid": "f8c685ac-2969-4854-a695-5493ea0eeaa9", "value": "768:CHHrET4k408zFbUn/8byR9X+pXFHxHUgRqVqnZB5CQmZKZCoqHy6+HOr:CHHrlpbWAyR9EFHx0gsVqZGZeGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785101035, "uuid": "c63fb005-8fc6-46f5-852d-8dabb3c99505", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785101035, "uuid": "5789c750-75c7-418a-8ecd-35db1d49d37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785101035, "uuid": "a8a488ef-6582-4618-903a-c59286734f82", "value": "MegaBasterd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4108b92-8915-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785086280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086280, "uuid": "47d58654-15ba-4025-ab33-28f7c42934dc", "comment": "Malware payload (RemusStealer)", "value": "d5daeac5e6132601cd08bb1734fc7a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086280, "uuid": "0c24d01a-9436-49d8-881d-e7c1e26b3ab4", "comment": "Malware payload (RemusStealer)", "value": "0a4c8c4de448da39ee10e0990904efc4834f6daceb8ddeab7a8a7d77e4dd9169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086280, "uuid": "ac6e769a-4028-4edd-bf23-4ef35e9e1401", "comment": "Malware payload (RemusStealer)", "value": "4cec455049fad7ffedc47d39528e02d8fe8278b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086280, "uuid": "4bbd6551-6058-4ea1-a646-3e025c7c626b", "comment": "Malware payload (RemusStealer)", "value": "db3188ff2e6d6d77f5739fd1569849ff7d9518ec0b9db189eaffee661ae89ff036ec43ff7033f6d1ddb6183cb8731bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086280, "uuid": "c5d39e23-b95c-4abf-b7ac-9e29983edd0e", "value": "T12465112BC22371FCD593803C52662236B773B93947685EFB0393D3399D219C4AE79A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086280, "uuid": "5f74a053-d165-4c86-9a67-b54f52580b6d", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086280, "uuid": "b6373276-dd10-4218-951b-55416af8ac89", "value": "24576:KJ2nYj0aL45qZpZAAY4Hp0MD3xuqnt1b9enpP78tL2TU0lGFWk7f+cvqslcWPQ:6W+8aBuy9enmYA0w7+pslcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785086280, "uuid": "4641c5d7-7733-4fef-87c3-739a7fcd30cf", "value": 1527296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785086280, "uuid": "b21a614b-5192-45c2-9dc4-c7df30bb6a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086280, "uuid": "dd3e14ef-aea7-42ef-a1d2-26820c985841", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917fdf5c-88e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785064211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064211, "uuid": "2a290c93-207f-4cdc-8f9e-41d70c65036d", "comment": "Malware payload", "value": "250e47dd848549ab90e3c3f992c99bcd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064211, "uuid": "d27570ce-9d1c-4b70-bb60-9d4f7d635a4e", "comment": "Malware payload", "value": "0b1191aec5ad6ae2398f577f0b45de66c41edda4ce7216781f3a40ae010935b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064211, "uuid": "c4fa6d78-1541-4a85-ac46-1bbbdf9c5644", "comment": "Malware payload", "value": "89ebfc04bd98b6cfdfac88571d11f2c68f207e6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064211, "uuid": "70983775-c74b-4497-a294-69cf1c258974", "comment": "Malware payload", "value": "4fc870805df2bd701ca16f89e79e8b70b27f3b07742a341ccc29fa97abb050d03e1cb44ab74895a3bd848103788fbbd3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064211, "uuid": "6ba07fa6-d486-4054-b5f1-d5eee60983f6", "value": "T18CC27C966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064211, "uuid": "e1f4130b-55b5-4a07-aac6-941942a18e8d", "value": "768:l8vCB+25j6es8RV9FYpMSUpi+20qUpi+20YQX:l8l25Jzd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785064211, "uuid": "de5e7d45-49a7-49eb-a08c-060d4b13e129", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785064211, "uuid": "6072590d-243f-48f2-ac9c-eb5afd4db48c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064211, "uuid": "064fc626-dbcc-41de-8493-04e992f864e6", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bb1382-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "0bbe43cd-41b7-4ffe-aff1-18ff62c1290f", "comment": "Malware payload (Mirai)", "value": "348fe736037151600d6fe978ea30ee4f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "204782a7-7d2e-4dba-801a-c73e7ba6dbf7", "comment": "Malware payload (Mirai)", "value": "0b6cdce9677964345a98701111e1504efb211e72d9e3130d4d96013991263cfb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "f05bf9fb-9260-4d54-9f91-66c41208b3ca", "comment": "Malware payload (Mirai)", "value": "cde2e7d38b3bcac079e406babbbed1ccfcf7208f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "b2bdcf95-d35f-476e-a771-63240b127386", "comment": "Malware payload (Mirai)", "value": "bc426b9787098f0ce996591817380a49e6fc57d00393c07a785c5e8a982d2cbf825536f0c05fc5b6599dfdc662494c15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066130, "uuid": "a7e03ef5-28b9-486b-97a8-fe1278c7d13c", "value": "T1278160852B831FB53F3D9A2679DDC628724545DAC4822FC9F0DFFDA04E88DCA6C45262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066130, "uuid": "b53de278-f1b8-4143-bd56-b8aeae397dfa", "value": "48:vmUVUxylUmUsEUgUxU1UOUZU4U4UHUjURn:vmUVU+UmUsEUgUxU1UOUZU4U4UHUjURn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066130, "uuid": "c47764df-969d-41a1-b7ae-1627472d7289", "value": 4200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066130, "uuid": "64e52081-a6f6-456e-b4e3-1af2d7268e20", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066130, "uuid": "bfc028c7-44ba-4cc3-bdfe-aa18469a0eeb", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca9aea1-88a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785037949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037949, "uuid": "2248f07a-afe7-4dcf-849b-8fb780588830", "comment": "Malware payload (Efimer)", "value": "0ff0126ed66be4858a161aa773cd9a76", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037949, "uuid": "23a988ce-9e4b-4cc2-8aff-97f41a09569d", "comment": "Malware payload (Efimer)", "value": "0bc71f56b650c93a4f50e11ba41af659c46fba843cd019e2dbb152a536ed714f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037949, "uuid": "b496306d-e8fc-49fb-ad97-f5054eeac587", "comment": "Malware payload (Efimer)", "value": "904da862281f6a19155a5710c9bfb26f81485a26", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037949, "uuid": "3e6f4836-eece-4c3e-bf72-c089c41c98d9", "comment": "Malware payload (Efimer)", "value": "29683aa05c183dfc484058933e60280c57827a3a61e841b1c5c7cbc52a47a2f3308864a16b06d336458d095b23228696", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037949, "uuid": "2b2d5116-bddc-41d0-858c-4a1e00cc778a", "value": "T15BE6331576E001FEDA730239EDE20659F9F1B4B68731C19B1BA88B756A231A0CD3D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037949, "uuid": "c064a72c-8d1f-4bba-b3e5-601910f24ba3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037949, "uuid": "63b28533-39ab-40b3-97af-c05880a63158", "value": "393216:1gp7tsvr/AAD9Jy9ap2OOXMCHWUjX0cuI3/PGTAI:1gxOz/dD9JyM4xXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785037949, "uuid": "7717241a-d04d-4025-8e5c-a2f4a2fb6b86", "value": 14322878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785037949, "uuid": "1df565da-cc34-444c-98b3-4a782575669a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037949, "uuid": "b5408ec5-c810-40e5-b04f-b150564cc6f4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4027a19b-8906-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785079536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079536, "uuid": "6e305b36-b0be-4a91-9846-eaff178d3ead", "comment": "Malware payload (Mirai)", "value": "b0c77867cfa1f1e5cbfb0400c5a3daf1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079536, "uuid": "75e55f6e-c966-4aed-9a09-d79fb97c8702", "comment": "Malware payload (Mirai)", "value": "0bfa529ca3f3f1b40015dcef26f7e27f493fefefc36779d9ea2f2c45aa72cb81", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079536, "uuid": "ea288ad7-4fd9-4aa7-9429-2d0c8fb50cd6", "comment": "Malware payload (Mirai)", "value": "e0a2ef40755872a7b366d8d83193cac1be3b16d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079536, "uuid": "8acb0822-9248-4719-ab94-48d738c38b99", "comment": "Malware payload (Mirai)", "value": "145d5de8dadf05345d1bf28a4c2322d516b846d888d90394eb6b9877a39d98be64ebfc1d1f7a26d808d794ec083820c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785079536, "uuid": "12f752d7-b9de-4cf0-8eef-8e4ee339580b", "value": "T1BD41B9ED11418DBD9DA2D93BF2648016729AADD534DB3F59DADC3EB880CCD0831816D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785079536, "uuid": "2a29c494-c6dd-49d1-b669-00a7fe1cd623", "value": "24:npucusZwpiBwpkYvjwp5BwpAdfwp6Y+MwpuJwpmFmXCfwp1IGfwpEXDLzdwp7Ffu:nkH7rmdS5AHfFkGYRQUkOg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785079536, "uuid": "d3f90225-9211-42be-8d30-ee275f5306fe", "value": 2302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785079536, "uuid": "49d8b171-66b5-4f7d-ace6-335011bc97a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785079536, "uuid": "27da53eb-f30e-4679-8c12-1bf4c2c57027", "value": "cams.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f7a36-88c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785049385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049385, "uuid": "01abf205-b1ec-4246-8cd4-10039ddb0d28", "comment": "Malware payload", "value": "107b23e53cca586a700e8da328719079", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049385, "uuid": "040d68c3-5927-4219-9706-a0318665dede", "comment": "Malware payload", "value": "0c54132cab0103d71f7442af592cf31ad9b3a88d51bf6159f8adcd0186852366", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049385, "uuid": "6c109a76-9575-49bc-8774-749ccffefbbd", "comment": "Malware payload", "value": "fd33659ab3a59812f49c434c37e56a856a98af36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049385, "uuid": "8b029036-dfc1-494b-b0a9-0a19bb5034f8", "comment": "Malware payload", "value": "cfbbc8b62e7fbf4ab0acad4165cd31ab14f9de8a750d405feca02a9b6ea1e1f25c465d0db2be9352a77950a50ec72e35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785049385, "uuid": "b3a940fd-987f-4b94-af7c-bdedf4447b79", "value": "T130C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785049385, "uuid": "4e6b172c-5ac2-46d8-8b2d-acfe67c92a91", "value": "768:Z8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:Z8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785049385, "uuid": "9d6680a2-1521-4f5a-9525-d6716edf79fe", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785049385, "uuid": "7b3717c9-1a12-46d4-a9cb-43fb77503386", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785049385, "uuid": "d8373534-aea7-480a-89da-be2b339dbaf5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee0cce9-891b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785088822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088822, "uuid": "e1acf3ed-c722-4435-acbc-92ce8e117344", "comment": "Malware payload", "value": "39dab76551b5e819cb75c6128f915ae6", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088822, "uuid": "e83b0424-c79a-4841-ad67-aa1cadc236cf", "comment": "Malware payload", "value": "0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088822, "uuid": "b7c5dd61-3b0f-4da7-88fc-4ca590d2bcea", "comment": "Malware payload", "value": "37761b03f69f2c7fac6106b631fa8fa14e223caf", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088822, "uuid": "689d64d9-8336-42bb-b352-c9888ff54f78", "comment": "Malware payload", "value": "67d247cefb37d46e98429f1f370a5e3e0e997687df54632d6820b2383d74951ece495aa0f451da1a3b5b43fceffb617d", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088822, "uuid": "b4a204d9-e162-405d-ae01-b8af0abfad47", "value": "T1F4312CEE41141A381212CADE73A23648F11C92EB2CDFC794DD4D5EEAA64C5DCB252BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088822, "uuid": "76310603-9902-429e-b558-4f435cf89a21", "value": "24:rBPYU4zSj/J/mOYz/QoYehY7XO2lUl9Nl:lYU4zmxaIolYZe9Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088822, "uuid": "8f229162-4b29-47be-89b7-cb71a1fea206", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088822, "uuid": "4d7c0275-3098-4a15-9b5f-098dd2586a91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088822, "uuid": "91ebaa3d-3c93-4eab-b35e-b9e56baacfb8", "value": "0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030dfc22-8926-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785093177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093177, "uuid": "9766090a-620f-4fd3-a475-b9e9b104f634", "comment": "Malware payload (Mirai)", "value": "a7772434e4d86715756c3b5844ec46f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093177, "uuid": "f7c2af44-c1d0-4f10-b417-8c0d3e2d7331", "comment": "Malware payload (Mirai)", "value": "0ce97c6a160fab6db1246fd2f4fc0a932b2ada179e42a2d66005e2dbb3a6a8ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093177, "uuid": "8bec92da-ab0f-4454-ac5c-4bd490484123", "comment": "Malware payload (Mirai)", "value": "bb2ca764d73257c4c78277e7b99cd27eff4c9904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093177, "uuid": "4a401509-77c4-49dc-8933-000a0e51dbc9", "comment": "Malware payload (Mirai)", "value": "c8c61489b65e4f3d8f400a5b0536d24546847285f0751e7c6c59981bfe0d1cbd7097915e860d661c199e79ed9bda49ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093177, "uuid": "22c0c502-d5ef-4d83-b32d-24a22192958f", "value": "T18D042A45F8808A17C6D652BBFB4E428D372A67A8D3EE7107DD215F21378B96B0E37241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093177, "uuid": "17b94af8-6416-41b1-8e23-7bb946bda1a7", "value": "3072:UzBy+V95RRwNROuUw8hsXej8CD44ZU3csF6NnAfADBgR:C/RU0rIG44Z6csFZoDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785093177, "uuid": "81b04fe0-cbc1-4504-b35d-38e0e453a4e3", "value": 183040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785093177, "uuid": "42a3c31e-be70-4a44-b63d-b0374f2a9238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093177, "uuid": "ccab49f7-30ea-4e16-a4c3-5b0938bbe937", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbbc1fd-890d-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785082508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082508, "uuid": "96e61389-5ad2-4dc9-86a5-7f5ffb865cf1", "comment": "Malware payload (WannaCry)", "value": "0169a2526affaf05fef1de989bdfc0b7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082508, "uuid": "a5c89a9e-b3d6-48a6-b435-8e894f00ee00", "comment": "Malware payload (WannaCry)", "value": "0d54979efdd2af02aff5084714761a34041d844e34895b9a8401e884b3b47bf2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082508, "uuid": "c7b11a5e-a2cf-400d-b8c7-ed6ef0a33882", "comment": "Malware payload (WannaCry)", "value": "d8062d408bbb0eaa12524cdd6db14f8082a91423", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082508, "uuid": "7873818e-864f-4c60-b28e-af27b1f05ce5", "comment": "Malware payload (WannaCry)", "value": "36fac82130c6121c5ffe160ff995b31623d07e0eafde85f5a7c5b680bffdc46dabb3381f79642cb0c390013a4292fd94", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082508, "uuid": "e74d11c4-0b24-4319-a811-38e94139d53b", "value": "T1193622652F6851B8D2970E704F73CB15A77AF8ED8EA74B0F0B4CC2560D82A466E77E01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082508, "uuid": "d070d37d-059e-420f-8295-795ae1dec4dd", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082508, "uuid": "c59cdece-5f5c-42f5-b0ae-9f6673bb8959", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8:DyDqPe1Cxcxk3ZAEUadzR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785082508, "uuid": "12c2babe-6519-4664-9d0e-4d6af04c880f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785082508, "uuid": "76a2b555-4d15-452e-8e3a-d29ea66c631a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082508, "uuid": "108e2486-e68d-44d3-a722-f1de359ce724", "value": "0d54979efdd2af02aff5084714761a34041d844e34895b9a8401e884b3b47bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8058b25b-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785069336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069336, "uuid": "ede783bc-3271-4281-99fe-fcda989371cc", "comment": "Malware payload (Prometei)", "value": "7c2194e9b4b3f5b3ac96d19a484f0dd6", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069336, "uuid": "fcf57295-cb80-4139-8c78-02e790336ffc", "comment": "Malware payload (Prometei)", "value": "0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069336, "uuid": "6ab8af78-b983-4d09-8853-bb2a11c5be43", "comment": "Malware payload (Prometei)", "value": "7f92c229ef7e8bba3f75b54b8932085861d589f7", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069336, "uuid": "3d9e0c47-d837-4672-94e2-4981181d7832", "comment": "Malware payload (Prometei)", "value": "56ce90e7aa79ceda8d7d303c319cab346c6d031b300244a5925af706f67535e2d8883ae4a5dad1e9fe9087afa2eb5894", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069336, "uuid": "b2a5f214-6b55-47e3-ad86-04877320b59a", "value": "T173F081C1E03408349A926131914275D8ADA558AB742091686CFF8970F57E5143AD7AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069336, "uuid": "0973e1eb-e43d-40f3-802e-05bba8bc3934", "value": "6:hgfIRVFUYihyAl3a061AslIk0oHkcYuZ9IWoNbKY3FPLa240QFhRSqWq7v/F58rP:MIIhyy3w1vlI7/H2/NdMI8n8aLl6pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069336, "uuid": "bea47893-6183-4e7a-8bf6-acab628d31e1", "value": 573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069336, "uuid": "00d8c198-5f94-4000-bac3-a16f5d1fa0c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069336, "uuid": "63f67291-eab1-461b-96c8-5af56331d36c", "value": "0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b60fa4-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081161, "uuid": "73a87a30-368f-4370-a708-baa593599701", "comment": "Malware payload (Mirai)", "value": "ffb87a56ebd449d4570760073744e019", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081161, "uuid": "144ef228-3b85-4e4a-93de-42522b98b0f3", "comment": "Malware payload (Mirai)", "value": "0d88fa32792751a6826c64c6493fb48ea00474757344b13d56baf76b1f51cf1e", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081161, "uuid": "ce5e11d9-6f9a-4c10-b564-05c1ad0213e8", "comment": "Malware payload (Mirai)", "value": "e3ac2faf81954ad27facfe3397b17155a3f73e7d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081161, "uuid": "e87f07c6-694f-47a3-867d-06a2692d2b7a", "comment": "Malware payload (Mirai)", "value": "1d91272cd6b933481a4ecb710a78724357bc45c81622d862ce5a5ba50a9fe185438ed7e2c8fee8c9e87525e4dcbdf15c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081161, "uuid": "9920ba88-eb76-4192-8910-44769fbd7a2f", "value": "T17993026FFE43CBB1C2581AF1844DD62794C32690A00D63E12F5F662C5B672ED7F212A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081161, "uuid": "02730804-8cc2-4e16-9d9a-5de788e6122d", "value": "1536:JRSER49ZfBQAJtox3EyTHr4cA0R2/ypUb+VR+FqUmmsTX4tAklOrqNflogChY+t1:LuFmADqY67kFnN0XPkcrmfWg01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081161, "uuid": "b3c70419-4c48-4c65-ab49-ca00945db8af", "value": 91356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081161, "uuid": "6b629fcd-6454-4d76-9537-22f9e21d3a9d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081161, "uuid": "22639042-cd4a-4b2b-a287-5c3a067cd3ba", "value": "flutter.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4343df6-893f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104319, "uuid": "512ae9e9-cb87-4450-857e-be51153a44a9", "comment": "Malware payload (RemusStealer)", "value": "6a0a275f424bd2dd34701768c384e900", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104319, "uuid": "88a84630-1bb2-494d-8500-71c8a2786336", "comment": "Malware payload (RemusStealer)", "value": "0eaf541c66a2384ff77265a9e3e2bf11300d0c47642b1d953b52843e6365d659", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104319, "uuid": "0d830387-7a5f-4aa0-a15f-1cd94b5e66e9", "comment": "Malware payload (RemusStealer)", "value": "8ccfe59dfee26f101164bb91a139acfdbd54ff47", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104319, "uuid": "edd9472f-3b7f-42b4-a833-b364c31a8070", "comment": "Malware payload (RemusStealer)", "value": "eb76d8ca38a1c9994777a63e62329cd29d612005c8079f9805bc27a7ccb5b3cf78ba5ef0551eb4b78e6ef2a3e602e9c3", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104319, "uuid": "c5004068-e602-4a23-a479-9fab29c8babd", "value": "T121C55907BCA109F6C0A9A33189B25252BB71BC085B3633DB2E90B7782F727D19D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104319, "uuid": "a9f86336-2133-4cf1-a254-397e00341cbe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104319, "uuid": "d7633c8e-1e1e-4776-91d3-514911566707", "value": "24576:PMjTQI/qldwKckLXWCxaZo2eZQzsH3n8luoHR6wRA0nQB5/s64/PZoBele5I9DUQ:PMjjilGzkLmCxaZKZ7sZQBiCqF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104319, "uuid": "4f3a6177-adec-4b0d-a5fa-3629f3433aaf", "value": 2613584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104319, "uuid": "8173e358-d18b-4f73-985b-255c8d6244e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104319, "uuid": "ae3269d4-58f2-401f-97f7-634e6e67f64d", "value": "jhgkuyyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d94f05-88d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785059061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059061, "uuid": "d8ae937c-e68c-4dd7-8c1b-ed162e1aa44a", "comment": "Malware payload (Mirai)", "value": "dae5911bdd196d0f2c18fc5fb2b9b5c0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059061, "uuid": "e3f6e2ac-714d-49be-bcf5-3c4b1b87be0b", "comment": "Malware payload (Mirai)", "value": "0ec262385b9a7c53a0059ce514110334893ed42f47843b3dd7284fbbb9ac5618", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059061, "uuid": "a2fc0149-a1fd-446f-ad72-ae8a3e7a7be8", "comment": "Malware payload (Mirai)", "value": "93102027ccde544f5cda15969f3aea28fa3aff71", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059061, "uuid": "85662ba4-d6f8-4e38-bd85-1e95d61dcaf9", "comment": "Malware payload (Mirai)", "value": "8a1c417bc941eb81cbd207d36386ee88cbad8886779314dc379fbefc87de5edde71797d9c066446b44d9992fa2ba50b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059061, "uuid": "be40543d-6ed1-42a7-b47c-59e8b37fbd46", "value": "T1A001ABCAE26099104169D95E72AB51A0F420C3C6468B0FA87FDC943EBF8CA04B126F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059061, "uuid": "877812ff-a9bc-4859-8ca1-eb76224b3674", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkai1CUEbSCJb+Cgdjsic8CyWHvCmZ0auD:kXCKysE2hi0ziQvZohaS/JtBdDVyJZ07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785059061, "uuid": "b3543804-e9e1-49f9-99fd-14aa5d30b455", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785059061, "uuid": "966a225a-b6c1-46f9-bf86-a5bd5c90eb87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059061, "uuid": "90ad22bb-4132-49e6-9dcf-786339782413", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d24eb1-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069860, "uuid": "c7acdfb0-eb19-4508-8de3-f5d239a1291d", "comment": "Malware payload (Mirai)", "value": "d27fd8583d016459268d1e67ce318670", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069860, "uuid": "c1df1bd4-35d1-4c01-a605-b85670bb0aff", "comment": "Malware payload (Mirai)", "value": "0fba7666a043954725ca75b4b287176b4d5010cc9d7a3d898829709b68922367", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069860, "uuid": "bc676b3c-4a76-4b42-abd9-e0d550da32ca", "comment": "Malware payload (Mirai)", "value": "a49a1b624152c5aa066f9713eeaa583a8735aefc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069860, "uuid": "fc674b37-bb8b-472e-b260-5ccc895d84b0", "comment": "Malware payload (Mirai)", "value": "2de214a4eebb20359c799e5048963cb1decdba8e6295b504d1ee11d2df2f9e6807c7638ad1f1dd267f6e94ab8611dd0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069860, "uuid": "aba35390-7cbe-4ea1-a800-23cf38bfa02b", "value": "T1C603F161D68F9C70C8304E7DEAC89C897F6259B4D0BF645B0EB48724E7F054875BD286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069860, "uuid": "c570404f-2c3b-4e0b-a779-8a58e3657b8b", "value": "768:Gy0jeXW6qv2N8aJWY/oW4FPndhzAEDw/fm0pa81UGY3/w9q3UELJ:ZNW2N/QkEc/fmG1iGYRLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069860, "uuid": "02f82869-f9f8-4166-9227-5f8a82280f90", "value": 40220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069860, "uuid": "2ccd45f6-e91b-4ec2-838e-848a310bfdfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069860, "uuid": "25c788bf-a639-4ffa-b842-fb9fd8bb95de", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411cac0a-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069659, "uuid": "224e4492-7719-4e16-8812-afb085d55f1c", "comment": "Malware payload (ConnectWise)", "value": "43926e44c6f54991fe030fbe1e1f4369", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069659, "uuid": "eece1f41-2f68-4db0-a414-992cee5bdbee", "comment": "Malware payload (ConnectWise)", "value": "10f6149e4d153273ef676dbaa816ca1d883e1bdf11d0dde6ccb45e838240a1b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069659, "uuid": "92ae1b58-7b30-4966-992a-cbf9e6acaf54", "comment": "Malware payload (ConnectWise)", "value": "954c40e08f0a56229d4d12cb67bae55aab43c926", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069659, "uuid": "2867a915-d0b3-4bd4-99bd-3f8cae9f8eed", "comment": "Malware payload (ConnectWise)", "value": "6fa9c5783b178b4cb40d7fbcf38be78229358bed5d0a05f5551fe370645d976b8e18972e83dd652aa7ba548168f3177a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069659, "uuid": "58f05b2e-3d07-4ae3-9531-13e4a47368b7", "value": "T1D046E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069659, "uuid": "9af71bb3-5822-4710-b9da-3d78a40d5b10", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069659, "uuid": "b5f9e7fe-1f79-4ecb-a850-ceaef654e8f1", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069659, "uuid": "9aa92a4c-4fa0-46f9-a206-2f1fe126a2a0", "value": 5641496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069659, "uuid": "f120d803-5a61-4553-bd42-c75ea38be4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069659, "uuid": "278e0765-fb76-4745-9160-264b1d077deb", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdf5949-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "5d94f21b-48a5-4b24-b2ae-5cc12fc6e875", "comment": "Malware payload (Mirai)", "value": "c0e7c1c4b70a6049d0992f0ddfea0e26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "bda081a1-1792-4a70-b939-53e4c19de7b8", "comment": "Malware payload (Mirai)", "value": "112f69b402c11b73cca7bb0a59654c497383a5f437aa8e52cd0f75005a0d0ae7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "617fb0e9-c0f2-4512-9195-8858f9ec72db", "comment": "Malware payload (Mirai)", "value": "323791b08324cc8b202f48a04e63b10228db1790", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "3c1f7ca9-f070-4549-841d-f0fac5ea1150", "comment": "Malware payload (Mirai)", "value": "56d8335e1c8c70b17b4e517c881bb27afdebd08d99120a5b29fc73c0369e079ae9a64bd613ff27621182cc417a4057bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "e2e2e577-7567-4119-9ad2-1d6b87e96f6e", "value": "T1EC73285AB8819B21D1D123BAFE1E118E33231BBCD3DE72169D145F2177CB96B0A3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "ff4db4a3-d29e-48ca-96f0-58fcb14cd099", "value": "1536:LZnAYrB3VhOyHNxhPjj9vhZyiP+8IQJe+a6j03CMPgi+KMS4yiyBaW50YgO:6A3+yzhPP9j+8IQJfaiKN4yiyBaWCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "030c6921-dee2-4b06-b42c-08b117a33e58", "value": 80296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "5d39fcb8-99f8-478e-9a03-026168e84eab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "1fd8de53-4df3-4050-8dd1-b8b1f26c5120", "value": "karm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac32b38-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "ebe17c0c-9a5e-498f-b054-7c8484bd024a", "comment": "Malware payload", "value": "4041eaa77750c8dd7ae7cee6134620c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "ecfc3713-5327-43e3-85dc-fbebe2aad5a1", "comment": "Malware payload", "value": "11c39cb6c241fad31b89906b276831eb7d0431ad8ad69ed45a0e99f77fa80a88", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "ca797fb0-91af-4572-815b-f9f1b1cf6263", "comment": "Malware payload", "value": "8d9b8553a2abd050070aa5eba589dc8e57fee8f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "32191f04-1a33-41ae-8809-104dc26c7a5a", "comment": "Malware payload", "value": "fbbc849682b59b2715dcd48e1166fa4164147db2129cde577780e74b674bfb171d0620b5c53be1f19e8b21b395e8fdb2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067930, "uuid": "096e0f8f-5ebc-448d-bfdb-01e0bfd87020", "value": "T16BF03C8F0623E81189435DF7F1928920E951EAC86BE28F9CECCE3E764254A0030B3E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067930, "uuid": "a6217aa0-8c4b-4e91-83c9-d6c6f4eb754b", "value": "12:my+KWK4Gqf0E+r0EE370Eu20Ee0Ep70Ewn:mjbHGEbE5EuNElEpoEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067930, "uuid": "be1efc08-e788-4567-ac5e-6f55903172c8", "value": 591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067930, "uuid": "a21509b4-83c5-4cf3-8793-37fefdd45fb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067930, "uuid": "9d64f511-fb8a-4f66-859f-e4280434862d", "value": "d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0933c67-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088341, "uuid": "735b8d92-1587-4e1f-808a-eb73c38b8968", "comment": "Malware payload (Mirai)", "value": "9ddc197487e7e943b5d61cb07771619e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088341, "uuid": "dac10db9-3476-49a8-a91e-cddfeed99226", "comment": "Malware payload (Mirai)", "value": "1244de4b548cab663276387684a4bcb3987ca7c84b94faf0c13084bbef8d980c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088341, "uuid": "609452a6-9d2e-446e-b5d2-1c30558d96d7", "comment": "Malware payload (Mirai)", "value": "1e8f59db389024021c027a268a5acbfbf4e8d5c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088341, "uuid": "91ebf6c7-e065-4c6a-ad2e-a71860557a06", "comment": "Malware payload (Mirai)", "value": "91a735c038c291ab6f319dea5d830bdbe7a4f69370891b96bcc4036d425a8bf5ab8559a2a92269110bd0f478f3a68dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088341, "uuid": "6bf8225f-f8fa-4da8-9c93-205a125ebedb", "value": "T115C36C4673180F47C4930AB01E3E3BE987BEE5E421E0BA8A650F9B564675DB7144AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088341, "uuid": "a9a0067a-f5f2-4339-89c6-1fb800437f74", "value": "1536:aomlj+GZ9yPwTlm553joeiVNa9LADo4F1+FmY5tNVYvQHSvB9:ao4w51jo/uLCFImEXHSvB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088341, "uuid": "c8c2f24f-20d5-4705-b2e6-2c1e7452b300", "value": 121348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088341, "uuid": "9e63508a-b0ee-4e0b-b555-0d5252a3111f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088341, "uuid": "5c0aefeb-60c2-4f65-9ac2-510d0a7cef11", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e336c9-8938-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100960, "uuid": "ca908f6b-4b1b-4613-9326-730003149973", "comment": "Malware payload", "value": "73fd97bc9afc00c3614ed21b1985c900", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100960, "uuid": "e1075a66-e9a0-4771-adc4-6b140e3b3d01", "comment": "Malware payload", "value": "12f1e8ea44fae73b7636824985c04866d44dce4c76c203fe4c547d781416b900", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100960, "uuid": "14217df3-a1ab-4f11-9391-9e9ee45d86fa", "comment": "Malware payload", "value": "469464b0c4c77e5d204c5510ff87eea9cdde1e4b", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100960, "uuid": "fc0daf18-a8e6-4d71-b748-cd07e6229548", "comment": "Malware payload", "value": "9c50ec28e8fa7f8f1e923b35fb383d5eb68a81546a035a020cf18f307b5fd50092bbbe4c1047b49593fc92b3cb0962f5", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100960, "uuid": "b9ef2c0b-afea-4771-909c-326c61c402d4", "value": "T1BDB3AC78DB0928B3FE1515B0766920171CAA1EBB3821DC2AA6D7384F2387F317D74E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100960, "uuid": "1091bf35-9979-4cc7-9492-fb2fe92f596a", "value": "3072:H0dusU9ShDX6cohyYprqzN/S2eRtfmOeQSzgI:HEU9ShDXFyyPh/zA5mMSzgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100960, "uuid": "b14c8cfc-5417-47e7-9289-2e4898b6f744", "value": 117984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100960, "uuid": "802ec1db-0f40-482f-b792-152cfaaa3a1a", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100960, "uuid": "fa2f3d9b-231e-4eb1-8a9d-a2100c1e8219", "value": "Launcher.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb91c11-891e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785090055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090055, "uuid": "92618c05-8432-458b-8e6a-f7f82ff9444f", "comment": "Malware payload (Mirai)", "value": "85cdc28c92052b0110049d5017f0b4d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090055, "uuid": "fb6b2504-f521-4629-a71a-08eed58c485c", "comment": "Malware payload (Mirai)", "value": "13e711f65f349457645905e6a1ee05595fdeeaab98321fa60598c61f940ced71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090055, "uuid": "980668fe-4275-4f26-8d44-e2430cad496f", "comment": "Malware payload (Mirai)", "value": "5b20b6366a6a1a810cf6333f11921d948ce412c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090055, "uuid": "bf4cb506-c4e8-44af-a201-05f46f375ec5", "comment": "Malware payload (Mirai)", "value": "0925e08e8aade1d451c8938ca1b71b15289c559388b47f92fb4fb412379b77ff1dcb09570f6a9f7f761b6142bdb99883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090055, "uuid": "c17d60e3-69d8-4564-aee8-b27c59c92efc", "value": "T16F34F90AAB510FFBDC6BDD3702E90B0625CC641722A52F367678DA18F94A54F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090055, "uuid": "0cbf8a06-3a16-47bb-824c-b09b9c39746d", "value": "3072:w395LHWeSiRTHBVtPSkHDE4SfhOz3+oAG5VB3v0B/t:m912n6HtSWWho3U0/0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785090055, "uuid": "d24bcf95-020a-41c5-b272-9ae3f80f511d", "value": 248516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785090055, "uuid": "592b4b2f-2431-4b9a-9c5e-7ad4c53491f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090055, "uuid": "1543db53-7ce7-4432-992e-2b1c4f206dbb", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff82a185-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785069549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069549, "uuid": "dd3328f3-7c5c-4e62-b2d2-76d4a8cb7005", "comment": "Malware payload (ValleyRAT)", "value": "9ebfabc11a98ec1b565de269b5e0d4cc", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069549, "uuid": "b8f47e94-5f37-4dbd-8dfd-205a80f08e73", "comment": "Malware payload (ValleyRAT)", "value": "1472743f0616bafbb4ebd6493538c41195a2ec63a1124f2363c3546a8f04811a", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069549, "uuid": "187c1fec-323a-446c-a280-424907cadf11", "comment": "Malware payload (ValleyRAT)", "value": "3d889b4805613dae5f1ea97dd4d2a9fc3cc2e7c0", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069549, "uuid": "19c894f1-ef31-4244-8e43-7da50cc03319", "comment": "Malware payload (ValleyRAT)", "value": "80c50c07f0a6f6396363aa181743fc14e0cf83749b9a11dd4ce81b3ea3cbfe920eb52dedf1b0b0e9783a41cd7160b798", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069549, "uuid": "0c839275-35f7-404c-9bc8-9fed0f1ecc01", "value": "T18B8633D0BDCAA770D187CBB12051752EBE657F09B6260D177F8E7E002D37A229A72B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069549, "uuid": "c1f8ba8e-b873-4156-bb30-4e9044de9be6", "value": "196608:FXN8ZXIT19Tdhf7/LMAnwtQL8ewf7QPBkFnErkla:XC4T1jaZqmznk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069549, "uuid": "5ded65c4-f138-49cd-a822-4e7e59319381", "value": 8073216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069549, "uuid": "d2031900-61f7-44b2-8b17-fa3ac29b6944", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069549, "uuid": "2ea4010c-8ef1-494e-8853-30d9ed62fea4", "value": "intll.1.zz011.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d86cf17-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081169, "uuid": "673499b9-5b28-4c85-8153-6e5044e2a7f7", "comment": "Malware payload (Mirai)", "value": "96950b5079e81927fcbae612a286694c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081169, "uuid": "83fa997d-997b-4373-9772-1989b0741ba6", "comment": "Malware payload (Mirai)", "value": "1527756ad4ebcd81203830ca6b9b0f4d28f140769b3890af5f3c6be353995750", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081169, "uuid": "c9e7d664-ff96-4c7d-82db-e3eb437d6b21", "comment": "Malware payload (Mirai)", "value": "de9e2bc7e66e885cab3a1ebbf598dc37dd9f19bd", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081169, "uuid": "37562ac8-9727-44ee-974d-663fe6c0a6f7", "comment": "Malware payload (Mirai)", "value": "45b34f94b7180247a03f4a8a8e0089e854c6d99b857e266b6ec458e3dfc985b2b5621bab5e037eeb750f723e82fb8ad4", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081169, "uuid": "e965d03c-88b4-4f5c-895e-f5e210de388e", "value": "T1E593017E78090467F9C490BFE11829E7FC9E24201769BC10F586189B9E1F4AE94F96E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081169, "uuid": "535aabc8-bf9f-4ed5-b6a3-ce254c3cfb6f", "value": "1536:ufgDbXrLsITCPvKdtgjeP6qIWcydBqX6BGjDRp70P42jrOys/a7H3Kw0vWqDi7Ie:uYD7UITqStseP6qsGe/L842NKajKJY7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081169, "uuid": "a794b22d-c8c6-4c60-b070-92d6f6b85d40", "value": 92872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081169, "uuid": "a220375c-542a-41b8-b7cb-ae88069f4ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081169, "uuid": "e8007352-88fd-4c08-b58c-e39f80336181", "value": "flutter.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9242e36-8929-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785094852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094852, "uuid": "bff8d90b-ac32-4c55-8c4d-49127d59d364", "comment": "Malware payload", "value": "f79d2e1d04a85fa522d1d0252e671a26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094852, "uuid": "57235d4f-ce7a-4284-b6d8-c5a18d8a118d", "comment": "Malware payload", "value": "158089dcc6e71e5f6dd212dfdb7657414f3eb540aefed1d82c6b9b56195956f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094852, "uuid": "b67f6ac4-ffbf-488f-a97a-942d12f279a3", "comment": "Malware payload", "value": "29d5a93ebd81bbcbf84f442be87d875062a6ab4a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094852, "uuid": "27867104-f820-4a64-bac5-d00f34c287ca", "comment": "Malware payload", "value": "2980dcfe83840bae56a131ba59e1b835d24aef9ab67d0c94f9c1ab2a0754eba511deb22d63459c7637eb908b02844ba7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094852, "uuid": "365044e9-dfcf-463e-ab10-3e06ff60a1fb", "value": "T14631449F405814099E478D01F075EBBF722BEFBD93B57709DA8A26739288B6030716DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094852, "uuid": "980c357d-82eb-4ae8-b795-fb1d262ea5a5", "value": "48:aOc4LgshXAbxBp9C+C/CRyDqHTCDW1sVkF8:aOc4LgshXAbxv9T0ayDSTCDW1sVkF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785094852, "uuid": "a08ee50e-3f7c-4b53-b572-77cf037981c0", "value": 1791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785094852, "uuid": "c73d0c6f-207b-4334-a42f-9f59cf4a6bfe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094852, "uuid": "be03b0bd-f913-4ad4-b372-46a69b81be0c", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242d236a-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044270, "uuid": "3292ef91-b602-4368-ab3e-eb1c59a4fbb1", "comment": "Malware payload (WannaCry)", "value": "ca53df54d9c9d33fe719d666c46980e1", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044270, "uuid": "ccc9c89a-cd47-4904-9234-ba094497c9b9", "comment": "Malware payload (WannaCry)", "value": "159305fd32c30428e76f8f9e2a3da3969d89f0715aa315c9c21f7f7205c2764d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044270, "uuid": "d17b8193-b7b4-4749-ac82-eb7622219b9c", "comment": "Malware payload (WannaCry)", "value": "d2e66dec99f6d32a1cdc4d93436570948255e5d4", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044270, "uuid": "acf031b0-2a62-44a2-b2c6-1dfad7c7ba56", "comment": "Malware payload (WannaCry)", "value": "e57a10b6dbaef02f3321c37dcf5da56337837f87b44cc6c893c8ed6ae2a6e698f34279b6548dce8c3e989e4d6b7e49dc", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044270, "uuid": "fcd75ba8-04a8-463a-b3b6-961c18ee6604", "value": "T10636024ADEB84BA9D034C279ECBB4551A3BEB4C81E554F0E478CE2352D432247BD1ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044270, "uuid": "d4737788-e542-4241-8305-4d2ea96781ac", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044270, "uuid": "5a72c473-1ef0-4495-b8cb-2089356e750a", "value": "49152:jn2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9q:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044270, "uuid": "45458651-2b67-46b5-9ac7-5c1261332ed6", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044270, "uuid": "47d68852-15e9-4fc8-97d5-82b910d0110f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044270, "uuid": "cf16f69e-4d64-4348-a38a-6878233f0589", "value": "159305fd32c30428e76f8f9e2a3da3969d89f0715aa315c9c21f7f7205c2764d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2747f0d6-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081212, "uuid": "a46607d1-67a1-46e5-9fb4-ea8f837e73e2", "comment": "Malware payload (Mirai)", "value": "7e12f0ea9cd7b2ab46dc7ea00a7279f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081212, "uuid": "a69f9f80-5fa1-4b54-b0bc-f410c8685dc6", "comment": "Malware payload (Mirai)", "value": "15bae5af4c9cb18f81131f56486728404fbeae6adda50ed9e56cdbebc4b01000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081212, "uuid": "171ab6aa-8ab3-4f3f-bfce-1f80b5c903c1", "comment": "Malware payload (Mirai)", "value": "43843564f63d4236e7baeeaa492f97213a895700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081212, "uuid": "eabb6712-d5a4-4213-af90-c80dc0ef475d", "comment": "Malware payload (Mirai)", "value": "7a8343646f90e6e159211cdba634ac9fc45e2ad05fbb98c6d8f7471561db2c09a740af96b0d9fa5c93120aec5cf60777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081212, "uuid": "a14f54c2-3437-4ca3-946e-f11b48f40539", "value": "T102344A8A9EA01EDBC46FCD30062E871719ED599BA3F1773AC67CDC48358E24946E385C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081212, "uuid": "560dc184-1f09-4fe8-801b-2bab7b1c3cca", "value": "6144:U36gAOnXSgXgDkqTJq2hhFIlIcahfP4TpCCHJlzK/a8t:/9KXSgXgjTJnUI2YC6Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081212, "uuid": "70d05145-ca50-4c1b-9e1e-0f7fd350c28b", "value": 241720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081212, "uuid": "ed74098d-1a5d-45b5-8a1c-696c729912ea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081212, "uuid": "ec001449-b652-44f8-a16a-013c9f73e13d", "value": "flutter.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2b7731-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785068842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068842, "uuid": "b7378ed6-24c5-4138-b6f5-598fe1254470", "comment": "Malware payload", "value": "dccf24d26aca8ae5fe73a7eb42beab0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068842, "uuid": "1562d702-3899-4366-9b70-9c363e73a2bd", "comment": "Malware payload", "value": "15c0fd86e94ba4100bd3509c30527c557aa7921160af19697e4c86efbe9a2171", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068842, "uuid": "4481b8a8-8261-4ef5-a043-994567e17c39", "comment": "Malware payload", "value": "940b18d1001cfb3c91f3760a78ddeba5d72d1707", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068842, "uuid": "6b0d3ca5-f1d0-4143-986d-f9a065942f45", "comment": "Malware payload", "value": "44e747a1f88ad515cd92488b82f5eda2cb57a2e597b5889225474d233c5f64d682e07f8dbfee1bfbc545555b895b2435", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068842, "uuid": "ff27ce25-19b7-40a4-8884-ce98b403a901", "value": "T1D0C01284A48D71349B286A0AE0694B31F7CE8C106A93FDC181C48081FC9EBA2B308F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068842, "uuid": "defc2d48-51a6-4180-9103-7c4a5ac98896", "value": "3:zJFqKXIFYtKSnXWXRRn1LVWDKRCuRXstKGB+/iastKLKNgLWX9tgz:zJFqKYOKSnK8CCpKGBjjK+Jjgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068842, "uuid": "48dd69f0-23b4-49af-b169-11bd048a33db", "value": 178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068842, "uuid": "a3311bf9-8d8d-45db-ad6b-13c3d03d4d7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068842, "uuid": "642ab092-1e28-4a6f-9e2d-c920819265cd", "value": "load.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286c6518-88fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785075201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785075201, "uuid": "a42c2268-4673-4e00-bb49-718bc1d5cf5b", "comment": "Malware payload", "value": "d35d5d91ec308380ae23eb5b528bb41e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785075201, "uuid": "87cf6187-94aa-49e1-b021-55709ace5657", "comment": "Malware payload", "value": "16cba6b486585767891d571e466b610d6492a0286dde9be072a2edf00782503d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785075201, "uuid": "d7bcf295-4216-4d3d-bcb2-1b52c00e02ba", "comment": "Malware payload", "value": "1ae323780368bdd8779076fff184a9180ee0df7b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785075201, "uuid": "05fe1145-965f-429c-82e1-48d8c16f7343", "comment": "Malware payload", "value": "619f6fec4f0eca5b46edfec103f57f7468d5f109cd5d4a0911795dacfcae4e7ddaea736e7cc93d07864189d789426083", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785075201, "uuid": "fa5ac7bf-6346-4f92-b835-29699621056b", "value": "T1E7563903EC9155E9C0AEE6308A669253BA717C485B3123D72FA0F7382F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785075201, "uuid": "339a3080-eb33-4800-82bb-d38c05d8480a", "value": "49152:kn9HtgxMP1N6xjl4GUnAnbdGLzZ5eaV/qhO7riezLIV27+EoT7PVPlLHK2KDKnkQ:k9NyYydaA4IVt79ZBBsED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785075201, "uuid": "ef94c1dd-d6d1-4bee-bb0d-f02925bb3fd8", "value": 6430904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785075201, "uuid": "45fb07d0-f0ee-411e-bee4-2d86ae6e90e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785075201, "uuid": "0df6a7a7-76de-4c3b-9964-691ecf0a59bb", "value": "agent.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9905089c-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063364, "uuid": "7c49fa38-d60d-43e0-8f8d-e7b6496c63e9", "comment": "Malware payload", "value": "5b3e427b2674ae860a4fc653bc8d458a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063364, "uuid": "52e8426e-7bb1-4ddf-92be-2d68df51c181", "comment": "Malware payload", "value": "17d7b641b8d0b35a3e1eaaf3f3c363b1783b7cea6d9594b1dcfb5bf7978cbf98", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063364, "uuid": "fc0b9f0e-98c8-46ca-b1e9-3ad158dc6694", "comment": "Malware payload", "value": "f294032e89d85535ac1f5a26cb0a2dd469ff7c21", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063364, "uuid": "fd6c9e7d-5635-4c5d-8804-394fbc246eb7", "comment": "Malware payload", "value": "0024dab33da1837b988aa898ba363ff08af1ca2f121f4777c2bd4f89a36d3e4eab0ebe68623c7df19881dd969d9d84ac", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063364, "uuid": "442b883d-1c9d-4bbd-baa5-5f4bfcf24791", "value": "T19B85337F1D820852C67974803B7DCA2CB4061B7B7765FBC054BFAE1B604B84BE9CA612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063364, "uuid": "cd092c72-9fa3-4628-a572-7efd948e71ec", "value": "49152:Qqig+JvNV/1zc2Ti8Z9XGbtPI0GilETkO0di2M:QVFJxy8b2RPdur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063364, "uuid": "4740e9a4-f699-4fed-b433-c3a80428c3b0", "value": 1727052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063364, "uuid": "9735df99-3148-4da1-a75d-68cbb2459e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063364, "uuid": "1727b777-9e2a-466d-922b-d6ea2acb81cd", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594172c1-88d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785059392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059392, "uuid": "9447f44b-806c-4b0a-9637-4d3a936acc32", "comment": "Malware payload (WannaCry)", "value": "3fdfc1f013bad7bb63fd7a254c8a8e5e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059392, "uuid": "7af95913-813a-435c-88a4-88ed33ab3f6c", "comment": "Malware payload (WannaCry)", "value": "18cc4bbb79751f3fc98e834376dfa6f2eb538fed44b73b832714e6291ea272f8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059392, "uuid": "6a90dc62-ccfe-4799-b268-c32be0297d04", "comment": "Malware payload (WannaCry)", "value": "5e73c34c36bf0f25c22b45b8299c1be9c87d5523", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059392, "uuid": "139f2701-917d-4c15-9d5a-361ac6753025", "comment": "Malware payload (WannaCry)", "value": "fe876c42f66fd2ca25de6175bb597dbedc45bc9de964223307036a9e339dc15539b2bb10822106e6d4eaea26cbfb434e", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059392, "uuid": "a5f5a925-90d2-4c30-8f35-764489ab940f", "value": "T1B4033B5933E040B8E4A36235CCF29E15E37378475379974F4268866A1F637C2AA3E372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059392, "uuid": "4a3ebe36-c587-4013-870d-5578a622d495", "value": "768:2OLgYfly/+lAFK5AUf4JMTUiI9ghT/n5buk6pSIzrnQH5sRPCXxkDM:ngYfl6LEVTCATBbD6pSgr+sRPcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785059392, "uuid": "126589d4-9f4c-4c13-b0fd-2f6ca9c06b40", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785059392, "uuid": "e9ca6e4c-24aa-4447-8e00-cf5eaa8f44a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059392, "uuid": "2fc603cc-6e1f-4e71-b318-9498f41fc737", "value": "18cc4bbb79751f3fc98e834376dfa6f2eb538fed44b73b832714e6291ea272f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43e2a1a-88e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785067329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067329, "uuid": "f560495f-3484-48d0-97b2-15367cf1df50", "comment": "Malware payload (ConnectWise)", "value": "f5ec392cae1e2e0c6f7ea66af09dfecc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067329, "uuid": "c1405512-5492-403d-b4b8-af05e60d7aab", "comment": "Malware payload (ConnectWise)", "value": "196cf41545220b60f88fc9fbf0211f03f97bb0b6b840795091f2973ede7ce7fb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067329, "uuid": "c746f87d-456e-4855-bd78-049402b9ec1d", "comment": "Malware payload (ConnectWise)", "value": "0684752b8ebd9afb616cc267ba83616408aa561e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067329, "uuid": "44c73cd6-6eb1-4e45-8609-2e1e4803f7bb", "comment": "Malware payload (ConnectWise)", "value": "7816bbf83d404343c1dd0f613618e291b5fb7e4e1ad26e13f7ba61b278bf0be178703773af6f86ef8c373589bfe86cea", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067329, "uuid": "e0b15fe0-1a3c-4dd3-8966-69ae7b7c6145", "value": "T1A6647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067329, "uuid": "0eb77c29-e7c1-40d2-a993-c08ea7ca6861", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067329, "uuid": "f2df4915-dc62-4e33-a418-4e6595b886b0", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067329, "uuid": "482c489b-257e-4c62-97ce-21983ef070ba", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067329, "uuid": "43124100-4a9f-4126-b4ce-c2f780398780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067329, "uuid": "fdec6651-576c-4a46-8981-f7e14e5586da", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d194bb6f-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068613, "uuid": "60231b66-38f9-4094-baea-2aad4f471588", "comment": "Malware payload (ConnectWise)", "value": "239e6a4a632b3038aff834c409aab476", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068613, "uuid": "111b4e1f-c518-4dfa-a835-c15414a7ca41", "comment": "Malware payload (ConnectWise)", "value": "198519dadf88a115b1bf9d370564b2b0ac895f9439bac0936a7f7cc1208f1211", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068613, "uuid": "f0c34e3d-bc19-4b5d-b3af-33adbd833e38", "comment": "Malware payload (ConnectWise)", "value": "29b178602ff00573a8a5e33ce1a809e371d07da3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068613, "uuid": "cdc9aeff-0f4d-4ac4-90ac-1e92e8661b69", "comment": "Malware payload (ConnectWise)", "value": "10d41e15f9b0ef38461a7dad96003da1850c331068db8de600e58266e6bc5797ed89dcd1af4ba58ccabb77c02ef8fefd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068613, "uuid": "16a0a502-d506-4456-b673-0de06bce12f3", "value": "T16D46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068613, "uuid": "c49fb002-900b-4796-a70f-6c59e0605ae2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068613, "uuid": "f5cb9377-87e7-4133-84ec-6056c7d0444d", "value": "98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068613, "uuid": "b2385967-5602-413a-8028-d588c44dc4d2", "value": 5642984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068613, "uuid": "39c5088f-8620-473a-a5de-3d81d94adc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068613, "uuid": "fb53860b-d72e-4901-ad0f-49b20c301637", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b4986c-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088375, "uuid": "9bade12d-f3d8-46b5-b145-039cc71e68ba", "comment": "Malware payload (Mirai)", "value": "5ac13aae240502e49c46d91b198f8ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088375, "uuid": "619aa29a-bb34-414d-a34d-ab0dc19260f5", "comment": "Malware payload (Mirai)", "value": "19df7861313f7d173394de1be660c49ead5d93157740ca573a928c91e6d6d64e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088375, "uuid": "c57f9125-2cf5-449c-85f0-a72d1cd3cc0c", "comment": "Malware payload (Mirai)", "value": "630cf044364aa0d39199959e75480e6ef9aec135", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088375, "uuid": "84b49150-fedd-4a7c-b060-63c2feccd28f", "comment": "Malware payload (Mirai)", "value": "844ebe4ad9faad734284895194fb0a5ca02b89e98538bd51066df9c6f0685fc01155a4722d645cdd3285bd371c232d4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088375, "uuid": "c7338583-edba-4001-bb36-9180b00c4e3d", "value": "T14DC32941F8825622CAD727BAF66E21CD332163E9E3DB7103CE255F21378658B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088375, "uuid": "5c1e424a-98b8-4f26-ae8b-77846df983ff", "value": "1536:gFBdpm3n2p4qA/g6cqIVhE0VI+YAV3j6d61d/ODpz925PA1FtyMeGJ1/j/ADEczr:gFBdM32pf6cmPUWePUFt9DQSHV0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088375, "uuid": "089e0a45-24d2-4bbd-a014-d1c7c37dbcbd", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088375, "uuid": "21d30fef-ccc3-469a-9a16-75b5dafb5230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088375, "uuid": "3b527b1d-eec5-4f6a-b4d3-eb89009e1b0d", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fb0a3b-88e6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785065968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065968, "uuid": "de297617-35ae-4dbe-a456-903647c25fe9", "comment": "Malware payload", "value": "ffdfca015b988c521bfc359ba042eed1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065968, "uuid": "2d673cb1-a442-4bc0-a336-9167b92cb8ec", "comment": "Malware payload", "value": "19e5eca388c115a901371dc3a488357b09b45cf0131a3732f960b0c61dfd76d5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065968, "uuid": "7dedcf9b-c2fd-4c8a-b9c5-768c27207569", "comment": "Malware payload", "value": "2045e59ce58c8285e0e703f1c7586018aa743611", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065968, "uuid": "31baca55-acb3-439a-85a7-510f3b10d628", "comment": "Malware payload", "value": "917da9e8b7efa845c59d9d68e9544d317d703a42a318cffe96006fd0663e86d7fabffdc5044725d6960df09a2f5eb039", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065968, "uuid": "986c73ac-eed7-420c-b02d-c0d9f93780d9", "value": "T10E183305C99A087FC63DF539D9E3F26983968C9BD660F168056BD7DEAE21F0E948400F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065968, "uuid": "2b2c6bb9-647d-4794-836f-92069b663915", "value": "1572864:de4hdV6xfFj7Hv59nFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzN:de4DoxfdLh9nF7z3V7vl385ySor0TzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065968, "uuid": "d4b5d492-c1ba-4014-91e3-99bb7e0d16a0", "value": 88914323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065968, "uuid": "007e13ea-ffa6-4c4f-9bba-90b4ffe23170", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065968, "uuid": "9cb16362-f0e4-4661-8c11-c4f26de3ed88", "value": "app-64.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c5f49c-893e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785103830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103830, "uuid": "e528a74b-7692-4195-8696-6be670f3c02c", "comment": "Malware payload (RemusStealer)", "value": "0c4ad644cc7c5715a31e1b5aff752672", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103830, "uuid": "8cc1f9a6-7c64-4ae7-9651-dc93e0cce5b8", "comment": "Malware payload (RemusStealer)", "value": "1a1bdfcbeec8791e79f8745a700a42a75dae7afd665a038da2b0d7812a0c0370", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103830, "uuid": "708fe9a2-908d-4769-bdeb-655cfe671a8f", "comment": "Malware payload (RemusStealer)", "value": "191958630ec8522c0f29a824e81f2d939611ff0f", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103830, "uuid": "6e6eb17f-76ab-42aa-b25a-fffd61516f1a", "comment": "Malware payload (RemusStealer)", "value": "0698a563a7646a57f53488f12bd39b29f6b570291321890fff7f8ac1eb6ae7c761c2c15573d9b80be181217697fbb5fd", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103830, "uuid": "f5dc3935-1202-48b5-a284-b5e7740fd50d", "value": "T1E8C55907BDA109F6C0A9A33189B326527B71BC085B3623D72E90B7382F727D16D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103830, "uuid": "a54924e0-4227-40d3-9164-b20be9c7a12e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103830, "uuid": "b751f7bc-2527-41f1-a3f7-9fe72043d09c", "value": "24576:KSsccVFOwSLQilPCphKg3ek/psK3dtWi0cDuhCOLOMO193MnlPPZoBele5I9DUAO:KSs3ywGlMKgbGikyuCmnCAW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103830, "uuid": "b67f8809-2d68-484d-9383-473641e2a57f", "value": 2610000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103830, "uuid": "42a28287-87e4-46fa-a014-3b31896f399e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103830, "uuid": "3391454a-eb16-4d77-a1cb-1b861b344237", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b40628e-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051208, "uuid": "23eb0311-1cf3-4c82-aecb-63cd05870392", "comment": "Malware payload (JackSkid)", "value": "06e6284f00ef954f488a5d214a77ae8e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051208, "uuid": "84f521dc-614a-42b5-9f3d-61b938e2cc61", "comment": "Malware payload (JackSkid)", "value": "1a9a54eb8b3ed707852eace623b935bc687c46d5e0cfa793751e778dacd8b62b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051208, "uuid": "62c51b34-55b7-447c-8628-a9ca363b5d44", "comment": "Malware payload (JackSkid)", "value": "30e1b29bd758c8295b90fbeb979716ebdfb986cf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051208, "uuid": "734cf9df-087b-441d-8528-fa4d74fb04b6", "comment": "Malware payload (JackSkid)", "value": "ec57d5fb6fff7eb5ca026bc41c1028e83d78d2ab1a0c8fc3ec2cc2c690d0cd9830ba2891b95f5844b0761b48672b141a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051208, "uuid": "2c94e069-1c5d-4377-8aec-8c9d92b53411", "value": "T1335412F2BB71840CF2EB16B21A6F3238D714253288A4450F9C8AF6B55A3135D675AF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051208, "uuid": "3db87110-9b91-495f-a58c-977f362ca355", "value": "6144:WvqtoLtKXreee6aPdhvrz+2zVqEz+rCNuZFjoUI3xGNcr:WitoZlh64hvrz+2zVqE0ZIt34Ncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051208, "uuid": "be78ab75-b877-463b-95a5-aa53d02b160b", "value": 306323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051208, "uuid": "2efc78a1-e045-4b38-bfe7-66eea86c79ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051208, "uuid": "dd51cbb5-e6a5-4c64-8db1-34bd852e80a1", "value": "1a9a54eb_162.249.125.141_20198_20260723-050002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15fbb69-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066895, "uuid": "3e083a82-6113-4a8a-b4b9-e1d7e8492cd0", "comment": "Malware payload (Mirai)", "value": "91f20eebd7e5526664be04e0e3728377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066895, "uuid": "00cb3b32-a1c8-4f67-bf6f-0829d4ba3902", "comment": "Malware payload (Mirai)", "value": "1b4734e560dfc27182f14d0fb49f8eba1f55ef00ffb5f9660152437869dd1e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066895, "uuid": "e928b60e-f67b-4f3d-a9df-7e52243d25b7", "comment": "Malware payload (Mirai)", "value": "8f8c6e6b6cb6e74e10a834bdb8aba1d33459085c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066895, "uuid": "480a8c7c-fa9f-4038-95aa-0f9a224959bc", "comment": "Malware payload (Mirai)", "value": "c3d83cd7153962205bca02ce6b71002726632e96c8717da86baec861efecfb9b19d9f483536d00c0c0e0036ead1b0989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066895, "uuid": "ea93c3c2-1446-4acb-819f-afefc4e77871", "value": "T19B041B42F8414F16C5D211BAFA2D128E37231B78E3DF7212AD245B707B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066895, "uuid": "bf9ba1bc-bfe2-4dd1-96ed-d97dbfff7b3e", "value": "3072:fZQOShtixZg4+AtQTFjxXsIa51U0T0BJcbZ0ZNNjcZf6hh1pCYRs:RQJhtixZg4+04rXPa511T0m0zNjIICYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066895, "uuid": "98cb45f1-ec26-4bae-887d-ff055351863b", "value": 178836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066895, "uuid": "d0539bd2-49e9-477f-a1c4-f0733f61b26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066895, "uuid": "5c476f09-b8fc-4297-b4d7-ddb94eb23b11", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efed7639-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785051484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051484, "uuid": "5798ad01-8838-4f99-a4bb-c2e9fdca592a", "comment": "Malware payload (Mirai)", "value": "f3bbebc12b0aae2b5b1a4ecac5730ad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051484, "uuid": "862d9297-dc7f-4c22-a2eb-6f03ee8e9cc0", "comment": "Malware payload (Mirai)", "value": "1b914dea47de55d28d56bef8068b3ea5c0a901e4d8b181db0e51148dfc670de2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051484, "uuid": "eb3b4ea5-57e7-4fb0-bb73-7506517a647e", "comment": "Malware payload (Mirai)", "value": "58f2f383a7107890c24eec4c6f734d203b68989c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051484, "uuid": "8681c3ee-24d2-4c86-9e46-c4a3bd16212c", "comment": "Malware payload (Mirai)", "value": "9f960c90c7f4e83e8c086544c92b57344b15f398ba91c3edc1535a29dd24c7dcce9f84e5f39fcac326596e897223dc62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051484, "uuid": "4a76b7c2-228c-4947-96ee-dc32c62081f2", "value": "T145B44A51FC419BA6C6D12ABFFF5D828C331317B8E2DE71129C1A4B3163CB95A0E7A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051484, "uuid": "12436caa-4d76-4dc2-b289-454b5b72f67a", "value": "12288:DZ8vuz4xQZTxp+eKysQseDc6+jOXHQbnybfxzTW2O4xgGXjDe:98vujxja6ZowbzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051484, "uuid": "25b2bad9-a18f-4488-8191-9c4985a1682b", "value": 498656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051484, "uuid": "de59e259-4450-472b-8549-4870fae2306c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051484, "uuid": "9455b125-8f71-4202-8388-a521431f6afe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ee5d14-8901-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785077556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077556, "uuid": "dcab8f42-3732-4b5f-abf0-c0746a656d9b", "comment": "Malware payload (Efimer)", "value": "7d0da082578d8d20e6568c5a120c8221", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077556, "uuid": "42d778b6-11ee-4abc-8a2e-f19fd8e3743a", "comment": "Malware payload (Efimer)", "value": "1c9f600de02308821bd9bf7ac780df8354277b80a2ba57f7639702c4d964bdaa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077556, "uuid": "171f339b-87af-49fb-9e9c-63b529ff8bf2", "comment": "Malware payload (Efimer)", "value": "17b9d41ae3e3b93d8d9db0b9867a70ca2e1088c8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077556, "uuid": "98d18e54-6f23-490b-b139-138b87351767", "comment": "Malware payload (Efimer)", "value": "e01d32cf49cddeb64057009797bf177692b9a94e77f622f41713e5e706d86aaa15b2f59dbed8ed7ea11f3877146a4da0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077556, "uuid": "6999436c-53df-4be1-989e-f6a0a0d98048", "value": "T1E5E63348E5D812F9E6B7953CAEE041A5D1A8F4760FB1C98F4BA41753AE230F04D3A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077556, "uuid": "915a22ae-8ba4-4536-9812-a5b53f784561", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077556, "uuid": "00442bd6-cc19-4b7e-9582-1a35b81d7d2e", "value": "393216:Frs2pimjNq2fqiSZUNPLveWXMCHWUjXxcuI3/PGTAI:FrXI2fg6N1XMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077556, "uuid": "4d7bd7cf-f475-4488-93ee-638ee4ade6d3", "value": 14331207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077556, "uuid": "a9055a1f-6f08-4137-b67c-30769dca639b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077556, "uuid": "a3fcb506-e293-46a3-b224-e76f201c2895", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf304aa4-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069871, "uuid": "e48f4af1-a0c0-485f-8ec7-c1da850b2624", "comment": "Malware payload (Mirai)", "value": "2b4593b6de0348114d6e8a2652bf73d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069871, "uuid": "cdb9ed98-19d7-4b79-b0b7-2d4d59864e3c", "comment": "Malware payload (Mirai)", "value": "1d28a8c7be39f68f833c5ac3aaaafed19b66a4c0a21dd5d975a4d331a7ec60be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069871, "uuid": "6e2bfb76-6250-4cea-813c-b6b5729560d3", "comment": "Malware payload (Mirai)", "value": "ac58959801bff5c878bb17e69964307bf596d2b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069871, "uuid": "84aac8ee-5f0a-4de9-9a21-a803e0b12f98", "comment": "Malware payload (Mirai)", "value": "f4e0246e6f2faf3188198f918824bc0cdf291a46b312b00b673b5a87405a5406086a224729087ac75dfb1751a734da6e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069871, "uuid": "80c90381-4b56-434f-8257-dd38d5d0e347", "value": "T19CF2E038234202E8C81C207ED3A1178A1D931B5769879C69B58EBFB30C575D5B6C3EFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069871, "uuid": "be44adf5-a228-4438-93d9-1511dce6f26b", "value": "768:1UZX3A0Lg2ldTAAE6hm/CDrH5GaGisjnJgGlzDpbuR1JN:1OwydDUAEF/UpGZjlVJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069871, "uuid": "122d5e82-bf0d-4540-a333-01c4e1b8fa36", "value": 35884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069871, "uuid": "24bd3b51-9ada-4e92-b729-7c10698c8cc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069871, "uuid": "7a6c14dc-ee48-41a0-8c78-b390377df25b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfcdd8c-88e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785065574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065574, "uuid": "3a2709b9-5e0a-4f7e-bf15-e4c2a716ba09", "comment": "Malware payload (CoinMiner)", "value": "2205a8b6df19bfd4b0e64e345d1cf315", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msfconfig-icu", "colour": "#F907AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065574, "uuid": "88549c8c-5053-45f9-93f2-7595c9e735fc", "comment": "Malware payload (CoinMiner)", "value": "1d42789ea54be34dbfa2d96095416723bc78f592bc56c62073f09dd5bad76654", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msfconfig-icu", "colour": "#F907AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065574, "uuid": "aa68eda2-efed-4f63-996f-02efede2a512", "comment": "Malware payload (CoinMiner)", "value": "1623b00517101bcc7fe7c47a806fe266cfc8f693", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msfconfig-icu", "colour": "#F907AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065574, "uuid": "102c51c3-22f1-4e0a-a373-19e39361cee4", "comment": "Malware payload (CoinMiner)", "value": "2882347ba1443d2dbf7e6cd1e28bbf8370fbc3c056b5bf3113981a77053ed4e92d80f9b3324d19da7ff000c0ae188d82", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msfconfig-icu", "colour": "#F907AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065574, "uuid": "269cae7e-ea69-49b6-9c02-c0f89dc5fe08", "value": "T128669D5AB7E400E8C86AC17CC6569613E7B2B8195370EBDB17B456A91F23BD10F3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065574, "uuid": "8d721ea3-9206-42b6-ac51-67d81fa6778a", "value": "023cbaf643ea091ab8297433701e9942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065574, "uuid": "f321c52d-9a17-4ed9-bb1b-89d4929f0e93", "value": "98304:pe3Xi3Zl6vqc5zrC1UVnev7irsSjP9BijrknXxdMaCQRaWnJZ6Q4TAHLwyrhhBBv:wdMaMqJcQ4Te9hhBKebIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065574, "uuid": "acbff2cb-e6c2-4b2b-9136-354cf0843ad8", "value": 6542848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065574, "uuid": "4259d4fe-8aa1-41d2-868c-1f23fe594c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065574, "uuid": "26695452-fa32-410e-afb8-b92c96ad805f", "value": "system.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68afe02-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084889, "uuid": "6c1320cc-ea4f-4935-ae5e-201abe684c6d", "comment": "Malware payload (Mirai)", "value": "b7cbbe07a878b9a641d36cd03ec317b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084889, "uuid": "af2a48a4-5073-4109-9c01-07fc8eb413c2", "comment": "Malware payload (Mirai)", "value": "1e4b1d75e06a7edc70b8ad3996622a094407f50930d8c66cfa516eeeefc7c3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084889, "uuid": "0601e62e-5a0b-4dd6-91a3-3e32f086879e", "comment": "Malware payload (Mirai)", "value": "51e9690bc5f4611393621883818b1f29bb135ce0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084889, "uuid": "81b697a3-b6d0-4fa9-a4ee-6da8a48a8d8c", "comment": "Malware payload (Mirai)", "value": "4f5bc4429885c53e5d6e1e950aa4806daf281864c6f533fd99afa2c9ee40fab4f1d36dcb7865f69d3ce9cd17f17d0b56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084889, "uuid": "389a934d-1a80-4f95-9a7a-e009070f1490", "value": "T158835B32BA351E27C0D164B921F74B21F6F157DA21E8C61B7DB20E4ABF35A402913EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084889, "uuid": "45718d5d-6dbc-43ba-bc26-ac3827fdc414", "value": "1536:nGnejGe3gDqsBd22oJUV3Njm5y5fk2T52tzAMfiV0rMk:GnjeYV5Hjmj2NoAJKMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084889, "uuid": "bec0f1fc-808a-48a3-9a7f-e72c2e6e5bd9", "value": 84568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084889, "uuid": "c478bd36-3a3e-40b1-bf8d-ea152e0b57bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084889, "uuid": "a2d86f9e-501a-4aa9-b1e3-e6f27bf001e1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaf14a9-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081164, "uuid": "598da1b5-adfc-48e8-b775-71d7f7024801", "comment": "Malware payload (Mirai)", "value": "69de0fb5e5033c36afce7a6c105690b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081164, "uuid": "f6bda621-fc97-4bfb-bc00-f4025851e186", "comment": "Malware payload (Mirai)", "value": "1e60104bfa1d6244802f1744e701431ab5010f6dec3ff2d435cbc2d5866efe78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081164, "uuid": "00070d80-8490-426e-b01f-c2d48d13b958", "comment": "Malware payload (Mirai)", "value": "1160e00d78425ef20824a90ad23d7a302ef25f1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081164, "uuid": "01bccc81-61da-4701-a9f0-30f7b1c9fdd8", "comment": "Malware payload (Mirai)", "value": "c284e9e56a6f57841fa4063e8b5aacfe74a53d121ab2cfde82fa404b547d1f707c06e9e0ab7d6fb4e4b77670d73119c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081164, "uuid": "0fd2c77b-a964-4a1b-96fb-267970fce6ee", "value": "T1469312F41C5896D4E0313D3CDB962DD8D52DF97E28003417618CDD669126A38F29FAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081164, "uuid": "a24dad20-09dc-4606-ac50-f2a01965e79b", "value": "1536:sBzFVzppEGwzwxGrprK742aDi4Tl2X83hiaNOhuLJVuefcjL9nqs:oVpfwzwMrsFm1nxDNndwv9nqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081164, "uuid": "e3a845c5-2805-4314-bfd2-5464de964b4d", "value": 96016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081164, "uuid": "a83e985f-fc29-4142-bbed-8b1c65bd8645", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081164, "uuid": "c1836ef6-285c-43ea-bb61-68a713768948", "value": "flutter.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc84517-893b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785102215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102215, "uuid": "16bb6b05-2980-4ac1-86f5-aa37f46aad90", "comment": "Malware payload", "value": "ff23372bf45cd719bfba8ab5b507a099", "object_relation": "md5", "Tag": [ { "name": "132-243-212-126", "colour": "#4BA6B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102215, "uuid": "4e5bc884-d360-4fec-b585-3c64650e487d", "comment": "Malware payload", "value": "1e925e77624c2db848d076f43d92f1acfdf832ff7ef48063f38088dd81e4c298", "object_relation": "sha256", "Tag": [ { "name": "132-243-212-126", "colour": "#4BA6B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102215, "uuid": "93c5aa02-49cc-44df-9353-3eacf8aa544f", "comment": "Malware payload", "value": "d61c2cbd1c96fefc370ccda8e0e818d56ab0e9f1", "object_relation": "sha1", "Tag": [ { "name": "132-243-212-126", "colour": "#4BA6B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102215, "uuid": "7e46f642-65cb-498e-9648-069bebb16e08", "comment": "Malware payload", "value": "621ee164a362b9714389ef76877ed51e1cf4fb3f684ce5a80ca8db5158f533fc87ffda0bf790868da6b3b017b627a17b", "object_relation": "sha3-384", "Tag": [ { "name": "132-243-212-126", "colour": "#4BA6B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102215, "uuid": "e0d32dbd-3d7b-4f5c-a8c8-110d47d3ad42", "value": "T158F54B03AD9149FAC499A331C9B761527B74BC0C5B3633DB2E50BAB82E727C05D39B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102215, "uuid": "801ac370-3981-4d80-a28b-f83f607d936f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102215, "uuid": "a9a38681-58ab-4078-bc9e-05fa4e023a6e", "value": "49152:pzf9ikvO0UZnei5Mxaj9aTHi8PCDU6RbXCXPULZLq6H4vGwp4zTfCwZ:pz1NQ/BH4vLp4vZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785102215, "uuid": "c7dceacf-2e0c-4766-8728-ae18da167264", "value": 3475280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785102215, "uuid": "a4dbc46d-56ea-43f6-b479-68f3db611504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102215, "uuid": "a463c8e0-3d08-4dd7-a639-067771fb4abb", "value": "dollar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb94d530-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785068603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068603, "uuid": "82ed0a3e-113d-4b9e-a0e5-2a97a8b69b29", "comment": "Malware payload", "value": "1cffb2bbc8c72d67342461356e4a0cfd", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068603, "uuid": "f3b32789-a52b-4d3b-8c1c-81132e090037", "comment": "Malware payload", "value": "206eeba1fcf7b2100ebe21dba990579a4b04b5b2b2a3a4467f118e6f6023f168", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068603, "uuid": "4ad862a5-46cf-4891-b4ae-2d520e783821", "comment": "Malware payload", "value": "093b78fcf7ea134a0ac8b8a0d2769108d062af82", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068603, "uuid": "8036cf2d-9d0e-4b5a-aaef-99dd0b7ea24d", "comment": "Malware payload", "value": "3ecaa219506a1131e605bab15c2a0ac2d1b5b1d2d0b8c71fac7f7cfc40d3d71eff37f9adfd4971ae518b02cf5f6e4fd9", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068603, "uuid": "31e9bd66-42ae-47c3-9170-1eea92d9c462", "value": "T1D2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068603, "uuid": "4d5bc0c6-4979-4acb-b4f5-c3124dade7ad", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068603, "uuid": "f586cb4f-09ed-48dc-abc1-e6dc48ede667", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji94:h1iw7gryNkSV1hy1Z1u2JLu94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068603, "uuid": "22080b95-cc2d-42cd-8223-b7de37589dd0", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068603, "uuid": "096dbab6-47e6-4214-9cf9-6db95547f7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068603, "uuid": "a6b97e9f-1b2e-4283-b2e9-c0b453af83fa", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e701eb0-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785068393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068393, "uuid": "6ead27cd-b613-4717-a1ba-943d93af6c95", "comment": "Malware payload (AsyncRAT)", "value": "229d98edecf5078345e555b81058c1a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068393, "uuid": "7943bfa3-1e32-481c-8578-835b22ab11b9", "comment": "Malware payload (AsyncRAT)", "value": "21450a32efcb56844cf4b6ef588bcfb995a4f7614bbe7c4115e698998889e61e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068393, "uuid": "d74ffb72-771c-4e19-b101-04d138686ca0", "comment": "Malware payload (AsyncRAT)", "value": "040b948b40cf289730349580206bf76bf2410c21", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068393, "uuid": "89c5f81f-c5b5-4f93-a1a4-7367ba200697", "comment": "Malware payload (AsyncRAT)", "value": "fd13d8c16db2697de2aac1baba612742704f65eff878a82536328621b79b2ff21f9b83bc2e1a127422cbc86fcd7a18de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068393, "uuid": "533a2c73-c4bf-4aff-9150-d995351bb446", "value": "T1F6C23B0833D4C676D1FE4ABEC83385009779E55B9923D75A5FC490AE29237CD8A18FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068393, "uuid": "27b67d3d-2659-4caf-8162-2c0108ce9b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068393, "uuid": "4ef18baa-f275-42ac-ac7e-61be9f710b99", "value": "384:5gSVEEMiNPWmeOsVa/KFHbhMH9qbuUsUbQxnCJfJBndnjJsKI:5gSVXFg1VDHFiIbKBiBn9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068393, "uuid": "0c5e44b1-fee1-4ba5-b703-723fc5aeefda", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068393, "uuid": "f98ddaca-5850-4a86-94c4-95f4501819a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068393, "uuid": "fe04dd96-4c8f-4a37-9b27-7009596240ae", "value": "F168APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995198eb-890e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785083122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083122, "uuid": "b24c53cb-1ad0-44c9-85a6-77166bc2b7ff", "comment": "Malware payload", "value": "3e42a546634cd9af72ad76d638d3b447", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083122, "uuid": "ae07e645-1b24-4cc5-8a59-875bbb4f267b", "comment": "Malware payload", "value": "21ffeade7a2ca38e1cf578598afb3b6b36034e111e937300bb697dd9cbf3f7e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083122, "uuid": "c933a57b-a811-45a2-8c5c-3c4e98799a1e", "comment": "Malware payload", "value": "9684c96ba416c2250a8c2a835c9c8c90257c097e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083122, "uuid": "85a04627-2089-4153-bc93-d864ee37bf62", "comment": "Malware payload", "value": "87e0c5f95977af4b70ed2f95a4d2a5b6ea8e136456b05bfe072c699a4092ebac2e27a665f9245084e70e3fe10291eadf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083122, "uuid": "4e4e4c72-34a5-454c-af5e-a933295866af", "value": "T1EA217CE4002449EEEE03AE48F77B55C8EA5941A7FE82BE5AE594046DD45CD78E1CE2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083122, "uuid": "9f08f533-139c-4672-9ab9-3ba4e2c89865", "value": "12:MCd9WI+WAAQWeNIyJ6WDfKi+W39WkFWlW4H6WoW8WHW2n:HOSHeNIyzKihkV84NTn22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785083122, "uuid": "94f2648d-3d53-4c0a-aba1-16c865f5442a", "value": 1153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785083122, "uuid": "0a337691-2dc5-4468-8d28-2cfd9ba9ba3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083122, "uuid": "5f6196c8-7d26-4717-9445-2a74d633776c", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4febc59-88c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051009, "uuid": "ba8fc06c-d1db-487d-901e-6d21c96c0d3f", "comment": "Malware payload (JackSkid)", "value": "591c09036bb5b1efcec9d123267804fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051009, "uuid": "8dffc92d-a2ec-476b-ba0a-38014ad7b57e", "comment": "Malware payload (JackSkid)", "value": "23282313ee3edb3443ae8c0296b9b6ddf52501983093fd289f46d99e7d180402", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051009, "uuid": "3822d824-19ca-489c-99f3-a8cb2740b3cd", "comment": "Malware payload (JackSkid)", "value": "e36cd2e2bf5ae60da4805e9c7bc661adecfc5a08", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051009, "uuid": "8f6b9b9c-ad3a-4884-8cb2-8acb21541c94", "comment": "Malware payload (JackSkid)", "value": "db5c10b76e123ef25243636236b11d03664c784c2a9981ef4e2f7747ab569c0887e810ad1128a09b8905752b3d443df3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051009, "uuid": "42a9d5f4-a217-45c2-81b5-57cbed021fec", "value": "T1126412DD6F16B4BEEEEE32B689271B3901685DE180528A9F41448134323135E9BCE3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051009, "uuid": "ab0e5bb2-f26f-4158-a323-359faea44a5a", "value": "6144:fmMk18qb0wBN/R7T/d1lgsst1mJePVX4l+RrrbPpiWBpjy:+MYb0yNZvlgDmedEQXEW/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051009, "uuid": "f1d278af-4f41-4227-8a1a-b056e7aec714", "value": 324630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051009, "uuid": "697c68d9-46fd-47e2-a69d-0a8c4313b59b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051009, "uuid": "e3352115-0fa2-4801-94d0-e174b43142b6", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca477ce-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044284, "uuid": "8ffb3ae6-a7bb-4ad5-9d22-a240a14ce426", "comment": "Malware payload (WannaCry)", "value": "e6dca6bbb610070f9801a6bd10245601", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044284, "uuid": "7d7d80fd-3c43-44c5-94ed-1e8d36e6149a", "comment": "Malware payload (WannaCry)", "value": "23679cc38b8e793d6205e5d75713a931646b4e5e698d1fd258524ec7a305c34b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044284, "uuid": "dd0fc6f0-0067-4c4f-9944-200d73ce03c1", "comment": "Malware payload (WannaCry)", "value": "8965f590a1fff9a04936b63fb302db76078c237b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044284, "uuid": "71f92383-2373-49f4-b7f1-7c589f759a1f", "comment": "Malware payload (WannaCry)", "value": "24920da1b079e713859bac94d11d3eb878ec5af6f4b9fe362412bf5f5c7944d5a95d83cbc7ff179637abf0d99717c00b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044284, "uuid": "726a182f-dd8b-482c-acd4-ccca032d3a0b", "value": "T17136235932BC81BCD106167844F78E27E3B37C5A16FE5B0F8B408A6A1E13B55EB64B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044284, "uuid": "69371211-b528-4c73-9fc5-5aff37cecc80", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044284, "uuid": "76ae6c28-9789-4333-ab05-bd0c333baf25", "value": "49152:jnsnxQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DM6qPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044284, "uuid": "cc2801f1-2339-4bf9-8f5f-7678172644f7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044284, "uuid": "e4e05aed-ec7a-4d96-88d6-8299edd5ae4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044284, "uuid": "4009f14b-75fe-4690-a5af-0e352eefe70d", "value": "23679cc38b8e793d6205e5d75713a931646b4e5e698d1fd258524ec7a305c34b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbcce29-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104522, "uuid": "2de6d531-758a-4bb3-8180-f76fc6b8359a", "comment": "Malware payload (RemusStealer)", "value": "af584b28ceda51c7d4ea86910078646a", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104522, "uuid": "1c31257f-8453-4a5d-b9dd-79969320dbcd", "comment": "Malware payload (RemusStealer)", "value": "239fa9a692f16c74b8faa90e48099978b0aadeb90fb5b8aae1c4b3161d516190", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104522, "uuid": "8aedcd78-2f28-4b78-8d4f-b8d3814db172", "comment": "Malware payload (RemusStealer)", "value": "fd21771360238bd0e8850400c232eab1f3c35475", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104522, "uuid": "c867f421-a670-490c-89a2-0566e721f73d", "comment": "Malware payload (RemusStealer)", "value": "2f1f9cdc095a46c7e05874675777b739eaf584ac8443b15bf8c40f453ce9b534278942e037c03a04669eee2a9f04a6cd", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104522, "uuid": "3bd0d30e-bddb-45ea-853a-154e028a32cb", "value": "T114C55907BCE149E6C0AEA33189B266527B71BC085B3227E72E90B7382F727D15D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104522, "uuid": "6c2a1e3f-5cc5-483a-aa80-30ccfa11f67f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104522, "uuid": "f96707b8-69b9-4b23-bdbe-07c1e410b88e", "value": "24576:bWrF4N8YJvjYQOumWugdZhduN9QU2WgDzxqi0FC8cPZoBele5I9DUAKdKGKDE2D:bWrKiY1EQjmW97hQExqiV8wCYQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104522, "uuid": "9394dc46-c425-458c-85a3-78b60e1515d7", "value": 2615136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104522, "uuid": "596eb2db-d92b-4275-b1ea-bd8c409418b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104522, "uuid": "82b5bd01-949d-46a1-a015-c8e0670bdff4", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a902f9-890e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1785083037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083037, "uuid": "3ede7616-c7b6-444a-8df6-e71bc0ab07ac", "comment": "Malware payload (AnimateClipper)", "value": "0ee75701ce17b06439a5f1bb200b5a8f", "object_relation": "md5", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f0e7dc585ba3ebf586da7b92aedbfc64", "colour": "#1BA0A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083037, "uuid": "18135a05-7ae0-4554-994f-5d3d48cde8d4", "comment": "Malware payload (AnimateClipper)", "value": "23bec473632af324b0a271f6b0575ea3d3174af7042ee5d582cb739714a35af8", "object_relation": "sha256", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f0e7dc585ba3ebf586da7b92aedbfc64", "colour": "#1BA0A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083037, "uuid": "bfa16e75-05c5-4db3-9a8b-f0381b866c80", "comment": "Malware payload (AnimateClipper)", "value": "e1e8555a0518ba4bc0cea2c8e89c046a11059867", "object_relation": "sha1", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f0e7dc585ba3ebf586da7b92aedbfc64", "colour": "#1BA0A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083037, "uuid": "8f5537ea-b746-41e9-a6d3-ff7785e8ffc5", "comment": "Malware payload (AnimateClipper)", "value": "f7598a344823c4c46458a2cfea67f40668521e5ce61a8dfb1ccf3fc9acfc0623c225b3dfad2a57673213471b4fc5bc10", "object_relation": "sha3-384", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f0e7dc585ba3ebf586da7b92aedbfc64", "colour": "#1BA0A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083037, "uuid": "7fbc8237-461a-41f3-b694-0a2f4dd185a4", "value": "T1AB668C349E9801A4D466D634B6738232D6707872F7F3A58B3698C2073E379919B7BF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083037, "uuid": "079b0263-26f3-453f-b762-4aa33e0871b0", "value": "7a7cab4506c063a99a29f96cbaac56fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083037, "uuid": "1a855254-a32d-45f7-b344-a823a8423f1b", "value": "49152:PIk8ghPFhi6oM5ZWkGsXGV/lSIdyOan9123STY:Zbxs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785083037, "uuid": "d4d0cb00-eae1-42e5-890f-e40bd03f7bdb", "value": 6495232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785083037, "uuid": "83a2316b-048b-4cb3-b7a1-1b3922c4e4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083037, "uuid": "c366a2ab-a94b-496f-a37d-825e5e99f09a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9b1796-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069490, "uuid": "d3c5878e-2cc2-46eb-bba6-e49edb5ebcff", "comment": "Malware payload (ConnectWise)", "value": "ca5004c9bcfd941fea02670a382e28cd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069490, "uuid": "78c59c5b-7283-4ade-8428-72a60879c9d6", "comment": "Malware payload (ConnectWise)", "value": "23f3a4eaeff118a7a44ecd53cc7312750681dda1224543f169ddb6adeab96322", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069490, "uuid": "4f1808b5-dfd3-4831-bebe-059f9de0a9c2", "comment": "Malware payload (ConnectWise)", "value": "46a2ef5eec740bc4d99eeeae2b25b615ebef0c54", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069490, "uuid": "e582072b-ace5-49c8-b7e7-6ae7cf3b2fa0", "comment": "Malware payload (ConnectWise)", "value": "4f4a66b49f9354ef23645c3012ea611f8cf583cf51f4fa03e1799dc85949bf05340ecfcc82e64fb53627a9c78cc7aeea", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069490, "uuid": "b35db1f2-0e22-44b1-b66d-e627fd5ae677", "value": "T107646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069490, "uuid": "a66de37b-7f6c-4602-8eb4-966ea2fb34d2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069490, "uuid": "324a7ac6-d4fb-42dc-93eb-9c8e2170cd43", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:A1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069490, "uuid": "b9c23d40-8b85-4c81-b15f-883eb01d07e4", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069490, "uuid": "6c9c73f9-a60b-442b-a19d-8f799892ab00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069490, "uuid": "0944be1d-52f9-4079-8f35-c71ed3538113", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c559cd96-8922-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785091785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091785, "uuid": "8c1c32eb-8124-4cb1-a9e8-2f6e7faa8d25", "comment": "Malware payload", "value": "d6d3bf3ffcb43ecf26ac0a5319aa75b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091785, "uuid": "f3f169a6-957f-439c-b1ac-5d31aa32a71b", "comment": "Malware payload", "value": "23fee915a2ede0fa0ca36b1590ef0319703f58fbeaca1d5cfdef77ebf470582d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091785, "uuid": "0b074547-49b8-4da5-ac12-e73609df31cf", "comment": "Malware payload", "value": "162779abe15588612cdde42f43ff1aa0d2a9ec76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091785, "uuid": "7110e83a-37d5-4f1b-a350-2c00380ff75f", "comment": "Malware payload", "value": "53e4f2dddd6dedcdc1edda675d351e647768e4f66da76d285fe405be73eb51f33f264632192b185d095f6247267d2b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091785, "uuid": "f78b2a74-66c0-46a8-8372-79cca62c1c2e", "value": "T1CBE32913E29370FCC117C1B8459A5772FA31B8254324AE7EB7ACDA712F11E607E29B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091785, "uuid": "504465ea-0c24-45b7-964c-c3b8b101bb5b", "value": "dcef13196d9946b892f62428821e6df6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091785, "uuid": "0d7014c7-1af2-4196-a46d-768c3eef3eef", "value": "3072:j0/zFkHuTJyJDwh9rxOvsq9ow7LAQqEsdUWPPhhSGc:jmJwDwh65oAAQZNWHhbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091785, "uuid": "87c6923b-85b7-41ac-9173-05739d031564", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091785, "uuid": "69f14e9c-90fd-4eb2-be38-cf92956acb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091785, "uuid": "9333eee2-83d7-4081-bde9-2729316d4730", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c78692-88af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785042228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785042228, "uuid": "a8344544-baa9-4384-a91c-0e6867c48113", "comment": "Malware payload (Stealc)", "value": "ff52c7106d382aa1094208bb24385f63", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785042228, "uuid": "47457e12-b6e2-46c5-9bd8-d5f4e9f5e500", "comment": "Malware payload (Stealc)", "value": "243aa79d0616ce126bd21133e2a06326eeb81104613e298a22d2cffaa292e2e7", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785042228, "uuid": "cd7cf362-75b8-4fd5-9fdc-a41ca64c3393", "comment": "Malware payload (Stealc)", "value": "99518addf72cb85cd19122cec7bd0201aebbd7d0", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785042228, "uuid": "0a3c593d-d9f8-4fbf-800c-316a70a5d9ea", "comment": "Malware payload (Stealc)", "value": "1712a7dacf4625b2bb7a2667d38c301ce739ccd76af259c52c4c60f806ca371780ecb9aa7adb3651906b7f2a9fdb5b39", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785042228, "uuid": "2f8e3049-c634-4daf-b0a6-600349c6ba06", "value": "T15BD4C012F5A09076F17246358969EB519B7D7C700B2097CF67C005EA6E702D0AF3BBAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785042228, "uuid": "3e01b98d-d6e4-47a4-bdc4-b87ba30a0bd2", "value": "a1998621839dade08f76afb3130c1ef2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785042228, "uuid": "13836066-56cd-47fe-baf4-e03fc73104fa", "value": "12288:REP6CTwNIu2sC3z0o0ARkV9lVbsDhoyxBlDetAqxSv+ke:CiQw98310ARkblVAhoybGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785042228, "uuid": "44ab49e6-9be5-4f9e-9e35-e3039e28f30a", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785042228, "uuid": "e4c869f2-8826-40f1-8246-72a35aabf011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785042228, "uuid": "569c134f-66a9-45ed-a105-35b5aa611aab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0377f9d-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066893, "uuid": "43210fa8-b611-4713-8467-911961480f8e", "comment": "Malware payload (Mirai)", "value": "77925e3afa7bdc1276053387429c878e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066893, "uuid": "efe16602-6126-4bd7-aeeb-61e3319327f4", "comment": "Malware payload (Mirai)", "value": "247f0e3db72dfd40d0064653ca354fd654566c2a1a00cb65921d3874afcc6c94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066893, "uuid": "e9031c3a-a2da-4b3b-99cb-6bc554d57dce", "comment": "Malware payload (Mirai)", "value": "52e471946bfd53c06a351fd15ed38231522f95f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066893, "uuid": "14b41c86-9063-469c-aac1-ce995fc1081f", "comment": "Malware payload (Mirai)", "value": "d796bfbfba56530a2f235f61580b36fc993bbb20858c73924f493d6724a7179a3b85aba08e0d49b16a0be5f2e2d65fb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066893, "uuid": "e177b59e-3f14-4579-8293-8bfa262a0074", "value": "T14AF31745FC414F27C6D612BBFB5E428C3B2A17A9E3EA7103DD255F203B8A85B0D3A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066893, "uuid": "058db5ca-4628-4a8c-8192-d2430dd41f16", "value": "3072:oe8lFShubUaW9Ew4Thsy6zWRO5EZ7Jd6hh1PM:oe8GsYjGw49sy6yA5EZNAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066893, "uuid": "eed1e331-0c19-481d-a7ec-040d45242cf8", "value": 167512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066893, "uuid": "6d2db1d2-4052-4875-bd5e-0513c1ff6f49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066893, "uuid": "6bd5d001-50df-4e4b-a65c-5a4b4c49569d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1d4ec8-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088252, "uuid": "255f75bb-c0e4-480e-9f00-b2cfa303b588", "comment": "Malware payload (Mirai)", "value": "60855b7016c31539a0c08c8752bc3398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088252, "uuid": "2720b8e4-a4b0-4b7a-8bcb-ff95b29f94db", "comment": "Malware payload (Mirai)", "value": "24984afdb5b42c21eb382f517edd16567f3b5001a9de15d59d78b266b67b15ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088252, "uuid": "6eab836b-ed29-445d-8c34-b64a6e936c16", "comment": "Malware payload (Mirai)", "value": "d54189833ff600e735f4b6cd5cf2a2167b25d0ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088252, "uuid": "cb2c3759-e09d-421a-b2e2-d6d516691c19", "comment": "Malware payload (Mirai)", "value": "2d612f7a8cfc3c5b8c90f9be7589eedb70e7468385f0bc5ad468e8ac1789c64c9a1a82fb420bd1085370eaee0cbe11bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088252, "uuid": "b7346bbb-883f-4a07-b021-7f0383466a7e", "value": "T1CB33F16ED9561EEFDEA5DC3A20B51FA51800D48010D5EF8A9BB13ED1F291BE1B60C1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088252, "uuid": "fd7e8cfc-c73e-4ce0-b0d5-2a94ac9c2c4d", "value": "1536:biOo0rDr+0bbQpn1xxgwFpmTHkLKzfsAQwQkB:biqHKxgKMjk+rxBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088252, "uuid": "b79e3c73-169b-48c2-93a9-e1d85fc2097b", "value": 53328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088252, "uuid": "3827d91d-7e10-4f4f-9980-efbe3125563c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088252, "uuid": "c6a6e540-06a2-4b51-8938-4822952a1c32", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31c15ac-893f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104237, "uuid": "c86a49e7-7179-47aa-b351-981ba4d9b144", "comment": "Malware payload (RemusStealer)", "value": "b49afca85545ff5db04d08360274b5ed", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104237, "uuid": "9cd694dd-5c67-4e59-9356-484234965493", "comment": "Malware payload (RemusStealer)", "value": "24cabe973a480c2a5a489500c2615c2cbe0399cd0087b04ba56d0e725043a6ca", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104237, "uuid": "a3ced782-e32f-4a37-8c74-a1a0b67e2cf1", "comment": "Malware payload (RemusStealer)", "value": "925bd1946991f834571b089c463b2ace0306c9d8", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104237, "uuid": "4216cede-db1b-428b-b334-3e89581ea858", "comment": "Malware payload (RemusStealer)", "value": "c4874ff50a76ad31fa0ac6f5390bc63001c55e2b8ee924f44449d6e273fed52a744ebc6b0d21c8be057008ea374c5f98", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104237, "uuid": "e5073735-3db7-4f54-ac45-239843078364", "value": "T12EC55907BCA149E6C0ADA33189B262527B71BC085B3633E72E90B7782F727D15D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104237, "uuid": "2c3a9128-cf1c-499e-b1bc-15c350968cc3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104237, "uuid": "bc5bd2dc-549e-4d83-b69d-190b36c4af16", "value": "24576:EUGU3W6r7JSpqnIpyyWrMTaemymlofeoWpDUZ6ya9V3PZoBele5I9DUAKDKGK0EO:EUGMzrznayyWeoyUDUVa9FCKjIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104237, "uuid": "13d08c9b-9930-4c96-b9d9-87c3085c1358", "value": 2612584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104237, "uuid": "1e33f894-b785-47cc-8fe4-67d1f724bf01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104237, "uuid": "2dd34a9c-ee10-44ad-bc24-d94355a059e1", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f60e6e-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066151, "uuid": "f5cdf66e-1789-4a3d-b6ea-a9b12b6dbd3b", "comment": "Malware payload (Mirai)", "value": "448d24052f16bfeffb8c392c003c7a78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066151, "uuid": "69539fa9-5bf2-4858-9bfa-d8a10ee59459", "comment": "Malware payload (Mirai)", "value": "252aec32ae8193d8d01e18145055842cb7397699aecf31db54f1ea126072b18e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066151, "uuid": "0330789c-ed18-46d6-8360-ba62030608e5", "comment": "Malware payload (Mirai)", "value": "fcc30893cbd7c4e15c7cd8a2297fa42cfc77ae81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066151, "uuid": "1ca3cb5a-2125-4377-9c85-fa1726f527a3", "comment": "Malware payload (Mirai)", "value": "a7e30641e4ca38a893f40dbd205c6c81f34ac647b7c7d5be0de5f25ad45a682fd26fdf52477d33add61e40238b44e292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066151, "uuid": "7110eca3-bc97-433c-8e7e-ce5dd2223e6d", "value": "T17C834C9AB4019E6CF98BDAF941220E1DF93163415B530F27A76BFDE33D620A5DE02C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066151, "uuid": "fcfd9615-b795-4db8-84a7-e6ee77b94179", "value": "1536:sgYFj6jemPNWcj+MfNJCpfXsk5TOwGORWX83/Mt2uvBV81neW:e8WcqMfDCFsKTpF8J2uJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066151, "uuid": "aaa9b54b-39c4-4450-8662-2a64894a4afb", "value": 83856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066151, "uuid": "c4ecf8be-bbee-403b-a84c-7cb4425aa44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066151, "uuid": "119ac371-7683-4b93-8283-b2d778bc01ef", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2166c4-892f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785097325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097325, "uuid": "3322a2f0-e392-4bd3-9f0e-bb19720c1149", "comment": "Malware payload", "value": "56241fae7b30fae69410925b91107df5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "lb-propertyfind-cc", "colour": "#5E47F0", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097325, "uuid": "43e6d823-a9fe-42fb-a48a-abc676078758", "comment": "Malware payload", "value": "279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "lb-propertyfind-cc", "colour": "#5E47F0", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097325, "uuid": "4a971074-3141-4fb4-aabf-174323ae91ad", "comment": "Malware payload", "value": "95e291766bde87901fe6e253f71c84bd9c8af4a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "lb-propertyfind-cc", "colour": "#5E47F0", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097325, "uuid": "2f92009b-47fb-42dc-8e6d-ea1072f60535", "comment": "Malware payload", "value": "67528b54ca5d9a83b7f73951150fee7938349962f540824d5377c0f1719a5fc0c85f10a930f243f260e27f2494f7c40b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "lb-propertyfind-cc", "colour": "#5E47F0", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785097325, "uuid": "faf79060-cb40-438a-84bf-287138361236", "value": "T19896AE13B29802F5D0AAC27897569232E671BC161731A2CF2699F2191F7BFE04B7F711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785097325, "uuid": "97c6341c-2ff3-460b-9f4e-834645c5c943", "value": "196608:Ojw00mNBT0WAC/5lTIW98M7YzVdj+8CdRK:OEwIy5lTF50Vdj+82K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785097325, "uuid": "96dec562-640e-4cef-ac0a-8dea30740b8c", "value": 8852452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785097325, "uuid": "f4b2595c-48f3-47d1-b370-7af49dc0f2d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785097325, "uuid": "24fc95b0-44a9-4a4a-beb8-95a1104cb778", "value": "jquery.min.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f458017d-890d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785082845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082845, "uuid": "d83b6ace-7027-4175-99de-7081cab0eccd", "comment": "Malware payload (Mirai)", "value": "2b595b130512445851e3ae33b4072f18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082845, "uuid": "76b61831-e2ae-44bd-814e-f465d0a6f494", "comment": "Malware payload (Mirai)", "value": "28bdc62e508815c05b6de1c2bd0f1dc5cecc26514c2c93bc682998a2a7d75878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082845, "uuid": "cb01bbe7-2349-4aa5-8d77-96fed92647ff", "comment": "Malware payload (Mirai)", "value": "aec88243b97b3af94cd180fc60f1a4b00cabfc2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082845, "uuid": "c31d9f76-0958-447e-8088-416309a36518", "comment": "Malware payload (Mirai)", "value": "faa26498df84e7a74fc0b5167149941ffa3ab32f183be33eee51d4f966c0fb151a21d847d892ccdf42169ce7cb57261c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082845, "uuid": "f20c2f39-abff-4da4-93f2-78340f973673", "value": "T145B3AEABF34B2491C81503F417C74BCD2F672121AE6B99FB3C0E6A77647A1DB4A06781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082845, "uuid": "2ef3a2e8-11a1-4ccd-8746-3592600c8740", "value": "1536:1zYh8rOzBKlJAFdSX/CfZaO+N+1/iLqK0pFoxgHu/LWS:emOzBKDAF4/CfZDXxiL2pFoxgHuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785082845, "uuid": "03469913-cda0-4f72-9f42-5d459f5acb22", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785082845, "uuid": "3e8b76a7-16da-436a-8daf-5e55f5d041ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082845, "uuid": "0920bfef-6f11-4eac-9068-eb121a6d810a", "value": "zombie.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa3659-88e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785064659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064659, "uuid": "24ce305c-d291-4670-b587-90fa304de926", "comment": "Malware payload (ValleyRAT)", "value": "06138fb62550172df4c5ab13ba176901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064659, "uuid": "1bc7da32-4f08-4fed-bef0-f73d9a8fa7fd", "comment": "Malware payload (ValleyRAT)", "value": "2953cc4c71356715f99791136b31366be49a2886614cb74d637b1f3f0af7be8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064659, "uuid": "27553a2a-a4a8-4d02-b871-99836ada8cc6", "comment": "Malware payload (ValleyRAT)", "value": "60abc4a993d7cd4e24a0afa2674f7bb4df1e32e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064659, "uuid": "d915626a-62a4-4e5a-9888-97899a45d24a", "comment": "Malware payload (ValleyRAT)", "value": "3a4c2cf7c2af47636bf52ebfd6b2624802e7291e659759a08d000e881c5ad4bf3d213235663e703ff830f0dc463670bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064659, "uuid": "686a2315-679c-4a8a-ad6c-fe3460ee615a", "value": "T19C27AFB875047DE6E66F537BDA96ACD803B62E329A8BA4CD4064B7C30573375EF02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064659, "uuid": "ae73f1b2-1637-455e-8d3b-a62a0bd8f551", "value": "8ef447a3a75e8a956c852395abc55a5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064659, "uuid": "550860d7-5e1a-4dc6-8a63-fdc5397fdaeb", "value": "49152:hIkxB7QK4djqvPKSLflvgoc0KuPrHnHY:PZfOf0L74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785064659, "uuid": "9433b292-b254-4b2e-9bcb-1a55170b7d64", "value": 21681152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785064659, "uuid": "b4032e09-6611-423a-bd9a-66cc946f330b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064659, "uuid": "7f730846-3f1d-4cdd-8923-7f19cb1ab3a3", "value": "\u56fe\u724720260724kqwh_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b347550-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068924, "uuid": "4e3d823a-3c65-4332-abba-b63a30572b5c", "comment": "Malware payload (ConnectWise)", "value": "dba6e8485c1d83a5a468a2c63bc8cf80", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068924, "uuid": "c5bab799-0c9c-445f-a614-2c30c4d4015f", "comment": "Malware payload (ConnectWise)", "value": "2acced859e216ff200174c35e5275132ecc5db0b10b4e3a450a1f4e074f59603", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068924, "uuid": "1112e103-785d-4f5f-880d-2cb06f6eb6bb", "comment": "Malware payload (ConnectWise)", "value": "dffa0fbe31894edee9fa9aaa14b5340363f0e748", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068924, "uuid": "b0828e62-9e22-4382-8b3b-ff706eee14ea", "comment": "Malware payload (ConnectWise)", "value": "68c6c097701158ce8b1908ebea828c63947179e49bfed19b8e46f60e80b3d4a5bcab2c2ec098ba3135854a63a075cb34", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068924, "uuid": "3d2d23a3-fcfb-4274-982f-a5d834d83059", "value": "T15146E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068924, "uuid": "2b25b563-7e8f-49b3-9e54-7cf29eaf139a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068924, "uuid": "c09d8537-9ace-44d0-b532-822a748a124e", "value": "98304:fzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:fhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068924, "uuid": "6166a02a-9215-4611-8de7-781af2d05d18", "value": 5653200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068924, "uuid": "a41f7c20-df53-420c-abb5-2d7b50ea73cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068924, "uuid": "9de49d6a-86cf-40c3-9561-8c65e8b3c452", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5725a31-890c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785082310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082310, "uuid": "9d3e0b4f-c5d5-48d7-96d9-d46dfa67bcf6", "comment": "Malware payload", "value": "0faaf8a4bf8f82d22e9f81d465fbde8a", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082310, "uuid": "283b5745-7e80-4063-bc36-bd4c5183c191", "comment": "Malware payload", "value": "2b428382c0f8cfd575cef779b07cd2a16ae8bf2bc985a544991f026303f8e2d6", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082310, "uuid": "5771a0af-6082-48be-bc06-f270c106ef96", "comment": "Malware payload", "value": "5fa96f5951086f95035a648dc6b71aee741627a5", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785082310, "uuid": "4c459377-64b5-4553-84e0-53b1d8ae1619", "comment": "Malware payload", "value": "432e92423baa3be43e23e4750fa8b1425e317c8e563c6e50fbb6327baee37902eeb01bfcda948d0e7e65adc4b1e8d283", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082310, "uuid": "258f470d-2f5f-4666-beeb-430482ce25ac", "value": "T1AD012D9CA57CCFC54EA9C585F7F151548481908BE1F677C5F24D082CEF08D5D75A224D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082310, "uuid": "82421029-8ca1-4e6e-8d23-b5ff11386481", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkLjJckCnv:FzY8k1/sWi2jkHJck6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785082310, "uuid": "8fff1f8f-5c20-49c5-8499-aa4218812978", "value": 701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785082310, "uuid": "ac0fe0bc-4172-49fd-bd04-fe663dc11672", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785082310, "uuid": "3b20c20e-8cec-40ac-9b7d-c1d433b7037a", "value": "ipmiv2.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3e256f-88fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785074755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "4bfd616f-a48d-485e-9f09-cbd335ed998b", "comment": "Malware payload", "value": "489f834f5f6ed0e120828bebf397c811", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "6b40e2a3-3deb-4668-898f-dfb607d0f13e", "comment": "Malware payload", "value": "2b96e1fefa7210da37cebff57e10c76139f6953f908c819296a48ddf5eada707", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "3b5ea443-5efb-4162-ac67-f8390a93a22e", "comment": "Malware payload", "value": "e4c2ac1a60b8079da005dda025304749ebaf7217", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "d266f690-295c-4218-99a5-3d1f3439db03", "comment": "Malware payload", "value": "d563dd16628e3eaa179d0864b586dd3280b546831f90f52995e6db3a6451222c849051312ebc91d3e74cd8d6605fad37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074755, "uuid": "9eb5bfa7-3e21-4550-bd5e-e52c02892261", "value": "T17CE5332545B32C7F16BFF7D4BAB1AD41A9D0562C5CB248373B79B14E08B2BE30C69246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074755, "uuid": "b030b4ae-02d8-4543-afab-bb600f09353f", "value": "98304:p46bISNpJ877CnosVBVibRTZQiVhF/wAEs7:p46bISt8vCntVoR1Quz/wAEs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785074755, "uuid": "d43fbf6f-3091-47da-b26e-99e70e4165ab", "value": 3245415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785074755, "uuid": "1953773c-eeae-474f-b87a-1a8e703fb3f1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074755, "uuid": "5a0acaf1-b33e-463e-a341-fdc3cb1d8f39", "value": "payload.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2721e4-88ab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785040370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040370, "uuid": "01520833-b8a4-4366-ad2a-ea74357c1de4", "comment": "Malware payload", "value": "2f42f110b6c6d8ad2d383eba4f62a532", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040370, "uuid": "7620e317-c369-4461-9c2a-4b6f29c0ddc9", "comment": "Malware payload", "value": "2cb356e128ce0d2e713abdc713739a2ef551f7d0b1f9148561c162d8b57a0c0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040370, "uuid": "c92357c5-29b3-4546-ab04-23b37ed76376", "comment": "Malware payload", "value": "87549633999fc959428ed61767720aa939165d15", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040370, "uuid": "d997f08b-f362-4d1e-93fe-c32bfbaac216", "comment": "Malware payload", "value": "e426ae3b459a977d7f9fc2e3ce9569e810b6b1131d32500b1e950cf595f6fca068ae4d90d06244df81928de3a0d5298c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040370, "uuid": "7b67fa55-096a-4da1-b06b-170f39e348cb", "value": "T1A2235C6516867C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040370, "uuid": "ae19f460-f18e-4434-855b-898ac80da495", "value": "768:/+p9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:/+icr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785040370, "uuid": "09e1d0ba-451e-4143-95f1-f853859809a2", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785040370, "uuid": "a36d2351-382f-436e-a4c0-e531f7355919", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040370, "uuid": "fb08ab87-eed3-4a49-9182-049aa9af447f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df068f3-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088256, "uuid": "60661df8-f4a3-4c0d-8ec3-3ae9982c53a2", "comment": "Malware payload (Mirai)", "value": "0ebd24efde653352b3928901d14227a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088256, "uuid": "39dd85f4-9770-4e6a-846e-dad1cd9bf69a", "comment": "Malware payload (Mirai)", "value": "2cc810c31b632782b05d1eefd30b63f691e1b150239cb0261cf46b603ad2cbdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088256, "uuid": "00539cfc-4d16-4698-9523-7236919b2fed", "comment": "Malware payload (Mirai)", "value": "6ee24b5bacb23f24776c4ca396a0f5d9e4af21c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088256, "uuid": "255ef7f1-7f59-4ec4-9682-526ef5b75e35", "comment": "Malware payload (Mirai)", "value": "5450b625f942fbcba53c6b8f01fac833090008d8558dcb3254e96d8a4d24d8c01f8bbe35c119f5c1677303447b48431d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088256, "uuid": "6f7e42ef-f69b-439e-8220-5c7bc73cdffa", "value": "T139C35C21B5391E27C4E0A47A12F75366F2F657C911A8C60E7E720E9EFF152903907BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088256, "uuid": "0ac7a346-95ea-47e3-a44c-6ac966593d8d", "value": "1536:315LMRR1R76rx2STy3z4x1w45gkDxBYCZnD7jC4O1q2BQ5lxAvhdBiu23ytWvPYV:lYwB+zKsUkhdB/2iknYOwwfXoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088256, "uuid": "be29cc42-892b-4eab-b76b-5308353b30bf", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088256, "uuid": "2b1e5beb-c9e9-449e-9716-a123e1d884c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088256, "uuid": "ffd6a865-09c5-49e3-99ae-305acdf3d30c", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40171f2a-8899-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785032721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785032721, "uuid": "9ca8b028-6f1e-4f57-b2a4-b76eb4cf69c5", "comment": "Malware payload (Phorpiex)", "value": "a8a3dc6184e2e05d6b0f0262640bfaa0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785032721, "uuid": "a4e261a6-a012-4cc6-9507-1866b33702ba", "comment": "Malware payload (Phorpiex)", "value": "2cf0bc8361e716ffb2dbfa4c680028bf6b2dcbcd84a14c511dfec0af523860c8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785032721, "uuid": "cbdd0ac7-7e65-414a-80ad-9392378740da", "comment": "Malware payload (Phorpiex)", "value": "ba7eef5b9ff3e388335540385f336de4dfe8f1f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785032721, "uuid": "f02d5bd4-b2dd-47e8-bc20-678ad666c072", "comment": "Malware payload (Phorpiex)", "value": "ced0964d56ac3ac6319fc5b599f3024f53e8afeda0baa04517d72dbde1b865f10d5ded3cb39d14280396c01cd0d82b9d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785032721, "uuid": "f3a5e6ec-3d2c-4c58-9632-76b3a9f79c6c", "value": "T1E6623C0BB4808035EBE144B4827F526645BDADB623C5F9CBF7E0648A5EB46E1F43216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785032721, "uuid": "394f15b7-0cf6-4e47-8c22-3775e888525f", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785032721, "uuid": "373b5113-4cad-40e9-aab7-7e97407703e6", "value": "192:AWhsGnjXgjk8LMRI+wBdzMRJFeIFFBKUSfEzQbd1gJxTmv8U9cth+9ik:AYSMygUlEOyav8U9cAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785032721, "uuid": "6c8f93d3-538b-43b6-9f4a-e9975298a225", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785032721, "uuid": "a636f6aa-d4dd-465a-a94a-9e4294198110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785032721, "uuid": "8f731521-5e3b-4028-9ea1-9ca7e510d9f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f683b90-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070032, "uuid": "3d242386-3e9c-4fed-8551-718c1c1f92a6", "comment": "Malware payload (Mirai)", "value": "b1080185ff79a95420f7690db51120cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070032, "uuid": "3e10ede5-b7fe-4703-a8d9-e701ba2636e6", "comment": "Malware payload (Mirai)", "value": "2d11ed100385c2516a273de02c1781cee637a34092012c12e862a07f6044a5bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070032, "uuid": "40b5a53e-38dd-4735-9156-eb8de463812e", "comment": "Malware payload (Mirai)", "value": "618d794deda810dc7098af62d567eda1407fc59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070032, "uuid": "3669a27a-4faf-43e7-a30e-b21f60c09ae3", "comment": "Malware payload (Mirai)", "value": "85064391af5dc7b23b9ca385cf19849e147d41e5d4a492c89dedbb1060a398247bfc4c252417c4bcf0dd798c848dda42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070032, "uuid": "cbba3c2f-889d-468a-9a31-21ba224e64e6", "value": "T143734B85F793E4F0ED4645B1009FB33EA6348E521024DA6BEF91FDA19D23A52602FB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070032, "uuid": "88c680f5-e753-493b-8477-e202cfd23f0c", "value": "1536:CJ0gDT4f3lC37QbwDV6Pp9bwF+lC7JJHFUO31co2XcMYr:hgAc7QbwCEIC7Pi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070032, "uuid": "33af65bf-0812-4104-9c64-eb055ea2b700", "value": 74988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070032, "uuid": "e3506acf-c1fc-4230-89a6-0435ce69a017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070032, "uuid": "b2f380ac-0d8f-430b-ba42-7cd1f9b6d8b2", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e22c419-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785067587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067587, "uuid": "4bd529ff-6398-4c74-937c-b4845c255cbc", "comment": "Malware payload (ConnectWise)", "value": "041b9932fac174dbb4ae9a884170e590", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067587, "uuid": "e75c7adc-4f20-46ec-9c07-4d359ba27581", "comment": "Malware payload (ConnectWise)", "value": "2d695889cce2622eaa0b4ae3df0dfd621668dbad3828a3ef146a79cb2cd61be6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067587, "uuid": "56a4e4f7-54c3-446a-80c2-503ff05f8063", "comment": "Malware payload (ConnectWise)", "value": "a047f26068eca94a880607630641c8e80197bf35", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067587, "uuid": "3a4b47d1-54bf-44aa-8126-aac71996fbe8", "comment": "Malware payload (ConnectWise)", "value": "552153007b991faa1bb7293f5194fb5f345e14848d4b5ae4f63764f81054bc40be11fc71ff64c730eb6b9eef61de3504", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067587, "uuid": "a4261947-0be5-407a-b7c1-2601c2e1ede8", "value": "T18446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067587, "uuid": "aca0edc9-86b1-41f3-a2f7-b910a9352837", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067587, "uuid": "72a4f344-9867-4553-8b04-d07183e6b8b2", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ihfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067587, "uuid": "65e478d0-6749-497c-89a9-3b28c70e221d", "value": 5641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067587, "uuid": "60deb6d4-2d25-48f9-80f8-d7e87be5adfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067587, "uuid": "b808c086-a7a6-4dec-9b9c-445adfabdbdd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4067b34d-8937-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100582, "uuid": "9432ce4a-bbc6-4963-b3aa-d2fe788bc8d4", "comment": "Malware payload", "value": "205d7d91b72d06246a647c3290403280", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100582, "uuid": "8cde3763-0289-47da-a791-7409d7fec2e0", "comment": "Malware payload", "value": "2d9346aa5de94f207e93db952eeed52861b4b31a2c98899147c5fa59b2deee55", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100582, "uuid": "221331c0-0d79-43d2-b94f-cdf74dc3a841", "comment": "Malware payload", "value": "83979e73d7e00548bdf4fba960fdcce5bacbf146", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100582, "uuid": "30a98020-a04d-4cd3-9584-7bd808e3b1fb", "comment": "Malware payload", "value": "84318f1a6cdbe71f1461a33904772d0419036f8e4e54cec249b3b9d996e1d2d884c1c44f14cf0e0b051fbd70872fe97d", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100582, "uuid": "b823233f-f067-4cfe-abce-34a31eae9842", "value": "T1B1650216A6A900F9D2A3C578CC565D0ADB72F8025F74EADF03A81A960F237E49D3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100582, "uuid": "63515e29-cc1b-4bb1-971a-a0e9162dc258", "value": "c137ae5983c45e257bede56695037c40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100582, "uuid": "93eb53ed-b350-4730-858c-79c7f66a90c6", "value": "24576:ovwaUdlN+P6WLIcA9UJCO2GoxdV0fwoYFcCaBC87oNf6hr3qFt:ovwGP6X9A0dVjoYOFFIyhz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100582, "uuid": "59f9d687-2495-441a-9fa1-2dbc7235544a", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100582, "uuid": "d849c215-f705-41ba-906c-db1d5069e4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100582, "uuid": "4c680cc4-fa78-4acf-aebb-f45205377c09", "value": "chromelevator_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d9018b-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785088102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088102, "uuid": "306df3f2-0a6d-4ef0-bfea-9a5a0dfa59f7", "comment": "Malware payload", "value": "213cf6cab71aacc3d91b37d900a0ad7b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088102, "uuid": "3953479e-4b58-4353-87a0-64c154d87884", "comment": "Malware payload", "value": "2dc594ad73c5cd30919eaf4cb26004704b03d225f87ffe46c3f88612d5cd49cd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088102, "uuid": "09c220ff-1e3a-4efa-8bf5-c3ffec65a4c9", "comment": "Malware payload", "value": "05d65ba37b6557bc8a6a3d606b3d87184c8cc53e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088102, "uuid": "371c4ff1-8af8-49e7-b6b3-94a6015e2476", "comment": "Malware payload", "value": "97b37111c5779d8639dfa957dbd992a4b97d05401ae9288615218ad443b375e7d5e7f87362660a91adaaca8d0aacea4d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088102, "uuid": "a295177c-30bf-4097-950e-bfa6003fb07f", "value": "T1F5B7335190A00F84C80B593850EEBF1A6746A70648578B3F8772E2DB7FD7BF89A7D046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088102, "uuid": "d68b870c-1cde-4aef-83a3-2a526e453776", "value": "1572864:ppRGieX25966BBYgoPJqifTzLB2eR03Ra2iBi:3Rum5BYBq4TzseR73g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088102, "uuid": "b77a0185-038a-4ac0-bfd5-ba8cc85c6638", "value": 52563673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088102, "uuid": "2d440603-45e2-49ac-9f4c-39338410a776", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088102, "uuid": "ad40e3c9-9fba-4fa3-bec5-fc0b3d43eeff", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cfc9b2-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044318, "uuid": "94c010cf-5730-4ac1-a926-2a5677fea947", "comment": "Malware payload (WannaCry)", "value": "71fbc6bdb647b08e75c35417a1216e0b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044318, "uuid": "b73c2999-ebcb-4e16-8366-f43bcddafc26", "comment": "Malware payload (WannaCry)", "value": "2e29b77e732a935637fe3673ebe92fb84bd30081dd2ea087f286a6b30694d31d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044318, "uuid": "7a161652-fdb6-464d-92b5-1e2245f8d67a", "comment": "Malware payload (WannaCry)", "value": "5d915726d8245ef787f25abea86352996e3e3e07", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044318, "uuid": "95a84092-9f64-47e0-94f4-bbf10cd3b5da", "comment": "Malware payload (WannaCry)", "value": "efafb159d1af6abe82885f7fed37f79711ce799e9cd45b03d87e8a4caa0f791280c182ad0c70f230792dcabb999de62c", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044318, "uuid": "e9816ec8-7a3b-4ef3-8652-b4eef75b469c", "value": "T1D8369C42A3F94619F2F63F3059BA17306F7ABC92A97DC60E1240516E1EB1E40CDB1B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044318, "uuid": "59ae5182-e10a-48f4-a95c-ea29d89544dd", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044318, "uuid": "9374e091-34f8-4382-b272-47e2225cf6d2", "value": "49152:jn2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA8Kx/aa56L:DyDqPoBhz1aRxcSUDk36SANKx/ag6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044318, "uuid": "fa6bd90a-4c4f-4fc2-825c-be2e90fe7bd2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044318, "uuid": "c73efab5-9612-4d3e-80e3-774f2574a0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044318, "uuid": "257ce8d6-a826-457c-b51a-f935faf0214f", "value": "2e29b77e732a935637fe3673ebe92fb84bd30081dd2ea087f286a6b30694d31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb446a79-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069864, "uuid": "4311d6b6-51f2-4934-bc07-5dd7695fa502", "comment": "Malware payload (Mirai)", "value": "77e8d98edc7c670b706dc638017b6d88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069864, "uuid": "7128a617-dc25-4d61-84db-d87699b239e7", "comment": "Malware payload (Mirai)", "value": "2e8bd4e1454a35d54ee57fdd6e345775cfc3610425b81554a0267f2dbc906ae1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069864, "uuid": "367d0bdb-f493-49d0-b209-8f5f0a745ee8", "comment": "Malware payload (Mirai)", "value": "31d043132cd458efb1312f6741b875cc5376d3d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069864, "uuid": "6bd3cbfa-dbfd-4482-b4d3-52759e8055d9", "comment": "Malware payload (Mirai)", "value": "74c4146ad6c7cc1cd4c1b9810fe059aa59fe21e531721e8ca09ad3186168ebe407824c1f9c8f59958870f70cc651b0f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069864, "uuid": "e9345563-af53-4882-aa6d-276c5cef2b93", "value": "T113F2E1A8C0D85FC9CAEF1AF00DD2C1473B66461EAA31CBF425D1ED225243D9977C8AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069864, "uuid": "c5816a0c-e9a8-47b6-95e8-d12bafea5ff1", "value": "768:kAXyL46wqbZoVNP9SEECgtpniDrf/dTMTv6YvNF4uVcqgw09N:kyyL7wSZovVPeRIf2TXlF4u+qgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069864, "uuid": "01811614-254b-4ae5-84cd-a2b2e2c714fa", "value": 34924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069864, "uuid": "60fd8f9f-5fa2-48b1-9fa9-587c8687956f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069864, "uuid": "0d4dcc88-6efe-4fc6-9b23-638b582bbbea", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba1f0f1-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "43f209c8-4fdd-4bd6-b130-6290be5355b9", "comment": "Malware payload (Mirai)", "value": "b48f8f1b98f9aa5e9cd44b60eeba205e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "51672ffb-5d1d-48f6-b5d1-a3286ae19072", "comment": "Malware payload (Mirai)", "value": "2fe52177710ac8eb319c35916e3488ee7159350751e22ca33337453c882f3958", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "ed45fab8-7e12-4f18-92d7-8d35198966af", "comment": "Malware payload (Mirai)", "value": "04bed2238eae74960e56efa3c9130e0c4ede0664", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "3c1c7f77-1c59-44bc-a856-cf4ea61b7f1e", "comment": "Malware payload (Mirai)", "value": "52c8dd4250090c0ff025097b407e0e96a1edc9f842c7021e8d988d58a1d9b763b61887d5f58821f0264f721d693e8c27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "cd7f3c56-97b0-4d4c-ae57-b67d4ee1ee36", "value": "T13D41CE8E2F714EE8F555D93887374735279B920843C04249E1ACD5406FC430D89AE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "d930a7c5-3515-4ac9-8656-3b718a6fa8c9", "value": "24:3u4dsgph8AmsiRD8AmyT/z2H6llPDqtWB4u37I8paXDdz3N9l5zBkEp7i9liAGnL:exgpEuQ2HyV1EXD/9LuEplnn2nqxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "a5bbf7e3-eb70-4225-9bfa-19e7f907327c", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "080efddf-9bf6-4453-867d-415ff295791a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "a0ace0e0-bd0f-44ed-8202-227e070a1594", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dbd509-889d-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785034391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034391, "uuid": "3ed87bd7-2606-45aa-b669-4e2428100e97", "comment": "Malware payload (CoinMiner)", "value": "2e11f99e1017209acc1ecd207f1c5832", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034391, "uuid": "8a99ee36-d185-48bd-86d7-351c1c904020", "comment": "Malware payload (CoinMiner)", "value": "2fed5d0552cf80eaae1928150238397a632ebb9521e98129daa71eb46ea1f113", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034391, "uuid": "754a46bb-3285-42dc-b20c-3a1d5e2b33e3", "comment": "Malware payload (CoinMiner)", "value": "ffbe00b65889aa4554fb6aef8cac9383652dae6e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034391, "uuid": "d69e650a-e757-4e15-b09c-b60b03c66a8e", "comment": "Malware payload (CoinMiner)", "value": "93ab89c03b8c67a48db45ef8ef82be1e7a08af10ee0537637dc13fa14f71abb811096bd3a2d7dc05fde6b6e97ebfdc33", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034391, "uuid": "3a8c93f1-e28b-4de0-9266-bbde9831071b", "value": "T14722191ABE850331D39049F4517A824F557D2623A783B3EFF373929A0B963858410EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034391, "uuid": "f7940f80-0c9d-459a-8715-1fceb11a837a", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034391, "uuid": "b718e2d6-960b-46d9-b760-b0b1c24ab953", "value": "96:2KedvoJYz/J4hSWKB2dS6BDrVx+ZQSlctTKzsg9PFJxGE9mZ2FFhxC7tCEKAYv/9:2K6oiEKBEx+eSlRPFJxTEZmFhSKtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785034391, "uuid": "aca034ef-0673-4db9-a10f-8c2946bb7ee8", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785034391, "uuid": "acf0c558-f170-4bc5-b811-3cd81f733b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034391, "uuid": "36b96e99-b254-42e9-9b23-1fc5efb5490e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250c6190-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069612, "uuid": "07dfdb62-3825-4a03-be6d-e281cdb0ce32", "comment": "Malware payload (ConnectWise)", "value": "b4896fe43f64f8c21fe02369b7f803bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069612, "uuid": "34f30f54-7aa4-45ff-be9c-323d7255ca17", "comment": "Malware payload (ConnectWise)", "value": "31c1250a14e8a7e22b41b9b2cf1f0b5402869bdb8cebe5ab73117cfb8d8da8f1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069612, "uuid": "1f960c8e-2f3f-4ec6-9933-8aad73d84529", "comment": "Malware payload (ConnectWise)", "value": "50b1b8e4cc82de37de4389fb6e3f8663b7c88562", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069612, "uuid": "08892e7a-dd7a-47ab-90b3-080fe4bdfbc9", "comment": "Malware payload (ConnectWise)", "value": "feb57cac10ab0cae585614adbdc18b156bc94e1ea2b9288247f9b30615bface57fe022ea833958a11062f3e83a4b9bcc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069612, "uuid": "73c6cbff-32df-4f96-b545-e33d46632eb9", "value": "T1CE835B53B5D18476E9720E3118B1D9B4993FBE110E648EAB3398423E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069612, "uuid": "5ddaa975-8611-4ad4-bf8d-777d72c6f3f9", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069612, "uuid": "38876daf-75cf-4888-aba1-b7864cda2763", "value": "1536:qboFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYYW7E:X9q8tC0C+axfdalBqRfbYRGYYYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069612, "uuid": "44cfdb62-b14e-4b50-9fa4-b49fed0d6d38", "value": 84200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069612, "uuid": "7b7cd88f-bc2a-4a8d-b7a9-7ef036a7403c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069612, "uuid": "7a70b8c2-b0eb-472d-8bfb-6fe2d491c88a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4203b7d0-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063648, "uuid": "22eb3dcb-7484-4df1-af8f-b174bda7d907", "comment": "Malware payload", "value": "9c7f869705397d35e27b8042093f056a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063648, "uuid": "75f8d29c-4ec5-4d76-9fbb-7d1fdb3790d5", "comment": "Malware payload", "value": "31d23d8d4b1787ae52677e90704669d990b5c9fce2d4609dbfc7e0fdce68e9b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063648, "uuid": "cf4d6018-ef98-4414-b21f-66243e69b6a4", "comment": "Malware payload", "value": "cef51dbc00853c41c800baddc5bd198d9f0c20f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063648, "uuid": "3856ee61-ba53-4e1d-8297-e7ea86f9821f", "comment": "Malware payload", "value": "51f7e07d20178f2272d8fb89c6226a0d458c35330a619e344db1b8597b1227e3be3c90a9ff47840f484365971ca65ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063648, "uuid": "dfd75e50-1fd1-4b28-963c-8a8fdfb466e0", "value": "T173560897B8D24943C4E83677B8BE81C432635EBA9B8652566D04FE3C3EBE5D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063648, "uuid": "842d3ea8-949d-48bc-9b57-fd0b7d80cff0", "value": "49152:RsznWs09lisLzQy/ZmNAlCUq3bhgXJsnaBnrdWg5Ep:WznU/hCARRnrdLEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063648, "uuid": "a4178d76-b9fd-4427-a00a-644d1931f8bc", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063648, "uuid": "6a8f49fb-b2a0-4568-8e34-48bde5f8e76e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063648, "uuid": "44798147-2f12-4177-a836-916208806e1b", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b6930b-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106193, "uuid": "03d77773-8f1b-46d9-be33-a09655b3e861", "comment": "Malware payload (RemusStealer)", "value": "58ef78c52ac325ae64968eadc5496250", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106193, "uuid": "e4af4d89-808d-47fb-af4e-c34a2f7aeebf", "comment": "Malware payload (RemusStealer)", "value": "33bd75f49eee1a5f86bf7f673573a28c14c45b8f8d1b91694b214a1ec3d6c333", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106193, "uuid": "bf61176a-88c4-4fed-964e-8a20d8770e49", "comment": "Malware payload (RemusStealer)", "value": "95d047527125fc03a0a6147415671d6689b884aa", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106193, "uuid": "f18414be-f3ac-4ce7-a823-5b6daf0de822", "comment": "Malware payload (RemusStealer)", "value": "3037bbec6c1965d49e400e37c5c63b82ab39f0a069f17e92eba6a46edcf1ba43409e658d220e6fd4323219bfcf2d2374", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106193, "uuid": "9135b826-51aa-447e-af19-4e8289a0360a", "value": "T1FA24096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106193, "uuid": "193ebf32-51b9-4383-9c53-dd66d36f68f6", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106193, "uuid": "99944a4a-0bd1-4866-8194-82d789e2257e", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFx1OCGiics:Qj5WUEBx+Q7PEfFnQU+tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106193, "uuid": "097d14b7-554f-42e9-94bd-83fe352fea6f", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106193, "uuid": "2e669aa8-c86a-428e-a6fa-b66d3144e577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106193, "uuid": "0d73b451-669b-4078-9fb6-4dedf04a4b5e", "value": "ARbeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06581bc8-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081157, "uuid": "a266b34d-f0fc-4f68-a257-df2515921e03", "comment": "Malware payload (Mirai)", "value": "edccfae271586a57d11826b196f7443b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081157, "uuid": "992c1f93-5064-4141-973c-a37ae6c8147a", "comment": "Malware payload (Mirai)", "value": "33c9da20b36844d3d790df67f3c5b2751e76f2d92d71958a011ccf0cbf6ac408", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081157, "uuid": "fbf8fac0-9d67-411d-b3fd-9fb3d4c3c8d3", "comment": "Malware payload (Mirai)", "value": "21b6f7eb8284c58ecb347a33eef44487d3dd3eaa", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081157, "uuid": "3d337b36-5e17-41c2-b7e7-09124680890f", "comment": "Malware payload (Mirai)", "value": "67fb575be3819e965abeafe2b7a1d552795e710663e46a0ba4cde6811bfa56311b245ff31f78250d29d26807b781a525", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081157, "uuid": "1187fa06-cc87-47dd-92ff-1e62d896dac1", "value": "T1D5931215CCD29326C151DF3495CFC2C5039CABADAB8F1E456CFDF9101FA8A1A6CD8A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081157, "uuid": "57debe9d-7763-40ce-8bd4-0596b2724a80", "value": "1536:svkJVJOBquHCx8xDuLyOuAegpyBTFEwn86ucATpo3o7DlT2TI1E4A+v:O+JOBquHCUDuWMegpmFLn8JcAy0l681d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081157, "uuid": "50896e8d-732f-4461-bff8-d1f480c0e7b0", "value": 92800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081157, "uuid": "40631658-e05b-4146-ad1d-d772377dab87", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081157, "uuid": "ccc77463-8d90-4d63-a968-70aa3bb7715c", "value": "flutter.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901e14fd-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088260, "uuid": "bc48f151-0e7d-4767-b712-95ee2ec53764", "comment": "Malware payload (Mirai)", "value": "3c9aca9bb5b6514e721643cbeb805665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088260, "uuid": "a8599e1a-21f6-411c-bc0d-6b016cd59ba2", "comment": "Malware payload (Mirai)", "value": "33ca2fc5dc3a455f87656c4796de77ced899dca05516389b6fdb3d0ae332e5c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088260, "uuid": "44cd53c0-0b01-4510-9889-f496329031ee", "comment": "Malware payload (Mirai)", "value": "f6020d9e84d86de568b9b6c0968ae71893bca5f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088260, "uuid": "f8895119-853d-45a2-8001-16ccda410b2a", "comment": "Malware payload (Mirai)", "value": "a3a77230b80526af3b4f9c4d06428226ca1edb3d473bf422f93f3883bef46a973f2d5ca8a3b5203e3aad56e29d3c0fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088260, "uuid": "5ddf3c4c-a37e-46b0-b77b-cd4435940de8", "value": "T1242302D8706F9862D2A62970C22DC64D57530FE9A1FD2B333729C6AD20C35F919B0DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088260, "uuid": "0e4c26e6-7352-40a7-b5d7-8d0b5346724a", "value": "1536:3OjN21+73U1IyjAa47ZtC5gj8Fkk5mrzC:3mN21+73mBcjC5gQFkkge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088260, "uuid": "0c5ddfbe-ff75-45a0-88df-d995e714fb6c", "value": 49968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088260, "uuid": "ce9193b4-bb8d-4bc3-9838-cfb180841ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088260, "uuid": "34352104-177a-4566-94fa-b0c23537d04d", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00307c0b-88e6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785065685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065685, "uuid": "380dc857-d339-44d4-98bc-e2627079f354", "comment": "Malware payload", "value": "59d300cdee07acf9d1d82c3d767f9c0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065685, "uuid": "95bf6f51-31bb-40fb-8e9a-ab60938670df", "comment": "Malware payload", "value": "33dfe406008a87c6e84b7925e141635c78b573ad0f85e16555b0e1a3e54b9703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065685, "uuid": "432d206d-e00f-41fc-b6f0-6dcdfc622ed2", "comment": "Malware payload", "value": "e3d1c714f937d8971d3d1f9b2f1e777c83875f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065685, "uuid": "e7018c23-1cc9-431c-819f-fdb4e17a1393", "comment": "Malware payload", "value": "888d6c71a6d27755d440ccb09162f39d8138ce0328742985586123f419a9b1b5e4010c132fc84952706224389a32fa19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065685, "uuid": "c7518559-ee93-4eae-a564-e8e81dfac981", "value": "T12D183321895606BECE55AF3494F1A33641BFBF76AF30A17F09A2B54D9E3364B5030C1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065685, "uuid": "d93cca1b-2d7e-4930-b8e5-dc6a722a9abe", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065685, "uuid": "d9d4c7a9-3726-422e-9806-e5052a22784b", "value": "1572864:y6e4hdV6xfFj7Hv59nFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzO:y6e4DoxfdLh9nF7z3V7vl385ySor0TzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065685, "uuid": "f57462b5-b1d2-4973-9e56-d23ae5a791c4", "value": 89921318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065685, "uuid": "21fdb639-7974-40ff-8159-72fa59227e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065685, "uuid": "2f6f1fc1-0335-491a-a4b6-6745e89abcde", "value": "Windows_Update_Assistant (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9681d0fe-88da-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785060783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060783, "uuid": "4e135f74-bd8c-444d-a69a-aa0b4201ebfb", "comment": "Malware payload (SilentNet)", "value": "7ec779be3595d44d3dc8484557d47300", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060783, "uuid": "3d0bcffe-5f7f-455b-9279-fc35f59783ec", "comment": "Malware payload (SilentNet)", "value": "3402d06e96bbb6854bdb08faab602b4be1049748dd078eac20728df371208f61", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060783, "uuid": "a1c91696-3e8b-4ab2-98a8-c9d92c4da592", "comment": "Malware payload (SilentNet)", "value": "314872070c11598222015aa2e9700de7c767793d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060783, "uuid": "b1cbd64a-abb0-4443-976d-463e35885456", "comment": "Malware payload (SilentNet)", "value": "482fbd7a36ea1c2b78a2c91979e380ff0b7e71ea1b1b35996f4248b244624002b5178292e857b286310e92f01484cc59", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060783, "uuid": "c6341d09-2784-49a7-867e-7a4778f6e0a0", "value": "T1D3C5330ED88C8AEFB078CF37D65502D026CD410F99D29F3E565EB8AEB95B8055D821DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060783, "uuid": "95190453-d48f-42c0-a9d3-8fe15ef01c77", "value": "49152:x4Dsz4kOoPGGaaIxKAwksBNNHQj0zrViE6WjlUDE+Tz1R:gpkOo+slpksBN6OrDRQ1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785060783, "uuid": "06f634f2-c9af-450e-a7cd-85a04341e3cf", "value": 2502568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785060783, "uuid": "4217f15d-7750-420d-ac1a-a63fe546c806", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060783, "uuid": "f3c3875b-657d-445d-9033-2af43e66d50e", "value": "4E_Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03333f75-88f8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785073421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073421, "uuid": "aa7a5c47-5d3c-4022-9649-8ee267890ccd", "comment": "Malware payload", "value": "37069b1219e29f0b0e389d72832142c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073421, "uuid": "6e9e2284-1093-4fa4-8d91-85043611b01a", "comment": "Malware payload", "value": "34b3a7f20f952b72de26db5cb0b5bd21c25d9eacc112ea4b0dac62e213d6f04c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073421, "uuid": "eaa0b70d-d722-4034-845e-da0e9ea41d87", "comment": "Malware payload", "value": "bf39759e6ac52ba7c5132d9878e10f1665930ea2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073421, "uuid": "fdabfc9b-c252-432a-bd3d-f36b7d856bc6", "comment": "Malware payload", "value": "15f2e9c43324bfb0d177b1a3883ac15d616c76da1029cbbcac64ebc521fcac54725e53b882b6c168898bcadad8a620bd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073421, "uuid": "d8685f07-5545-4538-b08a-0a72c4fc716e", "value": "T12FC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073421, "uuid": "8a31758e-84d5-445d-8dfd-8eb705729232", "value": "768:s8vCB+25j6es8RUm9FYpMSUpi+20qUpi+20YQX:s8l25JBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785073421, "uuid": "d0902291-9790-4482-9452-37ab82babce4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785073421, "uuid": "f32a968d-70c1-451b-8ee7-f522d4921898", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073421, "uuid": "a036346a-3a0c-4bb9-87b0-6263c962f17b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb200ff5-893e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785103875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103875, "uuid": "5945d595-5d01-44a2-8507-ec87affa25a0", "comment": "Malware payload (RemusStealer)", "value": "2626817c354412174fc4937efd1ad539", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103875, "uuid": "22e5d2c7-7330-413b-b7fb-b3dfae4a3c0c", "comment": "Malware payload (RemusStealer)", "value": "3541431ce10c1833122df54cb4478ebc1631c89ca373a5747c322350a60d6385", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103875, "uuid": "b939a7f5-1aa2-456c-8726-cd11e2025299", "comment": "Malware payload (RemusStealer)", "value": "0cd8542cd41d178747559b3b0b056e456f1d1fdb", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103875, "uuid": "c4874cdb-c3aa-4d1a-b55f-b2c5733aa253", "comment": "Malware payload (RemusStealer)", "value": "529af529331f9a7866bd9cf91e34da583b57278342763a31976cfa72ff7a4c7fe2f65056bcdb3648ff325b92839455f9", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Adware.DownloadAssistant", "colour": "#58BF0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103875, "uuid": "a7216c21-c401-40fb-98b8-84108ddfd43e", "value": "T14EC55A07BCE109E6C0A9A33189B26152BB71BC085B3637E72E90B7782F727D19D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103875, "uuid": "1a6d659e-21ff-4163-a852-ad7c222ff49d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103875, "uuid": "5f8d31c5-ffe8-4217-a459-03964f69e4d8", "value": "24576:xo/r3hVsKAwmrtRjV9VoPaZyxBFFsld51E/ZCVnyzTzH9c/JSPZoBele5I9DUAKR:xo/1KKzMtRR9VnZWFFaguQ9kJaCU+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103875, "uuid": "a919ebe8-1325-41c9-a75f-74dad24a8efa", "value": 2614616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103875, "uuid": "98dbb4c3-fd3e-439b-b7b3-cdd17c50d39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103875, "uuid": "3c03ff13-a62d-4c14-b16b-a83d9ab445db", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a11bc16-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785088062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088062, "uuid": "09392e26-5bc9-4f56-8e2f-e1affba1e10d", "comment": "Malware payload (LummaStealer)", "value": "410d5a8e676d57b2a11a40aa496c8f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088062, "uuid": "d47812a1-d062-47c6-ad33-65a89fcc267b", "comment": "Malware payload (LummaStealer)", "value": "35a13d030bfba6eefd0b668a818987345d9ad4ccf28027f4221ae7ebe30b0c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088062, "uuid": "f3fd16ab-4110-4805-8a40-2eed0c8f2d61", "comment": "Malware payload (LummaStealer)", "value": "c572b6cac05c27973194f8a1a2fb9a576dce0ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088062, "uuid": "f279d797-87b8-4551-835f-a442902676a2", "comment": "Malware payload (LummaStealer)", "value": "f713ab11c29c257b76344b95116383d0ffdbfadba90739c065777bee8e69d9d4b6a0c68a1da78190407628136eb8b60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088062, "uuid": "a42be589-0ae0-4fbf-a95a-fab8ef794bce", "value": "T122F407C960B64698EFE5363910312FB64D28BFA617DF7DFF32E23A14123C940961962D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088062, "uuid": "4743c1ad-639d-483d-83a7-5f35ce7f45cd", "value": "12288:o6J59t2JTBP1TrTk087uU0F8zYkLe4riNsRCjZnwyJaJtm2c6qhkEyp:o6T9tmTBP1TrTkF7uALniNsojZnwyaaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088062, "uuid": "33518635-1edb-466a-a52f-6be504ae939b", "value": 736408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088062, "uuid": "c892337f-5e55-4503-b8c1-4caf5374fba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088062, "uuid": "de873b92-80e7-4a6b-b3b3-e3bb3a500310", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41730c65-88f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785073955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073955, "uuid": "bf0d5309-0cc4-4e71-8907-6598bf25d1d9", "comment": "Malware payload (Efimer)", "value": "222ae53b9f3b4956bac7b9d0217623d9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073955, "uuid": "274ae96a-adf6-4ac2-a478-245c5d484a35", "comment": "Malware payload (Efimer)", "value": "35bcc443025f622df0e121a32b7949f8ed2dd5936cb0b1673b249116b79cbe3a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073955, "uuid": "bdbf0580-5728-46bd-8745-a17bf68521cb", "comment": "Malware payload (Efimer)", "value": "8c262389973004356fda04dd69f61c74e7100432", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785073955, "uuid": "37a8a3c8-ce30-46f9-8dbe-b281438ad206", "comment": "Malware payload (Efimer)", "value": "2aa665a94dcaacd0a33b0b1fda33c503904b35406cb7abddf784133f63bb1c9542c1e581146997bd3b4475205135f676", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073955, "uuid": "ace8b8d9-635d-4871-88e9-584d332420c5", "value": "T115E6331C9AE001DEF6F3017D9E91169AE0A574760B32C6EB6B5887A43E673D08D3C71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073955, "uuid": "355be8d7-360c-42aa-8736-3d7d805b4cfb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073955, "uuid": "e7f6ee77-9731-40ef-aff0-c3ccdbb2a975", "value": "393216:BLvWqRv7Usvm1GTN570XiXMCHWUjXucuI3/PGTAI:BLeqRvvmMT/0SXMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785073955, "uuid": "faf30f9f-ad24-4028-9e12-2ceaade32e27", "value": 14309426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785073955, "uuid": "8762065c-7fc6-44d0-b60d-725ac5197cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785073955, "uuid": "31ac95f7-66f2-4e6d-bfd3-0822e4de516b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cf2cf7-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069175, "uuid": "596e4224-fbcf-4805-a5cd-976f0588176a", "comment": "Malware payload (ConnectWise)", "value": "0308c3fe1e8f4a7daf2c5f95652786ec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069175, "uuid": "60f5f054-11de-4c04-bd67-0753056753d2", "comment": "Malware payload (ConnectWise)", "value": "3616579fd11630962c81229dad3a58a21cf99ef9374cd5c399efd9ac2a6ce44d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069175, "uuid": "ed6d84c6-290f-48ba-98f3-a6e7d47f3cbc", "comment": "Malware payload (ConnectWise)", "value": "6697a2b95178b651f2e39cf4ba9141eb82cc8b58", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069175, "uuid": "bce298c8-0d16-4607-9a9e-8df377ea447d", "comment": "Malware payload (ConnectWise)", "value": "03fb8b36c4207b4d6c23ae1a2506d2a495679918ff5e43256882ab135c81390723a8fb24eeb2ebea3aba051547a183e0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069175, "uuid": "f7312936-478a-4cc3-b979-c5caabe9b32f", "value": "T1D956CF036295CE67C07AC7B8BF274B5D57327E044311B6EB5290B96E3F32780496E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069175, "uuid": "a1d35f1b-bcbd-4c02-9e98-91f28b0d8c39", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069175, "uuid": "8bfd2598-431f-4869-b3ba-425f5619d252", "value": "98304:lzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlg:lhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069175, "uuid": "d5743d64-70ef-4fcc-855e-90cea8b104de", "value": 5976552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069175, "uuid": "25877ac7-8eaf-4acf-a802-0dc0e20bb758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069175, "uuid": "5d222c2a-f095-4524-af15-1306282f6930", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ae1446-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "720c5c12-84b1-4b40-92cc-08f22023f99f", "comment": "Malware payload (Mirai)", "value": "c817c7f1d75960ed4a034a13658576ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "cdfd5888-7cf9-4097-ac89-0da102532dcc", "comment": "Malware payload (Mirai)", "value": "36cf9328ea3b65ec26b390235274bdb2beb4a12288a91e023f61aeb2b43d27e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "074d3c0d-7145-48f7-8ec3-24d215387b20", "comment": "Malware payload (Mirai)", "value": "1fc3e0038769821b4c2ce8f56b41445cd005ac3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "ffb2c79f-6c1e-489b-ae95-d7628650b47c", "comment": "Malware payload (Mirai)", "value": "28ce762976bb10581333239a29a0d8484d467098bc1e03dab12e62bb80a07c3ed708abeb18fcb1a4610be90e2172b4af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069861, "uuid": "be4f8395-8ca7-422e-a7a2-2583afa6cf0e", "value": "T178831AC7FC11E9BAF40DD73B04974A0AB230E3A10E821A76B747256BED7A1951437F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069861, "uuid": "5f484a35-d619-4f13-beac-d5485e18dab6", "value": "1536:wO8gGu6I8CDQp8TvPh3Egy5F64t2c/y8Wx/sfTCN1ofirl+Bbd5lc7FSagIMhgY:8gGGQuPh0gy5F64w8UkPfirlYdPc8OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069861, "uuid": "1bd3f036-06bd-4f08-8aff-77bae651c9c8", "value": 87464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069861, "uuid": "f1cfba01-546c-46ee-af59-19d7c641a015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069861, "uuid": "d519fa59-f084-4b78-8e9b-bd091f52ec7e", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de770db4-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785070353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070353, "uuid": "4cf53d51-e1df-4c13-b342-c711781bc764", "comment": "Malware payload (Efimer)", "value": "70ea4da4ecde228556d84c1e9df5d561", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070353, "uuid": "24b07e89-5d61-4917-858f-cd2df9dc02b8", "comment": "Malware payload (Efimer)", "value": "373cd79b66b23f65fd93e10807b5217897e603c268ea14f8d8f3fc7806c66322", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070353, "uuid": "4f2fc7f6-5640-4b79-8de8-86b0858693c1", "comment": "Malware payload (Efimer)", "value": "98b0f6cd253a5abdfe2beeb0f078ed54b592f484", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070353, "uuid": "567f7171-5d90-4978-a571-74899ef9cac7", "comment": "Malware payload (Efimer)", "value": "383b6f4d0b0d1419bb2955f6e54251bbcfa5bc258915760b5f66c4ea9c936c3089253b0c30175896dda4dab42e950f97", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070353, "uuid": "882ff3e1-8a9b-4ee3-a70e-7e170e83d791", "value": "T1F0E6334C66D510FAD6334236AEE11951D5E5F83607B1C18F5BFCCBA06F272E08D3AA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070353, "uuid": "9a4ca5c2-e694-4493-ad3f-4e28f1b29607", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070353, "uuid": "88758ac8-48d8-43d1-9631-37f61b72e2f9", "value": "393216:LlfJ4yaNJ39EGOPmMzeXnGXMCHWUjXBcuI3/PGTAI:LINdw9zeWXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070353, "uuid": "71ab2e62-cea1-427c-83e4-85d87de5ee2e", "value": 14313653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070353, "uuid": "08b607d3-decf-47d1-b240-c380135415e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070353, "uuid": "c7314a41-27f2-41aa-83c2-862a0d76cc35", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5c8adc-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066138, "uuid": "490d9a98-9566-496f-86cf-c542ec150620", "comment": "Malware payload (Mirai)", "value": "f6778e4b9fb4106238ecab0c54e874f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066138, "uuid": "4dc63673-2c34-4625-ab49-47c5c298aa2e", "comment": "Malware payload (Mirai)", "value": "380f64097ec50c5c2320e2f85e3faf7169c770fde5ea5566ef561c0342961829", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066138, "uuid": "9f8b079d-ade8-46d6-be30-0838b7e1d5bb", "comment": "Malware payload (Mirai)", "value": "1d96d6e811dcdaa65fd9506a7f944d0cbddc1db1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066138, "uuid": "ce923b60-eff3-4f2e-8962-7815e391ded5", "comment": "Malware payload (Mirai)", "value": "288741d042bf4b7a2fda6835e760029de2f8a5058f12ed493a20cec93c782b6489d2a98cf033307ea8b6f54ff1f5bd56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066138, "uuid": "e342eaaa-6e71-4d1f-8b3c-9123b831418d", "value": "T19FF35C86EA408A13C4C61777FAAF014D3322E759E3DB73068D185FB43F86A5E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066138, "uuid": "9d7f33c1-14ad-46bc-9a32-d2a162ed094c", "value": "3072:ogjZZu+bVzHprqHh3bsLOYq5IOqINrwGy/KQFmgafWOVM/9iwohAr:Lru+bVzNqHlvxNrwGy/XFofWkM/9iFhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066138, "uuid": "6ad82b7b-6737-4996-a642-42371ae07160", "value": 163542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066138, "uuid": "c5f9b21a-763b-40f9-ad02-9b689c4d4911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066138, "uuid": "a98f7472-1098-4c33-a2e3-563250924c95", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0732231-8920-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785090891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090891, "uuid": "cb3cfb54-ab43-4cfb-8f9f-ae870a158015", "comment": "Malware payload", "value": "d0c0cba9afb8e0d303b3a99f3acddf00", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090891, "uuid": "8ce982d6-d6bd-4439-9c24-f22078fd87cf", "comment": "Malware payload", "value": "38a543b8702e97a2cc07cc1ca32c4a31ba6eacc0127f8774d35894689ce5f5e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090891, "uuid": "93166cf1-6671-459c-a332-2306d26b57ba", "comment": "Malware payload", "value": "6891702d02bce283e3c3f5b03db2729d0bb766d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090891, "uuid": "360f38ef-a0b5-4be3-84e2-62653edb779f", "comment": "Malware payload", "value": "844722a1b498982902f2570fd6501869c8e7409a709e086c9dbae239ed6de51f40d4a5c0c55d005b867c2f3a2b264364", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090891, "uuid": "232c2c36-6ff5-4f17-963f-9e911f491cf6", "value": "T1B80140AFC05140D52F94F91879920A28B1456ACA29E78E8C9C4E3D7916ED588F938E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090891, "uuid": "074b1631-3c1c-4d11-a802-c1a7dd235d67", "value": "12:RRJZDxRAHWTRIWOxRIWNHWTRwxRbHWTRA5IjDxRA5IMHWTRfDxRYHWp:3JZbiWdInIOWdgjWdA52A5hWdfbqWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785090891, "uuid": "d64ced28-2366-4636-bc42-2d53e4a936e2", "value": 738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785090891, "uuid": "0f4da6d1-faea-4bf8-be00-86a29f87be2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090891, "uuid": "7a45c663-1a15-4611-b692-6a3a62e55090", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baa67f8-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "b8ee3772-d8fb-462d-bfa1-fccde5cd695b", "comment": "Malware payload (Mirai)", "value": "c4086e3c965389670f5f3120a48403fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "d1e53712-7588-480b-971c-11151b929970", "comment": "Malware payload (Mirai)", "value": "3973d9db76437fae4c5b1b4fdf002fe295746f7cab3ea09598beff51168e7dfe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "bba6a5e4-b7f0-4075-a5ee-034db26069a4", "comment": "Malware payload (Mirai)", "value": "399f03007f5aed4318feef1ddeff2ea9e15c4e3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "bf47621c-38ce-4d70-8c5a-f4c0d6338876", "comment": "Malware payload (Mirai)", "value": "7a91a1b815d8f08574d9df0e68f9c0d3d898301454c99519587c933fb14060652efbde1fce9a8670867f0bf08286e1ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "e51a7176-c43f-4d16-9ba2-c8e605191626", "value": "T1DAB3920A7F600EF7EC9BDC374AAA1B4924DD241A25A87B75BD30D818F24B25F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "2c965548-f3fe-4bea-bdea-d70fb44e351b", "value": "1536:VTUAnPWQ+tbHc2cAd88LZAJb7zEUX1p74UZ8aD2A2j6Z3ktkpra6:1UAnPWQ+tbHc2FhNw1p0Zj6j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066133, "uuid": "b44bcf64-0feb-489c-95fe-2990e32f5cac", "value": 116916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066133, "uuid": "64e736f7-096b-4b55-83df-c5943ac650ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "e4cddd42-1467-48d8-82e3-ee9f665e9f4c", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b32788-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088328, "uuid": "73b5ad44-f1bf-4277-8ecf-ab403735caf7", "comment": "Malware payload (Mirai)", "value": "7ee88fe8632888e76783f5ed0178fdf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088328, "uuid": "5c872074-b21e-4df0-a8ae-02ee5e778ca3", "comment": "Malware payload (Mirai)", "value": "39c4026aab0e846fc05a1bc7b762818f8b56f6e0f337ffc85f62417a4875350a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088328, "uuid": "2524cf8a-543c-43b8-876d-bb566bfc95ce", "comment": "Malware payload (Mirai)", "value": "dc90b63dae7a6af1a609d73a74cc063197ae9624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088328, "uuid": "8b26ecb9-acca-483e-a49f-57e8f5655186", "comment": "Malware payload (Mirai)", "value": "a5ad9e2d429d7de49891ce5418e9311eb22f1db5fc603527b9f5389f72e199fab94f667188c93324201d6d285b8c08ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088328, "uuid": "d1530053-77bc-4e43-89a1-721453c27d04", "value": "T1C5B35BD5E243E0F5DD6645306172FB3BAD72E0FA132DDA82E3B58A32B8225C1D41675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088328, "uuid": "66063c53-2eb1-41ef-aee3-341540e0ac4e", "value": "3072:Mh0DvGUN4spxfT+FcXRGMd5wu9bbSNMHx9/rFQHsCVBz:s0DvGE3xfTscQMduibfpQHsCVBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088328, "uuid": "c0198d84-1e20-4bb6-b552-b379b8d41a53", "value": 116500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088328, "uuid": "ca1c6cc5-ff41-46f1-94aa-99c51e6799ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088328, "uuid": "6db84a86-4280-44f0-b9dd-80b18b0e12a4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af83e19-889d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785034350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034350, "uuid": "2374d46a-0331-4633-b623-bc6f17b9f671", "comment": "Malware payload (Efimer)", "value": "f19a0eda7ff0268f6c6faccfdce0879e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034350, "uuid": "fb89745f-d690-431a-845d-2b69c808753f", "comment": "Malware payload (Efimer)", "value": "3a0ecd128bddb650c684af39de612fb50953c76e1be4677afff1b0a3ae7e01f8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034350, "uuid": "c683bd3a-ddae-49c3-a14a-621e76536871", "comment": "Malware payload (Efimer)", "value": "d37a15e402c7d41e6139e563ff0f9696cf288a94", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785034350, "uuid": "c9ce6ebb-401c-425f-91bf-78b2ab7ffcb9", "comment": "Malware payload (Efimer)", "value": "1c9bf8479faf29324051f36afca007dedcb1bda6e66e3c29085f122439c8d4ec1fdbc9b949d5388da57f7b634d9fdf9d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034350, "uuid": "342a18fb-310f-4e64-be48-d489abdd095a", "value": "T1F9E6336CAAE012FEED23943CEAE05551E4B2B8731774C5DF975883B46E572F08839923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034350, "uuid": "69291169-7311-473d-8f46-23a213456e3a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034350, "uuid": "622d00d7-6637-4520-b5f9-9b4334bf267f", "value": "393216:Af3QH6q+q9U1hsaR1JbKKjHNNf9HNThCXMCHWUjXdcuI3/PGTAI:APO/Om21bPf9tTYXMb8XqH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785034350, "uuid": "5fee87a1-45e2-46bf-a83c-744696dc0831", "value": 14273883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785034350, "uuid": "07df7477-b202-4eb9-993e-0f5de314076f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785034350, "uuid": "acb52222-6078-4a3d-a622-90e35dc1354d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4aca310-88e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785067330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067330, "uuid": "14c9e414-ce11-44c5-9187-b0b768f7bd14", "comment": "Malware payload (ConnectWise)", "value": "4a7504ef8bf3fc33f9e0391add18aee7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067330, "uuid": "19df61c8-2b5e-427b-b457-f8e969e40447", "comment": "Malware payload (ConnectWise)", "value": "3b532277593630d24b0cbe32f6be199ac62fe57ac533acdda5408230486d9a6a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067330, "uuid": "550740f4-f867-4125-9a18-cf9f87f9bb3b", "comment": "Malware payload (ConnectWise)", "value": "64331092841a6f5ca0cd849586f1ddd2a2a791f7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067330, "uuid": "f66f9765-5ed9-41b9-abb5-8181cf977692", "comment": "Malware payload (ConnectWise)", "value": "f0828a10e2c094a7aef573e15b67e98f818591f9039720046a17cbd7de53436516f28b00b9a3f8d958513ab125d0e597", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067330, "uuid": "559efe7a-d146-4fc6-949d-8e679252cdcf", "value": "T15B46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067330, "uuid": "3297a93d-2fef-4348-aded-6b7538afe248", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067330, "uuid": "df0c1ef6-83c9-4284-9c7c-a2dcb20acf1d", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067330, "uuid": "be9dfa88-e3a5-4576-9714-b0459dcfcb6f", "value": 5641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067330, "uuid": "169141f3-b6f5-421a-aea5-d759919b2f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067330, "uuid": "7ac346c1-cb02-4fe9-8631-36fd90b88502", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7a5003-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088361, "uuid": "44a4d514-b0e0-4889-8fbd-5cd213688b4f", "comment": "Malware payload (Mirai)", "value": "4551dab16ebb364b4744dcbf462df770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088361, "uuid": "4f0782a8-09be-44c5-80af-ed23e6eda0c9", "comment": "Malware payload (Mirai)", "value": "3d2f7bf858c5960f18d22bfe55c4310df640880a6a30383fcf90bf2c093273f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088361, "uuid": "662710e8-d3da-45ce-9b7b-73682a44b9a1", "comment": "Malware payload (Mirai)", "value": "442514f40187c6d7747835b6ec9c0c74a20b9cf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088361, "uuid": "872ade5a-a187-4ba4-83ea-1bdf2dfaca38", "comment": "Malware payload (Mirai)", "value": "d60e7cc7f6e7068859d8a113e85bc95b6dcdfafda3b7b827381fae6a390d65317ccff434bd382c40488ea8e0cded17c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088361, "uuid": "5dbbb6bb-fe05-4593-8b67-2671b53c2c4f", "value": "T1E5931881BC828A2AC6D413BAF66E328D3761B3E5D2CF3117DD214B52778118B1D67FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088361, "uuid": "27560a19-862e-4b54-b4c2-df632aa87714", "value": "1536:cMypdD2V/HQl9DbHiUm/U2PwORBfzU63ggw7HoafzVAHUnDn:cMypdD5BaJEXVVAHUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088361, "uuid": "7b64f339-02ba-4603-b727-424c79485851", "value": 92032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088361, "uuid": "ef3af955-ae81-40c6-9331-03a937f8afd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088361, "uuid": "701471c3-3722-4b45-9551-50b4331ae0e9", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137bad94-891b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088480, "uuid": "6e5574d8-110a-4596-aeec-18b5cf56731b", "comment": "Malware payload (Mirai)", "value": "9fc0540a261ce7944295a1b9add98ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088480, "uuid": "4ac9ad89-2e6d-4e91-9114-c2cd9754ac84", "comment": "Malware payload (Mirai)", "value": "3f9a7196e25b5e7487331fd7a156d0f41fa37c806d6b45a3d18c608ce3004d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088480, "uuid": "9e625303-e76f-41ee-8125-355c6e4b27fb", "comment": "Malware payload (Mirai)", "value": "a92b9d617727fc83ee6ab41b9c3ed41c9cd96a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088480, "uuid": "b44df4ed-146f-4c20-bc1f-ff44933dd389", "comment": "Malware payload (Mirai)", "value": "fef0dda53bb54d54ef12f363b73c6eeabc90833c806926e99ebb280e861de1ae066e9c58fae6bc2551d1049aa8b6f69c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088480, "uuid": "5e993855-61d5-4e99-9187-2c2ea740af8a", "value": "T1BF246D46EA414E23C0D71779B6AF114A33329BA4D3DB730699286FB43B8779E0D63B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088480, "uuid": "e3a27bfa-e3b9-430e-b760-fa5c8904f362", "value": "6144:44PUG++KSUo9aMKmHtNsPuSCSSaHSYL15M/9M/:44PU+KSUo9aMKmHtNsPfL0Eu/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088480, "uuid": "71298be0-ae38-4242-b3e6-3e314c1fd9b4", "value": 213236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088480, "uuid": "62a6664e-3823-4959-b930-3f55dee1f5a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088480, "uuid": "3f77b7c8-f66d-4e03-86ff-047a8ceae34f", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c6b32b-88c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051004, "uuid": "8051166d-c731-4073-90a5-4f6ff191d70c", "comment": "Malware payload (JackSkid)", "value": "0ac680662a325166765a2d4f192ea6ce", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051004, "uuid": "7b0bdd79-e235-466c-871f-f9a47eb0b4ca", "comment": "Malware payload (JackSkid)", "value": "4017b001b2ed00fb4650bff8bb9e5c6cbaf3946eb6caeec2cb305be9f0439bdc", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051004, "uuid": "56e641ae-ffbc-4f60-9e3d-d174c8a38f70", "comment": "Malware payload (JackSkid)", "value": "7181be0738bfec571d55ad0c1df43ec3ba1accd2", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051004, "uuid": "4b5c9b6a-e9a1-4949-8aff-a6936f384434", "comment": "Malware payload (JackSkid)", "value": "7baa28bd4f7f1b3d99fb33176c5af0865287883abd4e2c41944a593f5398b3b144609a01fbbeba0ba932365772e848e7", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051004, "uuid": "900feb5e-f019-42f6-a597-30525b7e43b0", "value": "T14CF0780553F02B350C8C051C28A7BC5235152DD836F31ED41BB831685DCB889E3E3DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051004, "uuid": "8e9e04d5-7f97-4180-bf40-46a0bf426a17", "value": "12:th/GvpcgaunpcgaqpcgaOWpcgaOjBcgaQ2jYovmiPMCDkvmZVQvmHvmPjcYpvmP+:tHun4q4OW4OUQ4YYmiPMxmLAmPmFZm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051004, "uuid": "25357834-e45f-485f-ad9b-ba67cbe8c9d8", "value": 630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051004, "uuid": "d0694a24-d8c1-4e98-b3a7-2e8401a2c146", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051004, "uuid": "ebcb4b07-5593-479c-ad89-d66d346eb6fb", "value": "stager.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a20612-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070039, "uuid": "f5aa637f-f29c-4453-bbe4-9320b97c9a23", "comment": "Malware payload (Mirai)", "value": "9830c9f3c66da2a87ce33e95b4b75658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070039, "uuid": "67c6f260-dcfa-41dc-9435-9daeb6e1ae31", "comment": "Malware payload (Mirai)", "value": "40c09ae838bdaf102645c3de75964318181f75dc1b54a64792846e66b085c72a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070039, "uuid": "6b667f51-03ab-4e04-a513-60f9eee8d8d2", "comment": "Malware payload (Mirai)", "value": "065861aedce35268798732512aabc39a9f789711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070039, "uuid": "22c52241-6273-4905-b9c1-73c7f35611bb", "comment": "Malware payload (Mirai)", "value": "ce203e665c2ae892744e7d24e506a225eec9c85c2c23cc3c4956060a56ceed77c7ce9a7c92edab1a810bed49559fff00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070039, "uuid": "5858c1fe-feca-417e-8a53-6b1e5497a7cd", "value": "T1AE93CA5B6E314FADF26887304BB74B30A79963D633F1C685E29DC5011E6438E681FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070039, "uuid": "fa3493b1-2450-4a7c-b729-916560c31396", "value": "1536:BtM9724vOv84hzXv8fCBKSL4lB8LiZEeWzMz3AKteV4HHcqiz:BtQvObJAC7LYOLibz3AseVwaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070039, "uuid": "b6d34d1a-74cc-4fb6-a1c8-0cad5a0c455e", "value": 97652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070039, "uuid": "acc7a8fd-7417-4cc1-ac0d-24bc1ccaed92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070039, "uuid": "c19712cd-758e-4c47-b969-c8bfbd4045eb", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af553b94-892b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785095614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095614, "uuid": "7ded90d4-0bf6-49d6-8284-3a5f4bdc9ead", "comment": "Malware payload", "value": "7a3173e20eb1508b5ae29dabfda043c9", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095614, "uuid": "e520f9af-6270-46a2-90c9-05a449056466", "comment": "Malware payload", "value": "41986e5a10e7d708d74a8758a0dfc543fcaae48fe238a4b82194da0292338c14", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095614, "uuid": "090d9519-5e1e-4e69-9f62-32a7f9946205", "comment": "Malware payload", "value": "a11d24b6b07aeadc4ed293358f541b448c24f884", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095614, "uuid": "41336552-92e7-490c-bac3-c07bca5904d3", "comment": "Malware payload", "value": "7ba22ff800a471ccce06023c650d0f7646014d30bb70e0d0f2d6ea80302130b7a98306aeaa9e79655910ac460351414d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095614, "uuid": "48e71081-411a-4aab-9bb1-3bc8c6e9dabe", "value": "T1C9B3F129EC884A99D7C0B6B4E9D370372B1106E29E742317D3C1DB883AEA95D658F8C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095614, "uuid": "3aa39e07-c8a3-44c9-aa36-d9464674497b", "value": "3072:GjUvx7Gn1QNN7MU5oUUKkdYU8Zzb/wE/ehkgwwRx51v:GepK1c7MU5WYU8Zzb/wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785095614, "uuid": "648a12bb-5781-4d89-8cf5-0a9f7a9f1027", "value": 111388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785095614, "uuid": "275f231f-e970-4c4a-8558-20c20947a43d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095614, "uuid": "44f14ed9-2b44-43b2-98d5-7d707620aedc", "value": "Lobby+X.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae12f79-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "ff290910-df0d-4b54-8353-f697d974754e", "comment": "Malware payload (Mirai)", "value": "0758d078bf18bb6470953b68f6f6260e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "92ccd5b5-76d8-4b32-9f69-0cb597b68013", "comment": "Malware payload (Mirai)", "value": "41b425b787b9abd55015082ac2aa30f64b827fd266feffa560621b6174f5e248", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "dbd490ca-9d51-4860-a3b1-3e566b35be1e", "comment": "Malware payload (Mirai)", "value": "faf3b9149cbeb9c6cd3c5e6f236b0b99a4c32ed7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "b3ca74ba-8cba-4c72-b33c-87f429c2efd4", "comment": "Malware payload (Mirai)", "value": "94dcf51145ad9914ae100ae1ae3133a29204758defb8f30a89282b7176bd588faac5ad57cfe0f0af098aaf20eec27cf9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067931, "uuid": "d630c9ed-f322-4d1e-8a6c-d912194a6cb1", "value": "T13931FE91A3D09EBDCCA4D1BFAD56432473649F40F0C772A2D218B754BD2AEBC9D2A046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067931, "uuid": "44de0433-c3bb-4a2a-acd5-233483513c24", "value": "24:CCKGpa7Urz/jlf3LXK1hH9Vev3gRGH9iMjBBuPvlxrR+zDS+ZA:vKGpa7UrLZ3QIzdBuPvlxrsDS+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067931, "uuid": "e5ef3caf-f6c3-45f3-ba8e-aeb1a0ceab23", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067931, "uuid": "834eb882-bb1b-409d-b882-5033844fac3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067931, "uuid": "8449997d-cfee-4228-8223-c3754c8c4e5f", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eeaa56-8920-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785090771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090771, "uuid": "6a9d2c57-8bd0-4b34-bea8-13e5c00accd5", "comment": "Malware payload (Mirai)", "value": "d237627ecb8c36eda56db15a86ba488b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090771, "uuid": "bc97530c-81a8-4e5d-bf04-0dda0d16be10", "comment": "Malware payload (Mirai)", "value": "4257ee3f4c6155437d8dd7659c21c8a4f5aa67a01f88bf7701f36fc2a11aacc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090771, "uuid": "0921c6c0-1305-443c-a4c6-3ca53c39ce49", "comment": "Malware payload (Mirai)", "value": "8d45ab659fc6b3322fc5bfeb81a3c284d9832c6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090771, "uuid": "9315458b-aa2c-4d15-b974-31da1b5bfc13", "comment": "Malware payload (Mirai)", "value": "6d9fc8905e5c2a62229974e89d110a15220bb509b345932297166f9f5c37e0543aba73147fc0362075fb3c503b665c4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090771, "uuid": "479f4b43-cb4a-47e1-ab67-0d9d7e71741d", "value": "T193042A02B31C0947D1672EF43A3B27E0D3EF9AA220B8F645750FAA8D91B2D365545DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090771, "uuid": "f9d094e0-223e-428e-8e60-b6d5aa879f5a", "value": "3072:5nyivtW7FSe+2dMZTPG5xq8RnJ2YkOQhEpQoT+:3lmFl1dEPG5xq8xJ2lO3bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785090771, "uuid": "39a39edc-a10a-4b72-bccb-411b0f762b9d", "value": 179088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785090771, "uuid": "8688d355-6b43-4715-ace6-f4228ca0b922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090771, "uuid": "161bbb8a-5179-4294-9eb0-240e50e7219f", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40129b60-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785069228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069228, "uuid": "d0dfa12d-4b2e-438f-b43d-6ac6e55ab724", "comment": "Malware payload", "value": "847533da51f454871aa508f32d913bdb", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069228, "uuid": "c5529cf1-2222-489c-a581-8f788a65ab78", "comment": "Malware payload", "value": "4293b2d562d6a5e601b1c9f616f3186135373fbf0c513e1d334531f8cee7abf5", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069228, "uuid": "4372cfcb-2d6e-4b59-919e-d11f233971ce", "comment": "Malware payload", "value": "51c21eaf5a77949bf855a89e4edf57c983e4f44d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069228, "uuid": "e1675ab5-f691-488f-96b4-3f23761b30b2", "comment": "Malware payload", "value": "117fa5710329970e7ae2deb38de746b70f4682fa26744c94ea357f643c5561844499800981cd609b5715a9b0570c4a51", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069228, "uuid": "ee84fc27-e9f2-4a79-9e54-4e4049c1c3cb", "value": "T1A5646C11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069228, "uuid": "f8c6b5b1-745f-42ea-8066-cf89c1b43384", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069228, "uuid": "563b04cd-b4e9-41cf-bb52-f025e3b17490", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9P:h1iw7gryNkSV1hy1Z1u2JLu9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069228, "uuid": "36f57220-1746-42ba-b0ab-836fbea7370f", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069228, "uuid": "fa19e6f5-21f3-48a2-b07f-7e242c49b4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069228, "uuid": "81924e29-7a22-4fe7-b457-6c716d6f310d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b48b69-88d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785060384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060384, "uuid": "5fc7f38a-d392-4fa5-b74b-b50ec13a00c0", "comment": "Malware payload", "value": "3cc06b5accf9f07d6e1be22d944ce69a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060384, "uuid": "9703614f-bf2d-41f8-8ef7-acfca1aab4fb", "comment": "Malware payload", "value": "42daf9a89197d5e4e4e7781ec492877b699b8207ee1f92cd86506bd08224df4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060384, "uuid": "2a4da456-e451-4c20-9c2d-9175ff7469ac", "comment": "Malware payload", "value": "8210665c65a108838b17fe6259f7e1a760cc70c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060384, "uuid": "26697a7c-a27b-4d1e-bef8-e61e55363206", "comment": "Malware payload", "value": "72826dd3a06b4d80ce15807ca6989406071855eaa0f6591e72c99347755d8120f21b7cc5bfaa289d3adee93d97a77501", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060384, "uuid": "ad0ec92c-3c15-44b4-b68c-fa35d0cba1f0", "value": "T10CC27C956A867C44BEC98B3E4CBD2B1D6DF5C3D1224942AC3D8B3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060384, "uuid": "c67221fc-7d78-4cdd-bce1-8366d6241818", "value": "768:axOU8vCB+25j6es8Rn9FYpMSUpi+20qUpi+20YQX:M/8l25JBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785060384, "uuid": "151e3719-954e-4a25-9157-8701a2de1dfb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785060384, "uuid": "0a357522-cc4f-45c4-8c88-fca2912bdaea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060384, "uuid": "d8518fc5-b9d4-481f-85b9-65206ed97596", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5049a053-893c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785102756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102756, "uuid": "0e194274-24ae-4317-9dc1-30dcf1c0e40a", "comment": "Malware payload", "value": "ddb831195cd126a623071a57cb419a7f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102756, "uuid": "79083140-e20b-4f1f-a9fa-3208742d3594", "comment": "Malware payload", "value": "43095747bec46e0b016fe04caa8b447216e47eb788ad40e57f83fd2cd3b1d63a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102756, "uuid": "03ccc674-42c5-469b-abd4-f03beb397922", "comment": "Malware payload", "value": "2f5245c3857f5eb9477571c971e2d8ec365cf4ed", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102756, "uuid": "d0e93e7f-aaf1-4ee7-8aec-425304581647", "comment": "Malware payload", "value": "ad3acb60d385698e3c94e4b7a851c485f9b37720e59af6791867c9636104246c5314db68f66d1474b58e42a4217a5954", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102756, "uuid": "0240f199-eb17-4706-a43e-a793fd196294", "value": "T15DC55A03BDE108E6C0A9A33189B25252BB71BC085B3637D72E90B7782F727D1AD75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102756, "uuid": "e7bb9275-e532-440f-ba18-99a78fafef7d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102756, "uuid": "c4487df0-a52e-42a6-bc61-5d09fb2593a9", "value": "24576:BONBMhGXvkmLi/YU7cw2KUmW0GLwpnumImjmmyOUrOaapBpOJ8debEyPZoBele5K:BON2gXRi9gw2Kak7yiaapBISgCTVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785102756, "uuid": "4c7858dc-a830-4063-83a9-1ff1d8125a62", "value": 2608992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785102756, "uuid": "adf3e841-48e2-47eb-85b6-12291fd0dc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102756, "uuid": "86fdc1a7-7c80-4bd7-8ce2-9ee9957073d6", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c04068-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106228, "uuid": "d37f0861-8771-483c-9b54-3e5e50566773", "comment": "Malware payload (RemusStealer)", "value": "5e269369facd09a383f21d3e599091b1", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106228, "uuid": "1e84e732-f0b8-4da0-b1ad-4e91fcd0ee54", "comment": "Malware payload (RemusStealer)", "value": "43e89a578fcb9e1cea02e64c24829936b9b47ef6f2acb4e033436f8d5d446168", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106228, "uuid": "09119ab9-7162-4e5d-bb8d-202d877b803c", "comment": "Malware payload (RemusStealer)", "value": "486098d78773574d0b60566991304aab175d3aaa", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106228, "uuid": "4a1a6434-c712-4f6e-8f4d-d963c8e838a4", "comment": "Malware payload (RemusStealer)", "value": "9c2d5d4d0ad35bf38642a9a80908ae5d1d7832ec740e77ca9a719333b0b1bf117c7d6a71cedffb66617ddf469f18e44a", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106228, "uuid": "8dcc405f-99eb-49a9-a096-925eb49ba080", "value": "T1E024096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106228, "uuid": "c2bceea7-fc25-4aae-9d8c-b18d34c9757e", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106228, "uuid": "7cbf40a3-3977-4337-bd06-2590cd8a5a03", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFT1oCGiics:Qj5WUEBx+Q7PEfFnQU+tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106228, "uuid": "1d18f8bc-7d3e-4bd4-8c7b-33558e598a8e", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106228, "uuid": "69fe76c9-eb6f-4ddd-b7e9-2a515a182e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106228, "uuid": "083f8cb4-e116-4157-ac39-fb800632dd9c", "value": "arFtU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7507b5e9-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070176, "uuid": "0f81fad9-476a-4e8b-8db2-9be4cbbf3e3c", "comment": "Malware payload (Mirai)", "value": "5757c08056507cf14d836e4907e0c949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070176, "uuid": "e33be4df-ba11-46a0-a10e-e2f68217a8e4", "comment": "Malware payload (Mirai)", "value": "4484cbe31976a7231f9d8fcc91aef56aba3c4d87fcc3471644c95be17fb11100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070176, "uuid": "7ec23da7-9ea6-4b4b-971e-e4e0d9becc56", "comment": "Malware payload (Mirai)", "value": "42d4a6b0f68eb6803edf9808a0f11a217c4f6ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070176, "uuid": "324ba041-fcf4-4675-b6f3-8ae43801c39a", "comment": "Malware payload (Mirai)", "value": "c6dbdf2721ba38cb1059f7262017f23553fb609ce7797a920a70ea25dfd2617528a698a37fe36265c9a2c4eb4686bfb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070176, "uuid": "deb2f2ff-e056-4e4c-ad53-3865eda232f1", "value": "T13B83D75A6E319FBDF678833047B74B21A79923D633F1D685E29CC5001E6038E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070176, "uuid": "6325d472-1d13-4622-a250-9a91cfa67a1b", "value": "1536:XR6YJK9NgBDIzeGGpuB7wrewuTgWKsnm+3y3G:X/eKsedUB7wEgTslC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070176, "uuid": "ae589c6d-3102-42fa-9af7-2d65f4288a26", "value": 84892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070176, "uuid": "0832789b-6d8e-425d-8168-a2dd8c5642c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070176, "uuid": "824fb252-9506-48d2-9716-3c3e618f07a9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea9c2ae-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088258, "uuid": "3dab3269-ac5d-4ccc-80ae-cfab87050e21", "comment": "Malware payload (Mirai)", "value": "c83ed258db4980f307a79b98ec9752dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088258, "uuid": "0e016fcd-4899-49ad-b8b8-544c651325c0", "comment": "Malware payload (Mirai)", "value": "44fcd7a6a61dd418b64fd2fa3e0048d139740bf74a77d261a6900e24609e83f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088258, "uuid": "6514a95d-5997-48bf-8609-596d59e34943", "comment": "Malware payload (Mirai)", "value": "b729096f41548f821e7efc79080856f5de5202b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088258, "uuid": "773d4adb-4703-4f34-ba61-37b155cb9af1", "comment": "Malware payload (Mirai)", "value": "1530cc430f864783163937371101da1ce164e169ac31fa55a8afe402d189df697975b555c227d6296f2180b69e5dd3e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088258, "uuid": "5351bc2f-733a-4e69-922c-5c3f664dab7d", "value": "T1AB23F190C8CB8E026BCFC3F474BF1C4B1720B2686866C5979AD897678D34F16BE592D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088258, "uuid": "b593d0a5-bd2f-49f7-a1cc-2b6e0ae121b7", "value": "1536:4woCY8XMNETeWlullw4aswgzsY+lzebmuenouy8HyY:tsCWEwllwYwhoutr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088258, "uuid": "3ffafa91-5e5a-4475-bcba-e711dbc89f36", "value": 49636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088258, "uuid": "2e9f1468-9bfc-475e-93ea-9d94da3b76ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088258, "uuid": "a8e5a233-6d7a-435d-86bf-58135a380a50", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4f79cc-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066858, "uuid": "9f8b22e8-b38f-4ad2-80eb-fb8b106ec1b6", "comment": "Malware payload (Mirai)", "value": "3697669040696222bedf608ff22ed14f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066858, "uuid": "533194c5-22a7-48b4-a9c5-4599064640d2", "comment": "Malware payload (Mirai)", "value": "457cdf366613325ea1a3469107654d41849793d932b95df8c8a75ac417176649", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066858, "uuid": "61029ff7-25cf-48d2-8043-e51a1762afe7", "comment": "Malware payload (Mirai)", "value": "7a014c44c78a87b7d8bf5f10754265e988c26660", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066858, "uuid": "96342b81-9cbe-4f58-afc6-2b4368dbad2f", "comment": "Malware payload (Mirai)", "value": "e09fac792a9d4ecdea80d91fa952e88fe7b8ff2298a7694daaaf96fde2851858857e92611e6a10e3a8e00fdc64b0bbdf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066858, "uuid": "c9ca7c6c-9d36-4b9d-a1b0-eb013cb8eee4", "value": "T11B33024681F6CF00C1EE733158FDB67963A4EA0B242549F19EE4F82D6216A713D1D6E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066858, "uuid": "5689fbc0-6986-48bf-88ce-85c686f9da7c", "value": "1536:i3/kzrBe/UP2RuGMal5RaFBeeTmNAdv/Onouy8oyA:i3/kxfPkn3l5RaFBecnOouti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066858, "uuid": "37459ef6-ab99-421a-92c2-b75fe3307024", "value": 50952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066858, "uuid": "49e83435-d595-48eb-998a-ef60da6a3dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066858, "uuid": "026d0e54-08ff-4a52-9c64-f4d81afa3fef", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35732aa6-88d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785060191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060191, "uuid": "bc14da78-89db-4606-963b-17a5442db904", "comment": "Malware payload (WannaCry)", "value": "7fa66cd078571662d30ac258f4f353c6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060191, "uuid": "0b8ebfd3-0515-4738-855a-064b4213aeed", "comment": "Malware payload (WannaCry)", "value": "467d4772b1d4678dc935c8d4ce638f1d76dbd28a772fa713dad13061483914d5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060191, "uuid": "fd4f38e2-3228-4698-916f-efd39673d1b8", "comment": "Malware payload (WannaCry)", "value": "73fbe1e66f0c4b29e4673920b154b8f863560713", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060191, "uuid": "d8cf57f9-70e3-465f-b522-c4cd459ba28a", "comment": "Malware payload (WannaCry)", "value": "06e910ea1a05b4ab660aa942ba6983f95cb0b151a5c5cf77beac775b93f271a6d1842836c3be257fb7d7804fda1edee5", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060191, "uuid": "0e0f03a7-fa72-4d63-89d4-90588130dc43", "value": "T19B367B13A7EC025AF6F35B39D47664519977BDCA2836D20C10A42A5E0EB3F218CA177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060191, "uuid": "d5653711-4d31-4e73-b9e7-7b52bf26347d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060191, "uuid": "281bc527-6dfd-475d-a790-55cf9f346ef4", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P5:DI8qPe1Cxcxk3ZAEUad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785060191, "uuid": "8a0a8e10-8e07-41ca-9737-6d1df7c40903", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785060191, "uuid": "7a4d8120-1dea-4d10-be7b-7e0f2e4a1102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060191, "uuid": "72d7ef38-a6f5-44dc-b124-2ad81c92b156", "value": "467d4772b1d4678dc935c8d4ce638f1d76dbd28a772fa713dad13061483914d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706cb420-8922-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785091643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091643, "uuid": "3c5a58aa-433f-474b-965a-1d8111a01ec7", "comment": "Malware payload", "value": "baddbccad0733c684c6f86c418ae401c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "logs-workflowengine-cc", "colour": "#D34DC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091643, "uuid": "6d7f0850-ce52-42d6-8dbb-d4f1a1adcd1a", "comment": "Malware payload", "value": "46fcdef3fc081c8de5f687e5fb1a1e9cc597cef94c996154b5c85912f1506ba4", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "logs-workflowengine-cc", "colour": "#D34DC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091643, "uuid": "2ce2c287-46c2-45ba-aa4b-01f6054f4072", "comment": "Malware payload", "value": "562a96528bdd01f258e950c224c769fd35d9cc6a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "logs-workflowengine-cc", "colour": "#D34DC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091643, "uuid": "54e64f72-f3e7-4594-a76e-f3f5e5c19c0b", "comment": "Malware payload", "value": "f613ab120466b79fc0f8f15ca166cb002ef6e64e55d5644a73c4906674a7b322b4a7e31fc723c4fa042a463333a402c1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "logs-workflowengine-cc", "colour": "#D34DC3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091643, "uuid": "f7b8a1a3-2793-4642-a3d2-e53eee719cae", "value": "T1C2C61294D5FB4907CF0EB6FAB0CA81969DEDCBCA59205E23043C73CA5C965B10BD660E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091643, "uuid": "00a9b36d-8531-4618-8f94-ef48384812f1", "value": "196608:Heq8Dne/gMB2Rd2nGJvhlPziS33ceHZMOWKcXBP/15qhBb8nkWR+gKUvvM7:Hl8Dntj3zlLiS33ceHWMcht5qh/cTKG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091643, "uuid": "2aec1921-0384-4dd4-a24d-5823e996ccee", "value": 12151153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091643, "uuid": "86e53d23-84a1-4beb-a88e-447c086c6666", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091643, "uuid": "ab89ec67-464b-428b-8178-ce6af3dc6082", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879b138b-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088246, "uuid": "5443095e-aee8-4a97-92dc-81452b04ae5b", "comment": "Malware payload (Mirai)", "value": "0d10830b66179e2c2353ae27a7991302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088246, "uuid": "97f6f2e2-d872-4732-a262-985f90904018", "comment": "Malware payload (Mirai)", "value": "47260b2c5e4d49f0c738bb26b86582effd1ec9faf57de44ae6feab291071d55c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088246, "uuid": "83eae847-cbcd-40e1-9dfb-6955396593a0", "comment": "Malware payload (Mirai)", "value": "dfd4fec1817677604e63093c142a5e3b27b3377d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088246, "uuid": "892ce978-e319-48d5-a197-200ede044381", "comment": "Malware payload (Mirai)", "value": "21b0e5d67eb3b0f05c4e05029f62f46e1077f168a7bf0279b77a96de27e193053a1777d3b6e341adf4133af7eb09c14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088246, "uuid": "7cd653da-1f86-4bf8-bd01-86b1f64d11fe", "value": "T1BD33F173A2C64C21EBFDD3371E5E669EC80CD45CF59844C99E84283698E6F1E9A183A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088246, "uuid": "22b1daab-230d-4a93-9505-3edce9634327", "value": "1536:XhXnX8ajEiHszzUlQ/NFWeBjw8PIL/Puonouy8Hy4:XhXsSfMsl8NzBjwlLuAoutr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088246, "uuid": "b9f5caaf-df3d-49d5-966a-d4fe695f16bf", "value": 50336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088246, "uuid": "2600725b-2eef-49b1-9244-8651d898c13b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088246, "uuid": "49722bd0-d0c2-4b83-89ac-a392300b1fee", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe1f52b-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088367, "uuid": "b8479d8c-8250-480a-b01a-f2f6ccac72fd", "comment": "Malware payload (Mirai)", "value": "ca3f0ab34176e4caae1f2d78217ffd4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088367, "uuid": "8167566b-23f8-4aea-bfdf-c1cf960dfc55", "comment": "Malware payload (Mirai)", "value": "483f2a64b4303a31118cea9c14d92fd534b0f6fa5f75eec98799b18c4f5202ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088367, "uuid": "256b5a03-c23e-428c-b0b3-f34f86e57b27", "comment": "Malware payload (Mirai)", "value": "3e6fdba7ee8b7b427b71d5d6ce59e31b8c5f667f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088367, "uuid": "2d95275d-764a-4e7c-a86b-add6c31a7225", "comment": "Malware payload (Mirai)", "value": "483b13be09db4c299b9fd5935134999d9f119c23013cd2f04380669e8438b7f3c3d636f9f148f437a023818ba3988138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088367, "uuid": "9c015523-324a-4233-a7ea-4d290a6c6c44", "value": "T131D33A45F8814A21D5DB12BEFA2E218E331217B8E3DE72239E255F2133C669F0D77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088367, "uuid": "6fea2b36-67a7-4a17-a132-616504896ab5", "value": "3072:6ajJiPkvbN2Xr/kelTvMaLyaHbt7H4jyaJrIHL5x5W:Zjar/kobMaOahkjyIIHL5x5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088367, "uuid": "eb355753-aea2-4415-bb05-bf52d9f1ee13", "value": 132884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088367, "uuid": "560f681c-448a-4e23-97d4-6481646bffe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088367, "uuid": "12cafdd0-e408-4d9d-94ad-a17bb0293fdb", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669706b9-88d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785056408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785056408, "uuid": "776a32e5-5b78-40eb-8224-89d5815c0964", "comment": "Malware payload", "value": "d3eb122fd44a9d3f7b72e071748d3196", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785056408, "uuid": "0cbf335c-d8f9-4f11-99e8-3bdef5b8f690", "comment": "Malware payload", "value": "48529988c5269d5faaddf4f9dba4a652df736b3b6fc9d577bc1fd646db3ae233", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785056408, "uuid": "de39a449-365b-496c-9349-89c369c88c91", "comment": "Malware payload", "value": "817ef84468dbf2e042dd62fac9d6c1eb2734bc4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785056408, "uuid": "5008cff7-035f-4d1c-94f7-27d17cbfe3a6", "comment": "Malware payload", "value": "ed6be777c43369c923bc3bd915109a39f9514605e349da02e18d64cb60b7c0b8c5871ca721033d90e33fad2cae0277f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785056408, "uuid": "c2c56340-70d3-4328-9aff-54dc7af60932", "value": "T1AF866C73945224D8E1ADC974D5141612BDB83C8B573863CBBAC476F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785056408, "uuid": "e013152d-eb23-4842-9dc1-86a5982a5692", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQu:cqYUQuVDt0TZE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785056408, "uuid": "2d252430-5943-4e85-b1ed-c28f37312066", "value": 8323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785056408, "uuid": "8bf7bb56-03af-4594-8d1f-558c8784c64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785056408, "uuid": "35893917-096f-4618-aa9c-67543bcdfcd7", "value": "48529988c5269d5faaddf4f9dba4a652df736b3b6fc9d577bc1fd646db3ae233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b979362-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070053, "uuid": "46a596bd-6014-4c71-8350-49181d3fcd4d", "comment": "Malware payload (Mirai)", "value": "1da3f02f8cbede2be45313c529943a7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070053, "uuid": "0365ef99-ff38-40d7-9cbb-696fdf7de971", "comment": "Malware payload (Mirai)", "value": "492c65376c9bece3aa5a11dbcb8f71c620d36d5ff75a540a8f518c8fd4fb8b5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070053, "uuid": "2bb0a137-9b84-453f-93aa-c36d2b434804", "comment": "Malware payload (Mirai)", "value": "4ccb1d56a9e5fb860e132a0ce2202e5886be6403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070053, "uuid": "3870ba54-7e79-444d-863d-8c6856ded2c6", "comment": "Malware payload (Mirai)", "value": "a3180fafe8a63dd83c699f070d2b54fe31b567fc8ff0da1b4491a07d889a90da27591d7a86036791a4778b5a38a67f4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070053, "uuid": "d1401602-33aa-4500-ada0-6692f3061d3f", "value": "T1FD733C02B70C0D47D3B71EF03A3F27E6939ED58132E4EA88294EAE4591B1D3255C6ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070053, "uuid": "a7418cdf-9e61-43aa-b1e0-78f4ff22def6", "value": "1536:uN9mz9CQwQwQwfO2/hiViktuGRN4rlVja4YsZnsHUOvfYrwecqvNb:ubKPmhpVjakns4Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070053, "uuid": "837b2cad-1fcd-4ab6-a06f-3db4d272c081", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070053, "uuid": "09aac250-e347-4edd-b535-c9a85576b6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070053, "uuid": "3f00fb20-47b8-40e6-a623-e71a8cff801e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce84fe0-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081222, "uuid": "31d6ff5c-1df5-4e19-bfb2-b6cba3a4f78a", "comment": "Malware payload (Mirai)", "value": "86976feeadb96a6c9fb966039f3030e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081222, "uuid": "e86e6a78-8d7d-4791-93ee-0b06a58b3bb9", "comment": "Malware payload (Mirai)", "value": "4a38fc33ae1ba2e37acb788870badb24d11348e6463589fa479259f46fa6779b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081222, "uuid": "8107fde4-9221-4362-8f9f-88da69418e3f", "comment": "Malware payload (Mirai)", "value": "3d06269a25cffeeca2e03a6f79efd46c8ea87eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081222, "uuid": "a2dba828-adc5-4369-94cb-a714ba5190bb", "comment": "Malware payload (Mirai)", "value": "f9fc893f4ff788c669a47f635cd6f56d49b647fbbdb758193cc8586e322cd91484b5b337f8fbfc452306b2c507cfccba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081222, "uuid": "1e8b6618-b2b1-40d6-aabc-3d92da00ea65", "value": "T116345C4B77A08F90E275D93006F34AA79AB9129317E39545E2BDDE113E6034C6C2FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081222, "uuid": "a3964a1a-9f39-41e6-8cd9-c990967ed8e4", "value": "6144:wc4e/ONXwIMZlMY6GUMMZf0TsyrHdLXDX6/0M8+:wVePIMZhuasiXDKcM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081222, "uuid": "3a443235-aeb8-4973-bccf-82b420c08906", "value": 241208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081222, "uuid": "9287fa39-b1f3-453a-84f6-1ec334dfac3d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081222, "uuid": "f291672a-16e4-4d96-95aa-78424cab6433", "value": "flutter.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b947c0bd-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "8c3e446f-b105-47fb-be2c-3d2f4a33bed7", "comment": "Malware payload (Mirai)", "value": "84c603326af97275d75e6cdbecfd340c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "ede60a36-42e2-486e-9daa-a33f76867dec", "comment": "Malware payload (Mirai)", "value": "4b3f2d81134d733ca300d4df8d1619a0a1a7464a00bd1f230a83381cddb35edd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "eee1d047-f7ee-4d10-b682-5725050fa249", "comment": "Malware payload (Mirai)", "value": "f52235796a256d2c56088d4b35b2f0196acacf0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069861, "uuid": "e13073cd-83bb-4e68-a25d-bbb68ab5a0f3", "comment": "Malware payload (Mirai)", "value": "9fc19427cd3e13fbb09fa98f9b312e9f138f3b383952d8b5bd217b31cf35f1b17da1b8ab829a0b42daa25ad5a9862091", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069861, "uuid": "a644df8c-414e-4eb9-b49f-925a8bf70d8f", "value": "T1E0530206E5E03CA3CE96C5B7D1574E003E1ABF24D56EB4FEA3680415B75A80487E72E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069861, "uuid": "af658023-ffce-4f7d-b254-2236071f7e0c", "value": "1536:IZxlOlQ59rCRj2nOlvt3rzThdnmoLSY2H1YZj7RT:IZPOe5lCRjgOPrxDLSY2HeZXRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069861, "uuid": "a690d82e-4f10-4233-a75f-aa1c0a2a9836", "value": 63544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069861, "uuid": "d4c246f1-49f6-4ab4-8311-35c472f6d4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069861, "uuid": "583f8324-24ae-4fb3-9638-c9092580cff5", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8705fc99-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068917, "uuid": "c846801f-4caf-4ba8-8177-3f13dd692156", "comment": "Malware payload (ConnectWise)", "value": "6d65f635af16760f4bbd91e0b712e97d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068917, "uuid": "9383fdeb-aa09-4443-bb40-7b37869a0450", "comment": "Malware payload (ConnectWise)", "value": "4bd8c30ddbb6f06b528256a77baf4d37073528f22bbb2323a9d567c294226e54", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068917, "uuid": "dc9226cb-44e1-41c7-98d1-00287cd0ea70", "comment": "Malware payload (ConnectWise)", "value": "4c775957b9f7810b99fdc5adb971c8ad18d5334c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068917, "uuid": "345ed0df-e723-4cd8-98a9-c09d222a53b2", "comment": "Malware payload (ConnectWise)", "value": "47b9487e38768f24e69cb37c1ea225d45be2e753064f5f48b50f81b3501e4e0d44c5d2339b9201384a48ade69fcd13ea", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068917, "uuid": "946fd48b-aa23-4246-b999-d88a5ce350bb", "value": "T1F0647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068917, "uuid": "430648c5-4e72-46ce-90e3-4dca784b810c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068917, "uuid": "401d244e-4e92-4315-9b87-b8c856f3abfd", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:A1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068917, "uuid": "edd8cdbe-460a-4d03-9810-9b468665044e", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068917, "uuid": "26b1f937-031a-4ac9-af86-d62de4a94230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068917, "uuid": "1ffa423f-a968-4273-b0f0-d08375e68fb2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a2c1a5-8907-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785079976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079976, "uuid": "c00258a3-0521-42c7-bc11-c70c16371688", "comment": "Malware payload", "value": "7672211e57d1f557c6c3aa013503df28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079976, "uuid": "3fee8b2c-1c90-44ed-8844-6093b1e98b41", "comment": "Malware payload", "value": "4c487d86d904ec55002123163e8db6dfa93918a342036cf0d155ce9c2f662c7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079976, "uuid": "bbe879f0-4371-438d-9fd6-c04880f6ca6f", "comment": "Malware payload", "value": "ed520cdc859946a93421205d6dbba61451649b20", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785079976, "uuid": "b64bdb6e-aecb-4d63-a68c-1e484189d35f", "comment": "Malware payload", "value": "a5e8d3992e1f6ec7deddcfc07908bbf362434aec8f8e6c1dcf75c5e2a7493fe54a85920c411669e09d320d0b4abed1fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785079976, "uuid": "6e65eeda-0fc6-48f6-9cae-11c41e9d19e4", "value": "T10CF42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785079976, "uuid": "40966b5f-527a-4733-ac47-c53184dfe91d", "value": "12288:tU7wAcpxXAIIETE1UWLwJrr1nuwyiPUcyvmByHaRR1L+:tU7RyAOTt4vPaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785079976, "uuid": "9baa4ba7-c706-46ba-8c71-a87974d3133b", "value": 723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785079976, "uuid": "389c6bab-9d69-49ea-b15a-238235b839b8", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785079976, "uuid": "ba824e6e-cf54-4762-bd6c-b293044d810e", "value": "cursor", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0cd7cb-88d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785057301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785057301, "uuid": "be702db2-8042-4a45-8813-70068e361330", "comment": "Malware payload (Phorpiex)", "value": "c2d1ac4a8b2cb770fc1f594c3b050a8a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785057301, "uuid": "5e493e02-482d-40fe-9f77-757006c35e3b", "comment": "Malware payload (Phorpiex)", "value": "4c5529e4e93f8504affd39e5deea46a1ea4410600e39a9c66d18d9dc2cddb204", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785057301, "uuid": "22037fdd-ac0d-4452-a388-b762212200ec", "comment": "Malware payload (Phorpiex)", "value": "5dbb0bab48b31e4e9911d1e70f727049ff81129f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785057301, "uuid": "eb98736d-2b84-4f71-bd3c-ad79661b3042", "comment": "Malware payload (Phorpiex)", "value": "1ba52db0e22cca8b841ec6509a9e2bdd50e4da91988a3eb68b5829363486c6e24df4d0671e7f1165d1b36cc41a9b1ae0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785057301, "uuid": "52f24b11-634f-4694-98d2-cdd942e513e0", "value": "T18E321A0BBD948133F7E004F195BF968B8AFC29B23795698FF780B10A2975351C1616AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785057301, "uuid": "f84057d2-e842-49ff-aacb-6754893897b2", "value": "38ca2cef077b08d131c2be3bfd70789c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785057301, "uuid": "58e25c22-1e8d-4ab6-b03e-dc1a34cb1a8c", "value": "192:2pd4GvyoejTWghMfhjff7JJfxMLkWScZqYa/DT:2pd4sv6vsTxMQWSc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785057301, "uuid": "a62abd59-26ba-41f7-b6cb-e0ec9dd7db21", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785057301, "uuid": "54454f70-4133-46a4-a8fb-01c0578dd279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785057301, "uuid": "4d4e81b5-7447-4ab7-a63d-b3089a07416e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ce0272-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063352, "uuid": "57c2c937-97d0-48ce-ad21-8382e7a92183", "comment": "Malware payload", "value": "48164b0a8683efbd98e5efff48371fed", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063352, "uuid": "b70de3ce-8c26-4422-baaf-ffd4ec6175a0", "comment": "Malware payload", "value": "4c6c1d6779b94b5144f26b6f8737636f9312d3f6a2b0c06b03fef37f552db203", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063352, "uuid": "141756c9-b14a-4616-9410-fa8e3fa6000b", "comment": "Malware payload", "value": "a96ea512ae4ef320be587f0c9ef534dc6af0d58e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063352, "uuid": "458d2dea-f853-48d1-a274-39c2cb88b9bc", "comment": "Malware payload", "value": "4458ba56ed2354160cab24d7c68f35d078f8b976213ff2ca33f44994e00e02fec6403e5e5ed7a1ec14104b3992e3935a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063352, "uuid": "edfff1f9-0ff1-40fb-8d33-24ca0af26428", "value": "T15D8533B3293724F4E4B03937CCAD9787C1D6BCBE9AABF38E5D40C59011499B24A5C9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063352, "uuid": "e7151ca8-3ee6-4802-84b8-875441b2cbf0", "value": "49152:xNiqjZkOJ+BC+DI9BVaVggbr4SQGOLJFeVvaGna:x8qjP+BAYZwSQGOLJFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063352, "uuid": "146a2bf8-e185-4124-a781-0fa450d8d8cc", "value": 1776620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063352, "uuid": "f43a52db-5ea4-4ecd-979c-b7f91ca1a448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063352, "uuid": "b363f877-e6ff-40c5-a503-0909fd4ba0c2", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6917bc-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088259, "uuid": "2a7d3bff-0140-4df4-a1da-1ebda8893a6f", "comment": "Malware payload (Mirai)", "value": "c6728b13e3cba62f04b1de6b713a00c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088259, "uuid": "799217e5-1558-4e11-9505-8eecf3a9c317", "comment": "Malware payload (Mirai)", "value": "4e7f5ea43897e1e55cf846ed552d85e675f3bd1918d923127c6e1f37f8215cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088259, "uuid": "c68c4bf0-9af3-40f1-8869-0b63ae411d1a", "comment": "Malware payload (Mirai)", "value": "5817c0c1ef025bf58d06ba55b636ac95d1973920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088259, "uuid": "55003523-a208-4d55-a459-ab920db4c9d9", "comment": "Malware payload (Mirai)", "value": "f4ac23f44c31ba488ce80cdc98a4964bd289da63d3c10225cbe55ddf2c68dee24e2d3b8752207bb831b70a97666ebaea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088259, "uuid": "15d00efa-b747-459a-ac5f-cfb687ebd129", "value": "T1AEC34CCAB802DE7DF50FD9BA542B1D0AB921A3515583172623ABFD936D321E4BD02F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088259, "uuid": "bb96aeda-4b7f-498f-99ba-ffc7badfe0e5", "value": "3072:IjZpROP0/aMQUGkJz+v8YFMTXqYYt+xPFUiBm:uRO8/aMQUKUmMLqixPFUiBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088259, "uuid": "29cbff07-1579-4860-87fb-d5a1f3b84c39", "value": 127320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088259, "uuid": "f8ac24c8-6f70-4b9f-9520-18260f32fda9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088259, "uuid": "582494e2-8f52-43ab-ab18-93331d0a3c1f", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b68e8-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785066155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066155, "uuid": "425174f7-bfa2-44f4-9ae7-72d76e064cb2", "comment": "Malware payload", "value": "9ab8c3a9c3438eacdb43e3c6ec9b163c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066155, "uuid": "4713cffc-fafe-4309-bb83-cd0147d7ce32", "comment": "Malware payload", "value": "4edddd66b6178ec78af28bc437eaa675319fbcb0e83a7f5b6eebe42c543e6372", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066155, "uuid": "83937924-a782-4fc3-8674-83bc634eea13", "comment": "Malware payload", "value": "3e9a4a53a5d515ab385aaf07cbda96f28b2c66a9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066155, "uuid": "c9da5b41-b68d-4541-8722-cd2aaca139aa", "comment": "Malware payload", "value": "bdd7e22b9032116f597daa268322a56c8ebe2785a1b04ab0411ef261ec49a2c3885460297d5d2fba74ab32570f08cd59", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066155, "uuid": "569e2627-3617-4927-acd8-26ba793d040f", "value": "T19B0833BAFBBC1022D84994B953C084A45FCEC0754E97E4F4F568926FAF536C0EE21627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066155, "uuid": "beed248d-0472-428a-a6d7-212d387bd74d", "value": "1572864:ZrziNx5qlpvenpSeA5MR8TIHzFV7w2rOs5FkDgRPx:0x5qlEpHdTzbhis53H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066155, "uuid": "2c7e94f1-2715-41f5-abb3-90176d34acfa", "value": 84310879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066155, "uuid": "a24ceefd-df33-46ec-9a18-3c52620d42b1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066155, "uuid": "4d2b85b7-a3f6-4cee-96e4-ed2b0d31bcc4", "value": "app-64 (3).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926c1ab9-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785106303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106303, "uuid": "28b505c6-abeb-482c-81ef-ac43467765db", "comment": "Malware payload (Mirai)", "value": "57645793382fc0f1ba98660977ba977e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106303, "uuid": "27115e10-851b-4427-a63c-5146eaef2ca9", "comment": "Malware payload (Mirai)", "value": "4f58256a0e3199a31f42cfd1a9c2637625c8c3386b290ad4a95d5534af58c74d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106303, "uuid": "6ead836b-3900-4de7-a81f-ff00b8cf6dee", "comment": "Malware payload (Mirai)", "value": "fe3a3b8c3d3e56ac8c7dd0a51e3eda5711bf4415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106303, "uuid": "65b8c6d0-62d2-4654-9cfd-4f24f7d23bca", "comment": "Malware payload (Mirai)", "value": "efd534b7828b3f2d33109bdd17573d4dd680672f546bd7e1d0afd5e44f4d719111665bd18abdc9136a951c7a2288b3e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106303, "uuid": "9fbedc6b-fd98-4f27-929a-40bffe8d7294", "value": "T1D1B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106303, "uuid": "b7515b10-bbde-4712-9b0e-864b68dcbd04", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4uPrs9j4ZWn+E7+TeVedVPneQBZN01X6n:gni50poFLP49j4+7+Te0dVPZ01X6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106303, "uuid": "826a21ef-14af-49bb-8ecf-893434d0794f", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106303, "uuid": "a7ed2f2b-f456-4e84-976b-af3d41d0dc8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106303, "uuid": "878133d8-f55f-436b-a5d5-a7a0049256ea", "value": "SecuriteInfo.com.Linux.Mirai.9816.6013.2947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92de2047-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063354, "uuid": "7af0c6ce-b8e7-4701-9366-4d5e1fca97c9", "comment": "Malware payload", "value": "9ae6517d350197a75e62fddc27dbbf42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063354, "uuid": "ea01851c-31fb-4394-a493-d499a6b5723c", "comment": "Malware payload", "value": "4f59ae7f68e747ed8920301c1a1ca1cbed916ede7cdba368c08b90da35e31acf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063354, "uuid": "36aa4d95-5824-4209-b880-1fb8c2f326d6", "comment": "Malware payload", "value": "f2eebf27fef60d615290fb49f39ef2f511f42d3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063354, "uuid": "47c73dfd-7dc1-438f-b446-a7b4e6bf389f", "comment": "Malware payload", "value": "61f1b337729fe53cb97a14de5c026ac3ba90ba43ac23ae6f7973a98d86790e3f19a007fa8155b1470388e6c4a8082e44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063354, "uuid": "6ef48ea8-3b08-4628-aedc-158bd4f0fad5", "value": "T12E566B0DFD64CF61C6A003B689F812981371AD066FC74B03A238F77CBDB6694EE46695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063354, "uuid": "a332dc51-ff47-499a-8e3c-934928d5ba52", "value": "49152:bEoo+4VZB99ZXoZqBnAbonF5ATtZw+8p1ENbg5EA:w+sZXoZqcruEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063354, "uuid": "414b861a-e03a-4d39-984b-0313b2dba210", "value": 5963924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063354, "uuid": "94648a58-123b-46af-8914-c9b0b21cbb81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063354, "uuid": "44ad5213-686a-498a-be02-f374914329ff", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcf1177-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088253, "uuid": "958f4c65-96db-4b6c-92a8-13d7797f10e4", "comment": "Malware payload (Mirai)", "value": "08c0526400f34a70d2e1de85e751e36a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088253, "uuid": "d6d5c2c9-e9db-42b0-9896-5de1f5e2e720", "comment": "Malware payload (Mirai)", "value": "4febc0a0ec7d79a38575b16f516c509fe25d1658d638993dd88b002f7906298e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088253, "uuid": "f8bf78e3-a168-4030-ac89-ca2b707e6aba", "comment": "Malware payload (Mirai)", "value": "7c3d9da900abcf910bb048153b0590b0956164f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088253, "uuid": "4bdd8b11-88ab-46a8-88dd-9dd9c189d730", "comment": "Malware payload (Mirai)", "value": "19fe72d4cf41acaeb2cb21fb18556187c2e0081f902e8f570d9faf7c2def9d3b3e3fea1935cecfa68d85a1c4e0f7851d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088253, "uuid": "c488a2f6-b5bc-4e5e-a1d4-86e601f35403", "value": "T1EAE2F1803092BD5247B04431F95E8BC64AD20379D9E7A1933F478EA8F2576CDA634F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088253, "uuid": "b3515b97-b00d-418c-8371-86cbad4c8156", "value": "768:+zllPrD+5WgCIW6UJ6mbSUpZahz3gPTCRMs3UozBS:6PHLtIYAmbSVw7uzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088253, "uuid": "1b0da333-cc84-4de6-8fe6-7d61f3d8b156", "value": 33524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088253, "uuid": "0db7a631-0470-4d97-b40f-24092bdae088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088253, "uuid": "59760de2-5246-440b-b80f-46839280825c", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5420e41f-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044351, "uuid": "71d0737c-bc1e-4669-9825-2109be10887b", "comment": "Malware payload (WannaCry)", "value": "98b8db2b82f626f52bd846cfe6c47ced", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044351, "uuid": "989e0bd0-2dc2-49bb-86c8-c4508ec4b6cc", "comment": "Malware payload (WannaCry)", "value": "502463a92e5f7b793ab5e082467d47d0ad6c8171c3eb6f98db7b095907135c2e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044351, "uuid": "a53b98c6-2724-4e91-987b-1332a1cd38fa", "comment": "Malware payload (WannaCry)", "value": "1d6d4a99c92787defe61ad9e771b72dff200a0fd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044351, "uuid": "6e1b80c0-739c-45c2-86cb-1e437084af4d", "comment": "Malware payload (WannaCry)", "value": "0c92a8efa56e9846d259a467648c91d6a7251bd4bd83efa7ac3ceb13ecac1f1e0c487ddb64f7ce49c10be86eb14c5184", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044351, "uuid": "d80e8ac6-7f11-4413-9b4a-61c3d77c5cb5", "value": "T15136239931BC81FCD106297484B78E22F3B37C6A22FE5B0F9B40457A2E53B56B750B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044351, "uuid": "730beead-8f02-430f-980d-532be5cd9962", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044351, "uuid": "0d415624-5670-482a-a55d-e02597dd8cde", "value": "49152:jnsnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMnPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044351, "uuid": "280eea65-65f8-4bde-98ef-4975ee54e8e2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044351, "uuid": "d4bacffe-f28f-4098-b2cf-ac7809af1fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044351, "uuid": "b42fe4bb-0753-4246-8ec6-af357b4ec880", "value": "502463a92e5f7b793ab5e082467d47d0ad6c8171c3eb6f98db7b095907135c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452b5e15-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069236, "uuid": "96dcbb82-9963-4731-bce3-864e4758a597", "comment": "Malware payload (ConnectWise)", "value": "f4fc87fe6b9a2ec22e972b3226ee7de7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069236, "uuid": "7c70b424-0173-4d9d-b476-2abd64d72aac", "comment": "Malware payload (ConnectWise)", "value": "50c7b451b3b11e23f1c01b3bfb723a2404d8888537543e42645b68e8112983ab", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069236, "uuid": "b41c636f-c421-4e4d-a9e2-7f9713088202", "comment": "Malware payload (ConnectWise)", "value": "2ae1c23f0d3dd48ef75a9365534d50600b42ee20", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069236, "uuid": "e620d7bc-6f8a-452b-acf6-78d22072bf5d", "comment": "Malware payload (ConnectWise)", "value": "1a784d6c134c2ee53a2b191432c9e9e62ad6d9537d85bf7ed68963617255bfd9c373502c4efe33f4e571fa3339351fc9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069236, "uuid": "c5cdeb0f-3832-4fbf-8d06-f9316c0a54eb", "value": "T1C846E101B3D695B6D1BF1638D87A52696774BC048316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069236, "uuid": "0d05d746-219d-48c4-8974-5a6ecc1baf87", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069236, "uuid": "eb37cbc1-0f96-41ab-8d4a-fe79e2046841", "value": "98304:VzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:VhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069236, "uuid": "f10f6aed-5993-4421-a729-8bf598465749", "value": 5642280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069236, "uuid": "483427d6-2f51-4eed-a90b-769c58b56ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069236, "uuid": "cc7c79a4-6f27-42ff-ad68-11ae91a29ec2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6378908-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106443, "uuid": "c5ca9854-7e08-4dba-9d54-78c0ff272b16", "comment": "Malware payload (RemusStealer)", "value": "e684ae1e3bf3994c4f68e84faa73f806", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106443, "uuid": "ba2ea963-de38-48b3-ab51-b668db77d77f", "comment": "Malware payload (RemusStealer)", "value": "51bfb2f390653647b087d789ef1559c3fdf220c565a909f1eee4d593893420dd", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106443, "uuid": "453b46f3-a541-4674-9f3d-2608842b52e5", "comment": "Malware payload (RemusStealer)", "value": "3102f42f7ea5346f0dd9e05ba35dcb4260b1c524", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106443, "uuid": "57f36300-dd2d-488f-80ef-459321463ddc", "comment": "Malware payload (RemusStealer)", "value": "774dd3a804900d1b4c21d66890c7d08bcfeb66858a9e149757dda10bcb83c207c7241d43398ba4e01bb87c89f5d76f63", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106443, "uuid": "f10a9002-0684-4432-8521-a976e2662077", "value": "T1E724086BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106443, "uuid": "bfe118b5-2696-47ca-bb68-5d5e705ed071", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106443, "uuid": "5a1f10aa-a7f3-4459-ae19-7c7ece455fe9", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFn11CGiics:Qj5WUEBx+Q7PEfFnQU+tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106443, "uuid": "c26b8552-b718-4efd-a356-148c356be277", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106443, "uuid": "f5518d94-519a-4977-907b-24e72925fce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106443, "uuid": "d8b8dbdd-1a1e-4917-9736-bab4316cd8c7", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0ccf2b-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785106265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106265, "uuid": "4abbb90b-e919-47e5-924a-9defc14efa03", "comment": "Malware payload (Mirai)", "value": "4e93e48729747f6894213778149e00f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106265, "uuid": "1803e08c-ceb4-4e7f-9561-a9e74411e462", "comment": "Malware payload (Mirai)", "value": "527cb72afb7644af363fa08aec91c3c1ab0f19535eb4d6b23fe57dfcb3a291e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106265, "uuid": "96b50408-229b-46f1-aaff-a9c926ed5f4f", "comment": "Malware payload (Mirai)", "value": "46d668eabe4274437643acbf0535ddf6ffd43a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106265, "uuid": "4aa61137-97b9-45c7-bc07-1f83a76e65be", "comment": "Malware payload (Mirai)", "value": "96e708b31001db6319194aaaf937d5473892823cfb9d1e062408bba4dcb4589e778cd74475326a535390524d8c3002cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106265, "uuid": "de904671-2c8c-4244-9c69-fbfe383d3871", "value": "T13613F168E70109D2E182413B21B80FD23BD31FF7BD86D86D651CA641C6DB6F03563EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106265, "uuid": "2104d266-3138-4026-ac1f-2fdc4184cff8", "value": "768:kVSrYS3JuIk8or7wskgzNl2/wkRY7aYUeG4pU8T3BomHAdH5p9KhbekJgGlzDpb8:k8DY8oXws/f2/wkmuYUeGh8TG+EYlecY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106265, "uuid": "081f06ac-ded5-4e65-9aa4-5a4149cf553e", "value": 43288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106265, "uuid": "93a16338-d478-43cc-8875-57f40189de21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106265, "uuid": "bc33a82e-75d6-4035-8469-d498a6f3530d", "value": "SecuriteInfo.com.Linux.Mirai.9816.6013.2947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5084ff-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785070220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070220, "uuid": "7ad1635c-09f6-4956-9d6c-22c291a4211f", "comment": "Malware payload (AsyncRAT)", "value": "4ed680e61600ebe73415a12189275c3b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070220, "uuid": "f789ae26-bad2-4615-8127-d36d785bb771", "comment": "Malware payload (AsyncRAT)", "value": "53500d036d4c789301fe793b5c01a392e6bcabd6448af7d1364e419eb3a91201", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070220, "uuid": "16e2bd92-0456-4638-bcba-961969ab5606", "comment": "Malware payload (AsyncRAT)", "value": "09cd1f06e7f51e0bdcdd76c37ecd5e75ae0d54bc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070220, "uuid": "1897c8db-47f7-47a1-8cc4-139c423c9d14", "comment": "Malware payload (AsyncRAT)", "value": "3bcfdd9126c978d568bc7ac3a9725d2622ac44883985dcf554b91036160addd5abb7883c6fa592edc84b03b9c2cff5e2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070220, "uuid": "8e110044-0309-449c-90ea-dcaa4ebe6328", "value": "T10AC22B0833E4C572E2FD4ABA8C33D6108B75E55B9A23D75A6FC490AD292378D8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070220, "uuid": "1cce9fc1-8bee-4af6-b34f-79237ba0783a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070220, "uuid": "da52398f-f423-46fd-80a1-38180c6ca872", "value": "384:QN3SaTSXW9bVWw7HtZARPn9jxH9qbuUsabQxnCJfJBndnjJuRVKr:QN3SaT5Lt+tIbyBiBneAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070220, "uuid": "7c7788b1-0168-41e6-9c84-031634ee625b", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070220, "uuid": "55e226d5-3f83-447c-8692-b1587cf8e176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070220, "uuid": "0739be4e-e734-4585-ab98-98bccf34d0f3", "value": "78WINAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94222ec7-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785106306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106306, "uuid": "13754530-9553-4252-bcde-dde31ef636ed", "comment": "Malware payload (Mirai)", "value": "457a6831ec751129b320de3c63ddea7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106306, "uuid": "a7cfa209-61f9-47bd-921a-2132d96d07f6", "comment": "Malware payload (Mirai)", "value": "53afc0671b022a589954ba2a6755e1fb56a23552b7fb96740035d8c6fb59a780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106306, "uuid": "bd051e89-2b07-4151-b237-05b25877da96", "comment": "Malware payload (Mirai)", "value": "a172f30ac9a5d0ddba29218b6f6171454a31a166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106306, "uuid": "7b51dd02-4387-4041-b9c6-cc00671969b2", "comment": "Malware payload (Mirai)", "value": "23fcb4c904bcfa39e46ea434a67f263291b5026093eebd9a4b8159eaabd9cabd37f89274ff11bd5a8db821f28ab47197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106306, "uuid": "6dfe60f2-c56e-4d95-ad81-98f430109c34", "value": "T153A32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106306, "uuid": "92f6b7a4-2821-4e7a-a8c0-44b05d2aeb06", "value": "1536:wAnTSlO27kf5J7ZLBpqpp8GBgcQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWF6:ilRbpp8nuik7uaRgp2x/F8ThULF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106306, "uuid": "a2bee5d2-f1a3-41b9-a9f9-c07100bccc27", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106306, "uuid": "53ca7d0d-15f2-4197-b87b-cf338100f9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106306, "uuid": "eda046a9-6f91-4ecd-9e2b-82717eb06148", "value": "SecuriteInfo.com.Linux.Mirai.9816.16164.28322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7887e933-8937-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100676, "uuid": "aacd13f9-3a54-41fb-a042-986910d48dd8", "comment": "Malware payload", "value": "24909335a110650fbd9b5633b3855534", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100676, "uuid": "ffae5a5a-5a3b-492b-91a8-5ccd73f14f06", "comment": "Malware payload", "value": "53ba5fd24bbf81d3a2fc53af19884b8ebb6344281891bdb78adb924a1f65b40b", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100676, "uuid": "ea68aea4-096f-47be-b32d-c5854727d393", "comment": "Malware payload", "value": "75b2c0de956c99ba5df53567faab45d878a5ee3b", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100676, "uuid": "6b1ab660-4937-413b-a686-d67c4c8beab6", "comment": "Malware payload", "value": "bd75355772b55298634df9e4b739a7fd5050aab266fd8727e8b235ecd0d3b8b76072181250b041ccbfc21760569ca73a", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100676, "uuid": "e65f275b-e70d-4e3f-be1b-2ddfdf2e4cda", "value": "T1DC65F1926B8D58E5D7C6D33CCC604E54602FF6788834C98F705B060EDDAEAC4DEA59A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100676, "uuid": "07f1596c-1020-45b8-b7be-839c9e446cbd", "value": "32858949e18d8b6ed83e72cb40c63c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100676, "uuid": "161a5c6b-3944-49b2-83c5-45abe5192c92", "value": "24576:by2WPmGW/kwU7GeCvYhT5UROd6e7DtwhslezLdb64If0+x9g:G9mN8wU7ao1UAguDtwpu4If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100676, "uuid": "d57fa5af-205d-4058-af8e-377953b5c7ac", "value": 1451520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100676, "uuid": "9ac52104-b654-496a-a59f-f46e3ddb6239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100676, "uuid": "3e888c27-f040-4619-90c1-b93e8bc63460", "value": "chromelevator_arm64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272a2b51-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070045, "uuid": "b03c73f0-c1f3-4346-b2d0-fce7c53311bc", "comment": "Malware payload (Mirai)", "value": "63664ab56a21e2811f1cd956c6a1b8d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070045, "uuid": "3292c224-0176-4f41-a731-54e31a585b39", "comment": "Malware payload (Mirai)", "value": "53e56e337395ba80d5b1f58f6d72666a4c314006d9c35526544cbd87277f6ec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070045, "uuid": "e6747004-d4a5-4bdc-bfeb-82c44633ffff", "comment": "Malware payload (Mirai)", "value": "55ceac9e52feaa40baa25940de373559eccd0bdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070045, "uuid": "ef161b49-740d-492d-9d5b-c91fe39fddcc", "comment": "Malware payload (Mirai)", "value": "fc69a6b8fce66aed641294b3cf931f1d4e23cc4a1f0dda57cfe4ada207fcfb19b2ba1337635181865b9e86d1fbe0b741", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070045, "uuid": "0e8bdcee-4f86-4e2f-a35b-2ab3cbefa288", "value": "T1A4533B82FA87D0FAE8534571443EF33FE632D61AD121D366EF595E22D923902412B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070045, "uuid": "a94527ab-e495-4c62-8b5d-b369e45b3656", "value": "1536:d4ylp3DVRfvgWZcbIrrsSzDwN61/GeZbWsnrcMSRg:uyzzzNKArs+DwNgxbk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070045, "uuid": "955045f1-1ecb-448a-b8b2-5f5207da8116", "value": 66664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070045, "uuid": "d2dbecf9-f7b2-4747-9218-f41b1bb5f4d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070045, "uuid": "83d52f69-b5a6-4930-82af-39c681fe653c", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55548575-88e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067116, "uuid": "9c91b8ba-17dd-4cb7-81ec-b0745948efcd", "comment": "Malware payload (Mirai)", "value": "8784a63bb94e98471261a51b1feb6acf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067116, "uuid": "892ec778-7e25-42c1-afe6-f3c1f6dce5a3", "comment": "Malware payload (Mirai)", "value": "5401700222b3f2188bd8747711ec183777d61d229a5f8c9bf27e73ede162e972", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067116, "uuid": "55ee960d-f33d-4eb7-902d-5f07a4987d76", "comment": "Malware payload (Mirai)", "value": "f8b630e1e21733c2359130ef2375045c29282c72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067116, "uuid": "ac40d0d5-0a82-48cd-b786-51b49df8ab51", "comment": "Malware payload (Mirai)", "value": "dcf100ace87496d2512d8c344ec3c362c191569db5a10da7b0571a9f36da986f31d30af55641b5ea6fd090557b9632c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067116, "uuid": "b6e1eb24-002e-4363-823f-21a0d7650fb0", "value": "T1F3F054B9E49292F21E58FE68B0610720B15997816231CB5DFC4E34BBEDE8940F638A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067116, "uuid": "97f43a0c-d58b-4015-a6eb-6a35c2c1a6a0", "value": "12:3JTR1F4RIWTJW4R3+4RAYNP4R60LKV+4RWaK9:3r1FcIa8cucAYtchKV+cWF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067116, "uuid": "d364e889-a0c3-4423-92e7-187a57a5df94", "value": 487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067116, "uuid": "e706b783-58b4-48ad-9ddc-0adb4e7f0438", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067116, "uuid": "43f3acaf-e133-4804-892d-c8d27b88272f", "value": "giga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcd339b-892f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785097410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097410, "uuid": "b4bd752e-44c2-4259-bc1f-e001127354b1", "comment": "Malware payload", "value": "f569ebb4d2fa3ea9cf7fd56a223ecda2", "object_relation": "md5", "Tag": [ { "name": "45-140-14-113", "colour": "#DBF90B", "exportable": true, "hide_tag": false }, { "name": "46-225-113-75", "colour": "#5C3850", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097410, "uuid": "fe6a8209-ad80-4efa-9a28-310e11863ccd", "comment": "Malware payload", "value": "54117f39ec10e191bd8d2513998c926cbd70e65f1aea9063f54801db1f046e11", "object_relation": "sha256", "Tag": [ { "name": "45-140-14-113", "colour": "#DBF90B", "exportable": true, "hide_tag": false }, { "name": "46-225-113-75", "colour": "#5C3850", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097410, "uuid": "9529e16d-dae7-4a3a-9d39-aa6b6470d6a7", "comment": "Malware payload", "value": "9b61bf2fa69ea708678739ac35dd665c6ad146b4", "object_relation": "sha1", "Tag": [ { "name": "45-140-14-113", "colour": "#DBF90B", "exportable": true, "hide_tag": false }, { "name": "46-225-113-75", "colour": "#5C3850", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785097410, "uuid": "7bd54946-51b2-4d98-a49d-4210a1946ecc", "comment": "Malware payload", "value": "bfc404f2332bdf55778501c33cd1ef4f11c866812f845e56b167f367c4e1e86a1b5c4bfc209801a35afa35dc5bcf7a8a", "object_relation": "sha3-384", "Tag": [ { "name": "45-140-14-113", "colour": "#DBF90B", "exportable": true, "hide_tag": false }, { "name": "46-225-113-75", "colour": "#5C3850", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785097410, "uuid": "10444f8a-8f97-43bb-8b70-b54c4a14d35d", "value": "T15B66CF52B3C816E9D066D63896059233D2B2BC224772D2CB06E6E75A1F7BBD14B3F701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785097410, "uuid": "c6a98b7b-ceed-4639-86c2-97d33f7fe8fe", "value": "196608:KojyTlmSIiyqGDM7CdiIu3PSUN2v70wKS5W66D7AqltNq8CdRF:ZWTnIwGIbIsSUNSfCyqlq82F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785097410, "uuid": "1e3937f4-71e0-4eda-96cf-6a2906485eda", "value": 6767490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785097410, "uuid": "53a6b0e1-b838-4b3d-967a-663694f3ee5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785097410, "uuid": "c765c8e6-8e5f-41c3-b65c-d5360bb8ca20", "value": "jquery.min1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098ce131-888a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785026187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026187, "uuid": "f6e9aa8e-e5eb-414c-b247-797de4030fc7", "comment": "Malware payload (Phorpiex)", "value": "b19dfd6c5c708e860712654606dfc5c2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026187, "uuid": "4b0d25d2-608a-436f-bf63-41503466aacc", "comment": "Malware payload (Phorpiex)", "value": "5414c823040b85495f88add29911ec42836277d9b1732468f70c29140cb198be", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026187, "uuid": "1194165c-d235-46cc-9442-fb04d617cea7", "comment": "Malware payload (Phorpiex)", "value": "dad9595d91e785ef247b7fef94e8b6e780383431", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026187, "uuid": "9e8b5733-f253-4785-9ac8-c936f797a6a5", "comment": "Malware payload (Phorpiex)", "value": "35ca5d71975128b933dd910cd8ed845e33cd7e74de0f253879a38ed07ff8dd2922c0616b2122e3384534f615550ac2f7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026187, "uuid": "e0492df6-234b-4238-a8f7-4e64dbc95a97", "value": "T167624C0BB4818035EBE14474827F526645BDADB623C4F9CBF7E0648A5EB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026187, "uuid": "993bdcff-3fe0-49ae-a2c7-11b95f3ec95d", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026187, "uuid": "2fee27e1-e4c3-4bb9-99b2-8c0413106598", "value": "192:AWtsGnjXgjk8LMRI+wBdzM1JFeIFFBKUSfEzQbd1gJxTmv8U9cth39ik:A8SMykUlEOyav8U9cNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785026187, "uuid": "5c9b60ce-f906-46fc-8bd5-6f7f159f8276", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785026187, "uuid": "24aae821-fbfb-4a20-9a58-f658fdc251ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026187, "uuid": "dba9d1a5-f4f2-4e14-8916-08525e6e66a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c45b92-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067714, "uuid": "eecfaac6-b2d7-429e-814b-299f55a0c9c2", "comment": "Malware payload", "value": "065a654298fea56fd643d60ef83b3fd9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067714, "uuid": "014ec122-60f6-4d2e-bbe0-e3684de3a112", "comment": "Malware payload", "value": "553304364a231098826212c9653d96d0a4f7ca448808a5372d47dcce4076b855", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067714, "uuid": "c2d30e80-bdbc-458c-833e-5d8fdc251cc5", "comment": "Malware payload", "value": "4b7fe1297aa8c28437de29002ce24578e8191543", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067714, "uuid": "df79f129-adee-49f0-83bd-c00949f340af", "comment": "Malware payload", "value": "7a5f9cc6024a928b9b23b9c2467ef96bf21f900e9fc5e7b82dbbd3c3bb8ba27f87e365baf1a343ac080a9bfe73913756", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067714, "uuid": "d746b9c0-fcfe-43ec-9822-e3c3418e7d65", "value": "T13463C89836BB8431D17FAEFAD5C7624B5E705133B901D2860CD226E26E11A96CD0FCF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067714, "uuid": "fc830d1a-a733-4300-95ca-6692f7f3160b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067714, "uuid": "66319ce5-2639-4f02-ac87-2663e564ecc7", "value": "1536:NODylMTjy1HhweDCoO09b/DyKysAgc8v:NnMvy1BweDCoZ9b/fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067714, "uuid": "a56f2ce4-aa42-4976-a958-5a7b3999016f", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067714, "uuid": "abe287cc-2a09-49df-ba58-6cafe215d59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067714, "uuid": "dd297e35-cfe4-4b83-970c-614ee40b6edb", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b2ff0c-8936-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100453, "uuid": "c2f0b483-627e-420a-9cbf-414b6dbec5fb", "comment": "Malware payload", "value": "3f577fe3546869bd9ea1f185c6646544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100453, "uuid": "be2b6524-839a-4b19-a6a7-67c6795b473b", "comment": "Malware payload", "value": "555e5544368694f5726c77cf1a12e3f2d6d57479a00c462476ec552312a753a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100453, "uuid": "3a0db78e-c454-4ef1-b7d5-6f7d803e729e", "comment": "Malware payload", "value": "95f00f95c96284adab1d7852e67fdcbb6445bba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100453, "uuid": "22bfadb5-63fd-43f3-b206-800e11d248e9", "comment": "Malware payload", "value": "e85a672315299d795029c4b779cf533a8c162ade9d6f1dbe9813a097e325b7ee2c303ab8ed82eba0a50d1e832117a878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "megabasterd-com", "colour": "#D30D25", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100453, "uuid": "2fec7dda-5626-427c-9c5c-09688d6c6d44", "value": "T1F7E32913E29370FCC117C1B8459A5772FA31B8254324AE7EB7ACDA712F11E607E29B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100453, "uuid": "04c00899-2729-4bb1-9f48-c19fe7e5dacb", "value": "dcef13196d9946b892f62428821e6df6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100453, "uuid": "992b7dd5-064b-46e8-aa42-eb03fdb45c45", "value": "3072:30/zFkHuTJyJDwh9rxOvsq9ow7LAsqMsdUWPPhhSGc:3mJwDwh65oAAsRNWHhbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100453, "uuid": "d300de51-70e7-430e-8b01-845983f47cdf", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100453, "uuid": "1a6bf9ae-9148-4948-b89d-374415a54815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100453, "uuid": "393345b2-4ad0-4dae-a2ec-1363ad7da870", "value": "Megabasterd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56869de9-88cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785055951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785055951, "uuid": "de93a9d1-5cd7-4f21-b021-a96bd9c194e2", "comment": "Malware payload (Efimer)", "value": "5602ba9f14aa3c99845b518314c4f2d5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785055951, "uuid": "ed0b945e-3a82-4999-8770-035473f893df", "comment": "Malware payload (Efimer)", "value": "55cd158c88d5e7cd6aadafc8eaf64ab4a1a633691f52951f8b82e2fb5226bbdb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785055951, "uuid": "e3aa7a3e-65c2-46a4-abfe-a709696685fe", "comment": "Malware payload (Efimer)", "value": "2fd434edd4bea9ad91801c4f50550125d8eb12fa", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785055951, "uuid": "442e9f86-db75-454a-899e-059f8eaa3b38", "comment": "Malware payload (Efimer)", "value": "6d110763f5f0608f3c5cc465c263c78529c6ee5407761ba7cc943f39494d1e09979f793ec6170b15fd4b50df88286321", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785055951, "uuid": "cf27fc6c-3be7-43f8-a705-651eca89076a", "value": "T18CE6338D5BE001FDE533803DEEA22686D4A634B90779C8CF476887646D276E20D3E75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785055951, "uuid": "f8c234dd-c959-46aa-81a7-6ef502bb8a0a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785055951, "uuid": "bdafeb1c-6ab2-45a2-bee1-a7edf1553c23", "value": "393216:x90oDlP8xPieJxpLh4+I2RXMCHWUjX9cuI3/PGTAI:xxDR1QLK2RXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785055951, "uuid": "20415c75-eff3-487d-b6ee-138a2df18c69", "value": 14278546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785055951, "uuid": "088d971d-7093-4f36-a2ae-23751a1cd735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785055951, "uuid": "34edd076-0b59-4a93-8140-68bdfc7f5088", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1068a153-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104367, "uuid": "189ccfa7-9537-4c87-ac53-af75925c95e8", "comment": "Malware payload (RemusStealer)", "value": "eff12246e40f22f87be90b4d27b2daa5", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104367, "uuid": "4171570e-b2ed-465e-b0cd-e5a4715fa247", "comment": "Malware payload (RemusStealer)", "value": "55fa2ac196000639174619c5ff366119c874393cc4d3575533639cd409af1758", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104367, "uuid": "bf18669e-e427-433d-9313-a7246a8e9294", "comment": "Malware payload (RemusStealer)", "value": "43563fe1d748cac51e21738045f579747eb22d93", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104367, "uuid": "2dd702c6-5284-4393-810c-6fb7d43a8155", "comment": "Malware payload (RemusStealer)", "value": "bf9f54ee959cc8aa591bdfb962ec1f5ad8c42f4814b15f4f65de35286ee8325e4bd54a3d69f6409d81b2393fde12b01e", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104367, "uuid": "4383682c-5e90-4812-815d-d7712ee3b012", "value": "T10EC55907BCE109E6C0ADA33189B256527B71BC085B3223DB2E90B7782F727D19D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104367, "uuid": "40ab414c-5b32-4883-944b-5490b889fa70", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104367, "uuid": "f8a4b84b-100f-4143-9fc2-4092e8c2a7c7", "value": "24576:Tr/pYG6ho+c65IlGKxz3ZoZUZ0uCKOBkEGg1GpUb/EaNSPZoBele5I9DUAKsKGKk:Tr/yThoZOIFxz3ZDZmqE/EaICrpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104367, "uuid": "67230498-974a-4b7c-9459-6891c0c0f3a5", "value": 2614104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104367, "uuid": "164c3974-bc73-4333-a35a-86ed83dae1d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104367, "uuid": "8ef9f576-ea3e-4817-aa4a-5f258179d8bb", "value": "kJHGFDs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422ee9ba-8921-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785091136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091136, "uuid": "bbef9b50-4dbe-4a21-ace7-7ca58cc596b9", "comment": "Malware payload", "value": "0ed94a916ff8b0ba6961350199107771", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091136, "uuid": "1b901632-e187-4df2-bbfb-bd3149c7e0de", "comment": "Malware payload", "value": "572d44eac073aab84c18a6fa39825b41dc5a8dcd1f2621c09d18346941040235", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091136, "uuid": "83672b32-4c1e-4e95-b89f-b5775f775e87", "comment": "Malware payload", "value": "cdf0e14307dd75227818d10b85b5e1e49d728927", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091136, "uuid": "cb7f5f98-0403-4567-8772-3acee00b3c62", "comment": "Malware payload", "value": "d7dfe0e0e9bcd550ec0b37cc023ab8d1db286691ab14ebc0e94d0bd898ee4e4469be3582bfbbba0360f558ac7cb422e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091136, "uuid": "d1ebde82-1cd0-4b92-9647-48639dfb84df", "value": "T1D5236C6516857C14AA99C4375C7E2F0CBDAD43E6314492EE7FCB3CF28C4A6ADA20861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091136, "uuid": "02c9dd97-b472-4722-93b1-6203a9886aad", "value": "768:Sr9NyXsZztCK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:8HusZacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091136, "uuid": "0b2082bf-9eb8-4d41-8dd3-3ba8f9b98f67", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091136, "uuid": "fdb9a34e-3cb1-4478-8ec2-264bf54a4585", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091136, "uuid": "00469404-bbd0-4bd4-932f-80b9fb871368", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8877b8f-88d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785059552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059552, "uuid": "ab75476f-5e90-4751-b932-bfb30974ec37", "comment": "Malware payload (Efimer)", "value": "8541dc9787c671e3ab5b51a252dad4a4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059552, "uuid": "b641419b-6cd7-4689-9436-8d8b6ff5d521", "comment": "Malware payload (Efimer)", "value": "57cefbb075b766c47392d9a85ccc88ba95c6727b12828046a7e81b20f085fc6a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059552, "uuid": "614757a2-3c7c-4fac-966f-9022c72422bf", "comment": "Malware payload (Efimer)", "value": "a8830bb425a309d578ac5f295d679bf002fc844e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059552, "uuid": "bb9a9869-de27-4b73-9be0-d47beb30f96f", "comment": "Malware payload (Efimer)", "value": "5b73dc1fac734444df0b7e9971acf08435bbe59e135653034d53b94026723935198d8e96aa06bf1374a03e75f31f9f7a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059552, "uuid": "c37e7f7e-aa4a-40db-833e-7ba0802000be", "value": "T124E63300ABC040EFD637513DAEB213A2E8A978358B72DD8F97148225BE571D08E7D667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059552, "uuid": "e6a49300-c53c-4f56-8e68-31832f53a693", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059552, "uuid": "29686e5d-8176-4a81-988c-7f444da5f80f", "value": "393216:Sg9RYHEj6MZPHSBVMnXMCHWUjXTcuI3/PGTAI:Sg9ykj6eSBVMnXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785059552, "uuid": "ec6ba259-b562-4cb0-a9b2-c638d3042f76", "value": 14298775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785059552, "uuid": "baf6cae8-1323-4f63-afb0-42ceb24155a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059552, "uuid": "3e5102c3-b80f-41e8-bc3f-7c5312c44651", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aceb0ad-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104599, "uuid": "7e200e1d-bfce-49ac-9099-7ac5bed4cc6a", "comment": "Malware payload (RemusStealer)", "value": "14fce87cf261a710c1cebcc8a4f4e9da", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104599, "uuid": "629f16c7-b0ae-4384-9954-878225340f23", "comment": "Malware payload (RemusStealer)", "value": "5820e30bc1d4bf9db0b6eca0249754c99b514cfa52b78990487cbf98f7b55569", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104599, "uuid": "3852fbb2-2c35-46b3-801e-c76fbd736ead", "comment": "Malware payload (RemusStealer)", "value": "f5a24b79ce6654e125a712eb6084c5245e6dd8e9", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104599, "uuid": "fa0a5f63-9406-4ac2-9a8e-be8473761bf3", "comment": "Malware payload (RemusStealer)", "value": "af292983b4056ecbd2b9fc66823020a6ee32cebc84dc7b38c4a4d7ad3323e415d82ca8867af9607b2732485ec2c8dfb9", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104599, "uuid": "bb095306-da4a-442e-8a0c-d9dbb259ff70", "value": "T12CC55A03BDA109E6C0ADA33189B256527B71BC085B3633E72E90B7782F727D16D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104599, "uuid": "e28d38fc-cc93-4724-85ee-5d622b0e1513", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104599, "uuid": "25357072-6930-447b-9ff8-1e6824fb9ee5", "value": "24576:cXVInyeA2i7GUECfDejWiE86LG6rXeUbkraPzk7nG9OT+dGGbp0Q+PZoBele5I9s:cXVYC2SEeejWk/kbFEG9p0QeCcn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104599, "uuid": "5e9d0eb6-91fc-44d7-bde1-3008e666ef2e", "value": 2611552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104599, "uuid": "dccf4ba1-e7e4-4201-b156-5e6c9ec7132f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104599, "uuid": "63b23387-5232-4475-9e53-156dfa023f4f", "value": "R5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf0be94-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "c9dfcbf5-d111-4838-863f-d1b5344536fa", "comment": "Malware payload", "value": "16cc366bd4a05fc5db14fc58b2223790", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "bae83c20-c484-4381-8fef-e347a24b86f9", "comment": "Malware payload", "value": "582a21d22aac721909d503ebd50946119ddeaf61bb05975ec9662228dc696a66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "6b082285-abc7-41fd-859f-46d4b90d5b54", "comment": "Malware payload", "value": "c41a19dbb3d9e72acd244c5ba111f2dd26224aaa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "9f19c42e-56b2-4801-8589-fa3016487be3", "comment": "Malware payload", "value": "86a755ab0e3e996594cf115ad0191e52614296392d1ef2219ad9713c8aba0d8a939e3fe8790d72d9123a11620c31c53c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067934, "uuid": "0165895c-8ae3-41a8-9ee8-046b351be57b", "value": "T1C141622AC392DA30A9425CE7F0C6C511695397987B632E24FE46E772746C8493072F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067934, "uuid": "221b9c19-1f6b-44df-b4c7-32beebbb52c4", "value": "48:QvQhnojhnojhnojhno0jDGEeECEhEoEgoE/An8Si/5SQsgY:AQhnAhnAhnAhn/jqEeECEhEoErEsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067934, "uuid": "8007e686-eab0-47fb-b488-954155d31265", "value": 2062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067934, "uuid": "5b3ea904-3bb4-4ce7-aa9f-469223ddb2a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067934, "uuid": "0d5fc05e-6afa-47c3-9898-401cfd0f3d3c", "value": "mload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d2a632-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051145, "uuid": "db62b867-282f-43de-8162-2a2e9c9dd427", "comment": "Malware payload (JackSkid)", "value": "24fe05cb6d2eed8f86d3bf20cf15d5f2", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051145, "uuid": "86386191-6669-40f5-9a24-f5922be31460", "comment": "Malware payload (JackSkid)", "value": "589fd8f0b10698888cbd9ea7128c1dfb7a35b02a5493ad5a00a514f6c15016d0", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051145, "uuid": "6fc17e31-d551-48d1-a0ff-92d02f5ef885", "comment": "Malware payload (JackSkid)", "value": "e892f6f466c2d0f34406ebcb6b14c75a761c5f79", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051145, "uuid": "5070ae47-1699-4c76-97df-74d9a283b2f4", "comment": "Malware payload (JackSkid)", "value": "3fccd205cdfa9f84f2ba8c51fe9259ec2f6a926263f86c00b117e3ca1a1df2dc0af4017e04b0d6be72efa9669f75afeb", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051145, "uuid": "fad4416f-614a-4d71-a471-66fe532de582", "value": "T173A42A56FC409B95DAD12ABEFF1E824973131B78F2EE72119D155B3063CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051145, "uuid": "d743abf1-4317-4527-a792-68cfaad7e37f", "value": "12288:+8BOSv1xzmVL73M9CpGrbVL0JkGvlR4RmgL5nya4znb0IlvcBx:PBNsgH8GqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051145, "uuid": "d1c0463c-5544-4f22-a240-a19fe2808d09", "value": 485060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051145, "uuid": "bacb54c8-bf60-4889-b6d8-ee61eac130d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051145, "uuid": "305c0751-db1d-4cac-9bad-5a3c739a7dec", "value": "inix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1544dc7-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785044588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044588, "uuid": "1afa98ca-5c84-402a-9396-56790b1868b1", "comment": "Malware payload (RustyStealer)", "value": "481f31096a01009414ef1a08309ab514", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044588, "uuid": "7353a30d-5291-44a0-93d8-0e4d2d49a004", "comment": "Malware payload (RustyStealer)", "value": "59a80a105dc161e0bf9566d260965111948c3eace7ed6cc073e40a8628e9cbb8", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044588, "uuid": "221b6410-f062-4f35-85c0-d4cf64c48554", "comment": "Malware payload (RustyStealer)", "value": "a7e8bf3ded34d7afcce7e74bfa0d9b83f8ac2722", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044588, "uuid": "df7408a6-656b-404b-8adb-d455bf82d924", "comment": "Malware payload (RustyStealer)", "value": "046c590f48e35bbd6e9fb5da6969f865f07fc168d2d48c7f49043e79b93f0b69289091be2e8798c4d8dfdc981fdeca4c", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044588, "uuid": "ee0c9b97-6018-44da-b48a-85a9c83ccc87", "value": "T15477E05C020CD384799F053AF3D8F83FE3DC66683776E869BC75D1AAA812294C279593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044588, "uuid": "579a3e73-996f-4289-96cc-1a4cf62d27fb", "value": "0bc1b1e557f4a4387777840b7c7925ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044588, "uuid": "f571a796-66d8-49eb-b636-4da0303a5040", "value": "393216:DKD/k51CvTa6pSiEcNJECDECs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBR:DKD/k5ILaiICahDLBtVbD1DT9SfhMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044588, "uuid": "9d5f5515-4b1c-4258-83da-a4a08615ecc3", "value": 33679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044588, "uuid": "75faf0e5-74f2-4a22-b97c-71568fe0d5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044588, "uuid": "7edfc478-bd9a-45ee-80a7-667ef5c124cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4339b67d-8924-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785092426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092426, "uuid": "768fd9f5-520f-4da1-b47d-71be5b0bb7bc", "comment": "Malware payload", "value": "e91defa2add4b9bec7259f7b75049843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092426, "uuid": "e9d58b15-db12-4091-92a6-932b8b7f959e", "comment": "Malware payload", "value": "59a9721c8214ef997096498c44dcf5f122e1c604b6f248456e8dc430e7512fdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092426, "uuid": "71a5067c-6737-474c-ba73-b0ee8421bd68", "comment": "Malware payload", "value": "f8488b88ecbe9d0dbe6263dda369a9325c194467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092426, "uuid": "6d80f617-83b9-49da-9ec7-62831536a361", "comment": "Malware payload", "value": "aa8e82e9c2ed1a7b03df84be3cd118c1426aff823d58abeb32d065505803abb51c3e969b3e422c537af224cf05d3f4a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785092426, "uuid": "e0a166de-ecf5-435d-b1be-8e7bc91aa1be", "value": "T1E7D68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785092426, "uuid": "0584be50-8c69-47fe-ac5e-e1bc6a7ea2ab", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQQ:cqYUQuVDt0TZE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785092426, "uuid": "0e22c81f-d2bc-4191-b97d-8f7daaa384a0", "value": 12877824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785092426, "uuid": "a753ff62-7c38-40b9-a332-f52c85c8b246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785092426, "uuid": "31fb74dc-ef62-4e80-8be4-d03898ed5e2f", "value": "59a9721c8214ef997096498c44dcf5f122e1c604b6f248456e8dc430e7512fdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7931897e-88f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785071042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071042, "uuid": "9931c2c1-6ead-49d2-ae05-d6b6becef051", "comment": "Malware payload", "value": "06b7c16c464e04a8f10b3c05887eaa89", "object_relation": "md5", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071042, "uuid": "a4704782-e7b5-4092-82ee-92b0e8f0cbd8", "comment": "Malware payload", "value": "5a275e84e34f8b8072917c954ddd0f5ac75f583b92745a8ebd87d73b505bfa19", "object_relation": "sha256", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071042, "uuid": "a2bb3b98-301c-4c6e-b40b-b76056d08c8b", "comment": "Malware payload", "value": "ed912e6c7a5434ddc5183beb4b346adff2f29a52", "object_relation": "sha1", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071042, "uuid": "8871bdc2-6cdc-4ae8-a563-03c9b6ad22b7", "comment": "Malware payload", "value": "00d0f3dcc60bd13dc48590a66b90336e08f143bdba4dc25b6cf048269a8a4ea9d91f811c05d73a2b2a1f29c99eef2e5a", "object_relation": "sha3-384", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071042, "uuid": "e61c259e-e3ce-4eae-b07b-5a5953423101", "value": "T12E01DD53B124E36849624A6ACC556B617E1D719743135E8332BB0520B4017E2FB4D7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071042, "uuid": "1d60fbe8-a39d-4bf5-8371-13a6f9be02dc", "value": "12:hKJ1QvBFNv+xHFDqofwq6s81kbQpcGWErBX7lJFkoJG81kbQpcYaPlFNtz:hO1QvDgFuo+kblEtLmtbZvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785071042, "uuid": "2f959973-6dac-4038-9347-76be0d8f2104", "value": 846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785071042, "uuid": "406de526-89b6-412a-bf0e-eaeeb649f9ee", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071042, "uuid": "bfae683b-4414-43f5-b039-943e7c12d997", "value": "Windows_Update_Assistant.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d101b3d1-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088369, "uuid": "94e78a3e-167e-489d-ba17-75495b55c027", "comment": "Malware payload (Mirai)", "value": "d8fc8e82501ca9e2168897b23923acb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088369, "uuid": "820da094-184e-4afb-a9dd-4f112a7bf4a3", "comment": "Malware payload (Mirai)", "value": "5a395c826117e12109b896d177ec44700cabb07a1ce61414c8358df7bbfc2b91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088369, "uuid": "9abffcdc-d2c1-4092-b2ee-82c5ea8d3a18", "comment": "Malware payload (Mirai)", "value": "655050330b8c21b5b05e12aac6629c3f2cd6a2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088369, "uuid": "79179c52-e8f6-4eae-9af1-68538fd56bf9", "comment": "Malware payload (Mirai)", "value": "8466cea629df36d96240b46202c67aad58ccec5827a813e90110f6f9947d07013045e474035441f5af63f0b3dafc3859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088369, "uuid": "70f87407-c0ac-4dfe-97ab-658fcfe7632a", "value": "T16873020E83EBB49540F20E3EE07C4E46EFD11EF8696EB1BA911D0171661E0691FC1D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088369, "uuid": "6c8cc635-bd6b-4918-9bf5-77cc67b927a9", "value": "1536:r3S8XW9Vkqoh8C48Cr3xbLnXzsQ0cjGpyiA/WOL2l7kEi7fXpIW:e8XWVkV8BXXHGIiTOL2o1DXOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088369, "uuid": "f8c584ec-c1e2-4aeb-a2d3-903c8a5adc3f", "value": 75544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088369, "uuid": "9155b2d2-4f2e-4f44-82b7-55f51db68a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088369, "uuid": "fe83bc05-c138-4900-8cc6-65fc6e45d874", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb036cb9-8933-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785099150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785099150, "uuid": "4f250bc0-53db-445b-be16-ffba0289ae35", "comment": "Malware payload", "value": "f3b3d37c7861b4d63bc2b1b966efdedb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785099150, "uuid": "a0578bf9-d647-44bc-8b6d-72da90ccc00b", "comment": "Malware payload", "value": "5a6f57b0f7404d70c29e5c39b3bdd95064df4c4885f0fbbdcee41e438ff8444c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785099150, "uuid": "94c500df-a3c4-4318-b045-a20976039dab", "comment": "Malware payload", "value": "b6d1264bc8df859f931f78369c3552bcb6dbc256", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785099150, "uuid": "fe2b6d27-f874-469b-9598-8a3d20a261b9", "comment": "Malware payload", "value": "037da70f5d151106749d77208bcc448ba90524b9cccd480573a8e09354d3c93105be7e6dc37685e872a929aefad7f0fa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785099150, "uuid": "b222052c-a989-435f-8756-f7713bb18bd3", "value": "T14DE633489FE001FEEAF3907DEEE19194D52474261776D2DF876967A83E432E08D3434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785099150, "uuid": "0236dbfe-6c4e-432b-aa1a-e6aec0d37c7c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785099150, "uuid": "22325fb7-1623-445c-ad96-b67acdf85422", "value": "393216:fFhNn1DV2Gn5chuOQQtqkT24wXMCHWUjXgcuI3/PGTAI:frN1V5eunkYXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785099150, "uuid": "fbbb7587-a5da-43df-acac-fc1dc60fa352", "value": 14319096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785099150, "uuid": "952e0b0e-4129-4fbd-8f5f-c87205c4dee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785099150, "uuid": "d763a9c5-11db-43cb-89f3-bb5deb9e3b32", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff2be21-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044397, "uuid": "2b80066d-84dd-4378-b315-f97a1a1b5804", "comment": "Malware payload (WannaCry)", "value": "8ebe0cda768b18141bf5c50f1b54b0d0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044397, "uuid": "7f967a15-094d-4e10-b91a-7b098bb770ff", "comment": "Malware payload (WannaCry)", "value": "5a9014db3c28643efe8a6e0bff4a4b4d785771d2239e4d0d6798028685887473", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044397, "uuid": "e458839c-c259-4f20-a59e-87db02a461dd", "comment": "Malware payload (WannaCry)", "value": "413947555c7767d5626de6e95dab518c5017f22e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044397, "uuid": "35271f9c-3cbe-4067-a710-e0c882acd144", "comment": "Malware payload (WannaCry)", "value": "348a8f28b3348f83f8e20e71e8441e0342670b0a8637c6ed7251405330f34c556e39df2683a0224dc4d3f1d6ad36bfa0", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044397, "uuid": "fcede9f8-6309-4b4a-939c-eeafe753d5b4", "value": "T1B295235932BC91FCD106267444F78E22E7B37C9A23FD9A0F4B8446AA0E13759BB64743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044397, "uuid": "46d2137d-7906-4bdc-b2b0-0d08ce9d9487", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044397, "uuid": "bd5379f9-c07a-4dbf-89c2-38a3db137adc", "value": "49152:jnpnQQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAQ:D9zqPoBhz1aRxcSUDk36SAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044397, "uuid": "605633a1-9503-4b14-99a3-9cbd3b989d55", "value": 1992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044397, "uuid": "aad1d1f1-f67c-42ee-bcf4-ec2b0377e6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044397, "uuid": "5ebd1f47-7d46-436e-96ba-fb491dd3998a", "value": "5a9014db3c28643efe8a6e0bff4a4b4d785771d2239e4d0d6798028685887473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d087f03-88fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Sliver)", "timestamp": 1785074350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074350, "uuid": "3b07b5f4-a718-43a2-82c5-ce97fde2f91d", "comment": "Malware payload (Sliver)", "value": "c83cf2440ee2f6eaac551ce7cd8dcb3b", "object_relation": "md5", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074350, "uuid": "c3a056ec-0c19-44bd-9b5f-38d5e96e0a7d", "comment": "Malware payload (Sliver)", "value": "5ac837e54412e89c6389b4d63f5b674dd81dc9169c749570679a4fa3aafd8213", "object_relation": "sha256", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074350, "uuid": "d466b7d0-c27b-4139-8662-d3f6060b0374", "comment": "Malware payload (Sliver)", "value": "a29b05ea16d483d08a9d4bfe1195bf0eb90c4188", "object_relation": "sha1", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074350, "uuid": "22384cb0-8d25-4e2a-9f89-fd916c4f188f", "comment": "Malware payload (Sliver)", "value": "2a703dec077071c236eca254371dccb52426cfa1f15f2566d7b8d2572611d7fc352e4304895cf8356fca239ae0646d28", "object_relation": "sha3-384", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074350, "uuid": "e3254369-76b5-4f17-b2a4-3d163a76d10a", "value": "T153943A72E6A24CADD557A27482C7C6B27639FCA04332D70B165053306F4BED06FEA399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074350, "uuid": "81f055fe-7854-4516-96b7-a127e1963cfa", "value": "c49562e9ac025c135ef9e3435b10294c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074350, "uuid": "4e367851-b777-4218-b978-a04ad71fe3ab", "value": "6144:WYbVPARd5Gp1bAxoLpqXkEMJUcDE7dkJJJ655ZZoMynlnaycEPbj3azh:WYZPAbgpexoLU0EMXDE7IaycEPbj3azh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785074350, "uuid": "768f6295-1a8d-4a14-b652-8a23114f7d98", "value": 415053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785074350, "uuid": "0abcaa20-788e-4faf-9a5e-be7e82d1fa0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074350, "uuid": "2b528448-ae5d-4400-95d7-a51eefbc3a5f", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95053f3-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "1ad12b25-2f23-44ea-a830-4956a800c6f5", "comment": "Malware payload (Mirai)", "value": "57a71122848bd5cc30f82c9743afd4d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "78a554eb-624a-4421-9822-2d7e4af34a69", "comment": "Malware payload (Mirai)", "value": "5af4d795b51588a8d34b52fe7ec4f500bcc7ed8bbbb743017ca10850574ea259", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "d2325352-f054-4d68-a1eb-7874bd05bb5e", "comment": "Malware payload (Mirai)", "value": "a88d0d0dfad219499469370f2580cba65ac96bc0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "b97e69d5-ff0f-4687-bdf8-bdd776d15830", "comment": "Malware payload (Mirai)", "value": "f3130b0bf068c8c0f63b1a19a7e610e5d21c9189d072fe9b12a790fa467871335112c849a66f3a5818ad0a000e5f76a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "c44c8731-a808-48b2-90d9-24f2820bb448", "value": "T1325302B0CAFD74635C751AB3CE56894135AA1370F2E4716B14E831317EE3C4249DA9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "92945f91-8568-4b3f-b7da-ff6a7b98526f", "value": "1536:rTAAujqF933XVTI2CJ/ciIv2R69RXd26tbaDLf:K6QIY2RXdJbaDLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066854, "uuid": "f2d7f86a-1714-4ff1-9300-3c8c7b003528", "value": 62608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066854, "uuid": "17a5b6e4-3d59-41da-9d68-6b4a8ede26bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "e0a6c2ee-980a-4907-938a-6b4772a192b9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c061e0-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104562, "uuid": "1930cdfb-cbf9-444a-a67b-ef593693d702", "comment": "Malware payload (RemusStealer)", "value": "a6054e9828a4aa09e7469c589afc6fce", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104562, "uuid": "fa2227b2-8736-4f7c-a263-95aa798afa71", "comment": "Malware payload (RemusStealer)", "value": "5cab5c362ded4c7795a68b94af56ff9922e15b4d343c7796bdc1c8338ac34887", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104562, "uuid": "7193da48-1492-4db9-8b56-b3bc18238337", "comment": "Malware payload (RemusStealer)", "value": "4339591ef72328dbbbaacb8119ece8d18a708cb0", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104562, "uuid": "d1e5cde5-dd7f-45fb-ad80-b47a13b8df8d", "comment": "Malware payload (RemusStealer)", "value": "4ce5ee561a0dc28aa89275de68f76fa71028eb251cc27a3435d86748e4c9885096ad4af425d73852607d65ed05b52bf7", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104562, "uuid": "d1cbef48-94d7-4345-bd07-f33c0c4dc583", "value": "T199C55A03BDA108E6C0AAA33289B356527B71BC085B3633D72E90B7782F727D16D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104562, "uuid": "435970bf-26fc-427d-88f8-c1ca78047c40", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104562, "uuid": "12799411-efa2-41a7-bdab-0b2247e4b288", "value": "24576:BjCpLi4UiTSqhO3LgmpHSpGlKSqPl/NCOLOMO1OpDvFeLTFYXDPPZoBele5I9DUY:BjCNkiRh+LgiSgI9XpDvILBYTCAG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104562, "uuid": "40cc1a74-5e46-4c03-8d8d-6dea083554f0", "value": 2608984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104562, "uuid": "40bf63ce-909c-47fa-872b-2cf1865a2dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104562, "uuid": "e783109a-0d4c-4b30-b6d1-81a583371606", "value": "R2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82187c0e-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785051300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051300, "uuid": "28f3461c-822c-4478-84c3-5d86a2c82f24", "comment": "Malware payload", "value": "ae40fc1b9a72781856c386117249ba0b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051300, "uuid": "ae1831b7-0e7a-4226-a809-f594b5e5b596", "comment": "Malware payload", "value": "5d6ba67b753dc2c21e1ed806be96477d11d0b6ccde9e75c011acd2c33d285216", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051300, "uuid": "882c8b30-5ebe-4816-a0eb-ed01b038c765", "comment": "Malware payload", "value": "4f4be3755ba61516e0efa84a263493e66ba94987", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051300, "uuid": "692c567e-5ef1-4211-83c4-e5d456b0b58f", "comment": "Malware payload", "value": "9e17872fa1d46316f8dff38f59b343cd5ae3a922e359e3c1d024182fdcd9adff97b35ad3905cea9cb2fb09f563aabc49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051300, "uuid": "1211fd3c-3b0e-4899-bae4-9299e37f106e", "value": "T112237D652A857C14AA98C4371D7E2F0CB9AD43E6320452EDBFCF3CF68C4A69D920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051300, "uuid": "9ef22561-7383-4b37-81bc-42b45fd8e841", "value": "768:R0XOGVvl9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:QLucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051300, "uuid": "35a77ea4-6ab7-442c-aaad-d6ec6916c956", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051300, "uuid": "72c6e6bf-6cfc-4c08-b17b-ef1f7aac57f7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051300, "uuid": "e5ceda5e-019a-4e99-af4d-614d14215bd2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b7a0e6-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "74295191-a3ca-4e12-8248-5931543d5bee", "comment": "Malware payload (Mirai)", "value": "de5383d1953e8896928300e3d1b8d699", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "a623e28b-d1f4-4e1a-a123-12864bfd6d51", "comment": "Malware payload (Mirai)", "value": "5e9804d8c0b806ea60d009715d1bf54a97fc0878a537bacdb5ab19b3f8cec39d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "bc6667c1-1534-4031-88e5-a23baeb2db77", "comment": "Malware payload (Mirai)", "value": "9ac2246b94edadca35c06e894a45e2e7663b584d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "d2e38976-b991-42d6-9272-14af98b81ce1", "comment": "Malware payload (Mirai)", "value": "917a4d9df379d92e85b31e4548273559f25044a120529b6f00d8e1218da9c04031c8f58620f08b897d5d5fa169342264", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081163, "uuid": "e1860422-535d-40cc-8378-5600d3bcb1cf", "value": "T17CA3120B4443F2E5EF2B52B3A548DACDE7D35E6617AE8A796379423457D2803F28B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081163, "uuid": "676823e5-479d-4741-8dbc-3e0dec78841c", "value": "1536:DFiWlhG8Qe/JmqjZRCG43RAfM8mvnhl5G81nvGx0DxIObARBZMm7Kntf:DDOBe/LKA1w/PBrDBbkxGnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081163, "uuid": "093abda4-b05c-4a0d-9ff3-e27536e928d6", "value": 97980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081163, "uuid": "bebe220f-2b8a-4400-94a3-e682aab98585", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081163, "uuid": "6a93ab5a-4f5d-4764-98cf-382ddc6be371", "value": "flutter.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790367ee-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044413, "uuid": "790180b4-42b8-498a-acca-495b960a848e", "comment": "Malware payload (WannaCry)", "value": "e541636db753771f0635da1630ee2494", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044413, "uuid": "ba7aa554-7293-437f-a053-186d7954ed68", "comment": "Malware payload (WannaCry)", "value": "5eb0707fd0426f46ceb7a1361d19616a3d43d3fac9381d22010801111e5c734e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044413, "uuid": "15180921-34a2-4c91-a8ff-ce0bce3f7e54", "comment": "Malware payload (WannaCry)", "value": "1dc23c7dfead93a346271f1b66e0a70cc8a6287d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044413, "uuid": "975352e5-2585-43ff-83ca-3a848701f8a8", "comment": "Malware payload (WannaCry)", "value": "eee1b10d05bfbbbf9046218bf8dff34a7e5a15401d8c1ec623dba3f8a843053aba17f3a3fa28a84264c5f8e203ac76bc", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044413, "uuid": "110ae203-72ea-4169-a430-826ab09e2fb9", "value": "T12F363368326CC5BCD10619B444B3CE27E7B37C5627BE570F8B504A6B1E13B5AAFA4702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044413, "uuid": "be740131-8a06-4944-9579-c8e16e3ff90b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044413, "uuid": "f0968d4f-3eb3-4206-a438-b97ded268eab", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044413, "uuid": "4ccd4b63-9760-4266-a998-81ccfa98e7d1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044413, "uuid": "8352715c-8f2f-4749-a56e-66231d2c467b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044413, "uuid": "f93460a4-6d1a-4231-8ec4-f80cf81bb035", "value": "5eb0707fd0426f46ceb7a1361d19616a3d43d3fac9381d22010801111e5c734e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f3b225-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "8c4e12d2-b7b2-4780-bb95-5be3c4ab3871", "comment": "Malware payload (Mirai)", "value": "7ecb2be47b3fb0207d131b0d2e676ab3", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "316c0b2b-2f36-4290-bd6a-272f46dd118d", "comment": "Malware payload (Mirai)", "value": "5ebc16022d4f31b00482e46336831683af9ecee3efbcaf69f18fad92f5d992f9", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "7190ae25-09a6-4e86-94d3-863be2f93eb9", "comment": "Malware payload (Mirai)", "value": "b977c03dfeb8735001f86d83c0953b7dac93870d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081163, "uuid": "369d6cf1-3266-410e-9433-28529bf672e0", "comment": "Malware payload (Mirai)", "value": "aed1b1ea2fdaf69bd0ff0564c55453e565e58dc4882810058879da43e7bcd30e4bc61b4e1db7c82d24d5a5cf9904b9fa", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081163, "uuid": "75ece6a7-d29b-4118-879f-6265f784979e", "value": "T117A312D2DB408E5BF640EBFDE75A869747A08E392087FF9943806E19499027BD0F1F60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081163, "uuid": "7d7824d0-9190-49a2-acc6-d4f6ad5c0d47", "value": "3072:6/nw4dlsiKn2bEK+CNHlDbFV1G+tbRLJp:MwS4n2bvvvDtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081163, "uuid": "2b88a2f2-7a33-4f52-b5f9-c196a4f01698", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081163, "uuid": "050f2312-ebfc-43c6-8576-949e3000833e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081163, "uuid": "55773b6c-df3a-498f-8e45-3a755d0fa362", "value": "flutter.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb6184b-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785106266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106266, "uuid": "ab5880f6-de95-473c-b86a-fff3becc426a", "comment": "Malware payload (Mirai)", "value": "03da3c371915a830ffb4b13f6934eff6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106266, "uuid": "9840a7a4-eef9-493f-afeb-cf2231a7c741", "comment": "Malware payload (Mirai)", "value": "602afb3c05b22b36d643010ec3e804728971d327537310301ce3890ae97a6aed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106266, "uuid": "8e8b9014-8981-46e6-92dc-55954b1443eb", "comment": "Malware payload (Mirai)", "value": "683d206615bc50df8923310ecd500d15ce002ec5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106266, "uuid": "cc6fa6f2-40d2-471f-ae70-5b13a86309c1", "comment": "Malware payload (Mirai)", "value": "fa7a82cfaf0c51ea6adb0c8b6a9c99444540a5f1c33f1efe44652ad9406c6357f6a3cd288d20ee505f34e83057c69fd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106266, "uuid": "aa116b0c-c53a-4371-8dff-9e8ac21ba2b4", "value": "T12213F1C848A66AE6832049B6EE90D3C683ADCA7CD5F658230E055F94E5E7C073BF91D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106266, "uuid": "b7f2888c-9faf-4709-9ef5-4325dea4c183", "value": "768:zrzD+GX7QWruIIOkByjnKkYEyEol8HKmJ77ZB7pCLabcQ+mys1DXIVIF9q3UEL8i:zvDZJuInJY8qmtD7pCLaj+myEDIOYLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106266, "uuid": "ac95e72e-fabe-4fcb-aec2-429b4d657185", "value": 44788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106266, "uuid": "97e55d00-827b-4c7c-9c01-2ad2d70ab5e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106266, "uuid": "e778e534-5901-4dff-90f6-885fee8656de", "value": "SecuriteInfo.com.Linux.Mirai.9816.16164.28322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be0b62f-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785067583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067583, "uuid": "842b85ae-0073-4e06-bc2f-05f49864f0d5", "comment": "Malware payload (ConnectWise)", "value": "20768341ce4da1908a03372e77b01e41", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067583, "uuid": "224b3312-3ce6-4f00-aa46-b52c7dc805c8", "comment": "Malware payload (ConnectWise)", "value": "60f460751db886977f80fc65f858e48e78b6739b070a4ee57a35c3d9ac8b9e6c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067583, "uuid": "7b9b1a7a-e3fd-45e1-b63c-c4f4382a010b", "comment": "Malware payload (ConnectWise)", "value": "db39680858c673f1aba487255eaa6872983cddf5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067583, "uuid": "5a32c0db-d5ca-4709-81d6-9639bc65ee72", "comment": "Malware payload (ConnectWise)", "value": "c66dfab7134489f34aaecb0fc7044928699fb939e067fa3ab3e8585bdb3e9deb7f8a088f264126c18be477ac0a38aad4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067583, "uuid": "2597149f-7fad-49f1-b543-c5c5e9943cdd", "value": "T128647C11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067583, "uuid": "5a0ee01f-91c4-411d-876f-61207f03faea", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067583, "uuid": "4ffa69d8-a3ad-460d-8db4-e03da35563a3", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:B1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067583, "uuid": "726ea645-18df-4e42-947f-2d92b34c4c88", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067583, "uuid": "ae3b33f4-0c52-4352-acaa-6da8ac983e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067583, "uuid": "bbb6638c-1aae-44d6-bc92-2c740b845481", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78b3727-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066851, "uuid": "927c6e06-fe2b-4a87-88f3-748ca6b89305", "comment": "Malware payload (Mirai)", "value": "55ddb16a0bf738410c77371342e9f213", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066851, "uuid": "2fe6efea-392b-4eaf-b73a-4cf8be4cf399", "comment": "Malware payload (Mirai)", "value": "61138d1745b75deaea946d448c54afdb748fb7d23b461f6cf1b18764fc18b579", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066851, "uuid": "5885b835-eff0-4590-9210-57a6c644908b", "comment": "Malware payload (Mirai)", "value": "3debc2361f0204d0c9d15d6bb745510813eb71c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066851, "uuid": "9aadcbd0-eb8b-4df6-8c5c-99e4e153c2cf", "comment": "Malware payload (Mirai)", "value": "65e50261a25740c9ec70de29fd724d77c1d4cc918ad8bbd2db56be4f2bc24ff2c529876d67bd6f3ca3ec733dbb426b34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066851, "uuid": "fc33063c-7ce8-4e72-9afc-34b4a463d02a", "value": "T1E3044BC7FC00D9BEF80BF77B04170915B630B7A210925B336257796BEC3A1991967E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066851, "uuid": "b3db864b-ffb8-4d88-b510-ffbc29202802", "value": "3072:3eLoU2OjM2SMb7ylEy6f8BD16SVvqrIFbTxVojbiaLrF+z44uh/Fgqeo:OLoW3beey6EBD16+vqubTULrotqeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066851, "uuid": "7c3bd362-36a2-403b-9851-7500f3b5a064", "value": 186872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066851, "uuid": "f8a47741-4686-467d-8732-41cbbdf43d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066851, "uuid": "750c3cba-77d8-4be4-9137-601c490e7730", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1aae7d6-88da-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785060802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060802, "uuid": "41f93ed5-b995-4994-bcf1-f80e36eb9426", "comment": "Malware payload (SilentNet)", "value": "6d85b50520aa11a7e19948b37530181d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060802, "uuid": "dee47c39-a222-47a1-be43-ab473d560ea6", "comment": "Malware payload (SilentNet)", "value": "6176827bf222db7bad006ea435a9409706087913901290a2af0fe7ea396abca4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060802, "uuid": "ba4f4e36-9b44-4cb5-a767-574110eeddde", "comment": "Malware payload (SilentNet)", "value": "a11244ff9e6aa19da9b4aca7dd308fed0f1a880d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785060802, "uuid": "2750dfb2-0670-4659-8e6d-bb79e7d1368c", "comment": "Malware payload (SilentNet)", "value": "4d030e925ae84170492c517719066978e4e93306fc8a811f0d4e11e2f61436e1abccaaf6179854763e58b318b4a10c7e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060802, "uuid": "6710e91f-0326-4113-9903-1d040c1b08d6", "value": "T1BBF633037C21262B647A71377AB6F40B23BD32A2D4B392DF2376A23C1B73065166F565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060802, "uuid": "246d24e3-d623-4843-9d7e-f0096a36dedc", "value": "393216:LjguBq++7uaCfeKfvoUB9A/u581QzZaMAwB4SQg1IqfPZjrhHpFWryr:QW9GUBy/uLaMAwyS9BPdrhJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785060802, "uuid": "b11432cb-019f-48e5-a3fc-beb3892e6109", "value": 16624618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785060802, "uuid": "e212573d-0913-435e-b9b4-2766ab515b26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785060802, "uuid": "5739d497-7879-43ac-baba-32bbdd4d6165", "value": "Cheatclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88c0e3b-8884-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1785024011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024011, "uuid": "8330d1d6-a43c-48c6-a130-91b616f98cfe", "comment": "Malware payload (AnimateClipper)", "value": "16fa9ffcb7431cbcd23d636718770ee4", "object_relation": "md5", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024011, "uuid": "c520b05f-baf4-4d43-bd29-e100d9d5564d", "comment": "Malware payload (AnimateClipper)", "value": "62ac78326c0ebec72a44b0037290c5b221c75a6cf1a7281d2795691581f67058", "object_relation": "sha256", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024011, "uuid": "acdaab66-1a5c-4543-bbaa-36fefdd4e5b5", "comment": "Malware payload (AnimateClipper)", "value": "c822be1598310509a54fc03602eaddd1524f5133", "object_relation": "sha1", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024011, "uuid": "866b8cab-c292-4c42-82cb-463efd5a280c", "comment": "Malware payload (AnimateClipper)", "value": "3cda3add762e569ac604de41f3f55755936c46c23734824b8805f95120286c62a5a0f63344da45550c25ecff9233e163", "object_relation": "sha3-384", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024011, "uuid": "355e54cd-82d7-4bf3-a4d7-39675a3864a4", "value": "T174969D15A3E0F2FCD6268174CA964232F6B574CD0763AACB0255D2152F37ADC6E3AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024011, "uuid": "0fc0c3b6-fd94-4606-9634-a1e9ac2dca1e", "value": "71b008ad892c449add994b5e45fffabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024011, "uuid": "b5b58d46-cec0-4791-8230-9e2ef01cc52f", "value": "24576:EY6TYOe2pP1y2DjTHcmQhPT+mP82giM7Ruof/CbcyIQ:EY6TYOEmQB+mmFbCgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785024011, "uuid": "387a7372-4111-4ecd-a2a8-94cf7d88aa95", "value": 9440256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785024011, "uuid": "cd198de8-a939-4e62-b3c3-5680fef853e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024011, "uuid": "10e7e482-67b0-4988-b542-8fdabaa9b7a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9be64d-8888-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785025571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025571, "uuid": "0f953b59-0b82-4bbe-9265-a178038e9256", "comment": "Malware payload", "value": "b933c74c0a98bcdb4f78a38957c24b16", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025571, "uuid": "50d28554-a313-4359-962a-0b44961f00d4", "comment": "Malware payload", "value": "63559cb87098de64cbe5f1d981bf782283a8e24e3d81926a3ddb80cae5b5d856", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025571, "uuid": "76fc3555-548b-4ab6-9073-6370bf99b7e8", "comment": "Malware payload", "value": "2b359eb0ae2ade043e348233d4035da6784e230e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025571, "uuid": "1d8f11b9-f4eb-4688-949b-d142331643ab", "comment": "Malware payload", "value": "e1f22a09f6b699da10bc313040d59b702c6fc5319ce449a7e50489134dd0c00ea6c1d66ad1d6a915ed6eedbfb77a8604", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025571, "uuid": "ec865308-a92a-4b65-84f1-8618755def26", "value": "T1BFC27D966A967C44BDC94A3E4CBE2B1D6DF5C3D1224D42AC3D4B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025571, "uuid": "add20713-7387-4dcc-a753-f7b35dc076d4", "value": "768:C08vCB+25j6es8RI9FYpMSUpi+20qUpi+20YQX:C08l25Jed2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785025571, "uuid": "77cd3309-04dd-415f-b1b9-3de6b5e5a945", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785025571, "uuid": "d3cd702f-02de-4140-89b3-1798ecd5ada9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025571, "uuid": "ee0dbb2f-c3c3-40e1-aba9-d63f7cd917eb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29136be-88a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1785037288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037288, "uuid": "336f3847-178c-4ba7-97be-d593511d121d", "comment": "Malware payload (AnimateClipper)", "value": "450e0227f0118633049d3c4f1e79fafc", "object_relation": "md5", "Tag": [ { "name": "3fc2270f9ceb525e5c2d1d101bccd90f", "colour": "#3313FB", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037288, "uuid": "5a2230f1-5581-4317-8caa-4e755254f69e", "comment": "Malware payload (AnimateClipper)", "value": "63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645", "object_relation": "sha256", "Tag": [ { "name": "3fc2270f9ceb525e5c2d1d101bccd90f", "colour": "#3313FB", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037288, "uuid": "4f407d14-477c-4dd4-8430-66460d8087f9", "comment": "Malware payload (AnimateClipper)", "value": "53de9d6e3d7816d949aa1adcb479f73367da8cc2", "object_relation": "sha1", "Tag": [ { "name": "3fc2270f9ceb525e5c2d1d101bccd90f", "colour": "#3313FB", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037288, "uuid": "41990753-2e83-4ceb-a61c-ee1717fe31fb", "comment": "Malware payload (AnimateClipper)", "value": "e0a0c1431dde40a1ff41a54b95ae2137a4bff4d57179a224e75eda5b7a4c814f43ec78509d5885b60efd911761981778", "object_relation": "sha3-384", "Tag": [ { "name": "3fc2270f9ceb525e5c2d1d101bccd90f", "colour": "#3313FB", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037288, "uuid": "b3f33289-5b1c-455b-affa-2a72df26cbdf", "value": "T16AB67B15A3A15EE8D226817CCA964232F6B57741C760AACB0274D2193E37BF46E3FF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037288, "uuid": "a98947a9-174f-4fc5-8797-ee65790c76c1", "value": "71b008ad892c449add994b5e45fffabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037288, "uuid": "76d4ceb4-024a-4bc3-9853-9c686430fa84", "value": "24576:iY6TYOe2pP1y2DjTHcmQhPT+mP82giMTRuccsUCsRq:iY6TYOEmQB+mmB9UCaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785037288, "uuid": "23bf73bd-f713-474d-b5cc-e6bb8eda351e", "value": 10488832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785037288, "uuid": "2b658520-2a3a-4a96-b6fa-96dfe87400d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037288, "uuid": "f442cc9b-1ae0-4ef3-9b82-b8552389ee53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1082ab22-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "95c8b588-faeb-48ee-bdeb-37576f7c0c74", "comment": "Malware payload (Mirai)", "value": "e9aec23d46535847ddeb3e563e9e1ae2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "02335e6c-ae84-442f-a3d2-4926e41586f8", "comment": "Malware payload (Mirai)", "value": "640369a15c165333c66de0521cdb4e4bb2c9a246c0efec0b406c3f48505e0f36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "cd23ee5a-2724-4461-8180-8de7279d17fe", "comment": "Malware payload (Mirai)", "value": "33774dba56befe24877bbc4e124634a81a81e36f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "571de6b4-b7b7-44fd-92b9-f9efd30176dd", "comment": "Malware payload (Mirai)", "value": "1088a5cd3f33233e56217362c7c2caa59ac14800f12860a9aada68a975c9e4f5b97fdbf9679aed874b571a051dde235f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066142, "uuid": "e45bfb06-7cb9-4dd6-89ab-86d6e89fa614", "value": "T174931882BC81EA16C7D0137BFA6F108D3315A7D8E1DA3242DD251FA47BCA81F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066142, "uuid": "e319b733-377b-4448-abaa-120f9606b1ea", "value": "1536:1++xx3dnbK2Uk/sZ6WkYAU2wrWmHzsMgSrZKj/DUr9B8t46ThdVfJfuv0:1+snbKxHA8tY/DQ/84whrJfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066142, "uuid": "f7499da5-6784-468e-9a43-e1b52bfa8241", "value": 91132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066142, "uuid": "7b612202-ccce-4edd-8432-2c118f417d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066142, "uuid": "df1ee1de-a4c7-49b9-bb3a-2111551f0c5d", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc067c3b-8909-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785081140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081140, "uuid": "01278bd4-c3d0-4a4c-9aa7-8665fe631587", "comment": "Malware payload (ValleyRAT)", "value": "9eed0e0d0f7f10bf58c1a839c932f4e5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081140, "uuid": "552f9136-adf1-42fc-8bef-e7940c93631c", "comment": "Malware payload (ValleyRAT)", "value": "6426ba538bb8c92ebfa45b2f57a205b91d15c46111fc1974223b37cc950447de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081140, "uuid": "a2fe76fc-ff73-406e-ac18-d42dfc17f23a", "comment": "Malware payload (ValleyRAT)", "value": "65039240d0bd54db6a698c45bcf78c0fea35bbfe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081140, "uuid": "9635a567-af46-42e6-b5de-69cdae31a95c", "comment": "Malware payload (ValleyRAT)", "value": "31e557929d6e7c0bf200bdcd454937aba6eda6f62b2caee79077b0feba062f7ce7b903ab2609ee43a566b50c9d999907", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081140, "uuid": "0f77c6d3-156c-4ef2-a560-182019d28ece", "value": "T1857633993D8767B1D09BC3718602B1AE31657FDB4B658D0BEFED782C2E3122560B6780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081140, "uuid": "f73f3220-2a3e-4cef-801f-28933680d1cb", "value": "196608:lAGmK1rmf/LuAoSIUn7DiACuRBgf0wYWUL:lAum76Ahef0pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081140, "uuid": "6a2410fa-d298-4df5-9665-68b7fc986284", "value": 7208960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081140, "uuid": "67119470-162c-486c-9ef8-9b91cd8d6931", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081140, "uuid": "c7007d7a-9fbf-4a32-8fa4-62bfbd5569b4", "value": "intll.1.zzs004.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53d294e-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785088349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088349, "uuid": "b75b44e8-ce30-4644-b20a-95722d7ec005", "comment": "Malware payload", "value": "65476e966e189531f646f56d2a9f74b2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088349, "uuid": "157165df-45fd-47a6-815d-92f99ee99e25", "comment": "Malware payload", "value": "64a385b2bfaef289318908ebf361dfeaac374897753abc7994c4e048120e688f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088349, "uuid": "37d41a5c-7ddf-4f82-b158-b2265e0f38f1", "comment": "Malware payload", "value": "4dcc43df029bca0226f19eeae8cf9ec898cd020c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088349, "uuid": "0c33c722-51d4-44a1-b1db-bf090cf488da", "comment": "Malware payload", "value": "b94de0b2f6fbd62b6ad570c93c28b95b9586480b2764a7496fd9d69c07e541ecae792aa4b5e4e2730dadd79894392fd4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088349, "uuid": "caa21459-a53c-4635-b82a-cdd8b8ecb438", "value": "T1D3E6331C66E002FEDE77923CBDE29581E566B8A50B31C9DB075883E26F271D1193EB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088349, "uuid": "8acaa710-deac-4369-8cae-3c98511dfbcd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088349, "uuid": "c7800653-b744-4717-8541-2e223f3100a5", "value": "393216:ywBnW9euv3ZsLa0RaooS5AUXMCHWUjXgcuI3/PGTAI:yBv3ZsnR35AUXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088349, "uuid": "a2e7c085-6a05-452b-b07a-f15efa8c61c4", "value": 14287181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088349, "uuid": "cbd83032-38e1-4834-b0c1-ca95126a1a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088349, "uuid": "701359d0-b3b7-4631-bf74-63f347354633", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7728f02d-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068461, "uuid": "a7e76ce2-3019-42a5-87de-e17285b2d1c0", "comment": "Malware payload (ConnectWise)", "value": "da3f293b8ea8ef925c8e68eeaf4c2245", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068461, "uuid": "b59f1fc0-9f4a-43d5-85ad-d5d00196daa6", "comment": "Malware payload (ConnectWise)", "value": "65209749f098f971fd047a459a43dbedc2fc423f69e8fb233c3985498c8e7322", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068461, "uuid": "b1a5c25f-6632-4071-ac28-98b218e4afc8", "comment": "Malware payload (ConnectWise)", "value": "4972cdc09e483de54ec4bee18d8f27e3e0983b57", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068461, "uuid": "49d9adfa-ad07-4940-8fd2-00176e332b81", "comment": "Malware payload (ConnectWise)", "value": "dfbd2d2f241db85382a4128e5ae47d17a7a005212e074d595acda15b777d53940d2dcce5d69be506d14471ad04122216", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068461, "uuid": "19eb5c6b-1c2d-41e2-9304-6ac3f65b3789", "value": "T138646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068461, "uuid": "c331f913-78a7-420b-a986-6fb62809b32c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068461, "uuid": "23ed3cd9-3347-4a16-9d8c-15e47e6b1964", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9I:51iw7gryNkSV1hy1Z1u2JLu9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068461, "uuid": "38e82ee3-c9d1-40da-8a8f-57cf7b77d712", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068461, "uuid": "3a4182ef-29d0-4315-9dd8-233299d96b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068461, "uuid": "292ecb95-59f0-4420-9508-e68746e3b388", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a4899d-8894-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785030750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785030750, "uuid": "7e6b708e-201b-4bf7-b641-77a916eb5c95", "comment": "Malware payload (Efimer)", "value": "73500ed71f4efbb76ec31499a32e83f9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785030750, "uuid": "e403cb57-54cc-4a04-bbf9-5b3f870e50db", "comment": "Malware payload (Efimer)", "value": "6543a1888c58d583be80f8f2749c4a0631c6f3d82a9b64a42b657d874f5d2b90", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785030750, "uuid": "ae7a3fd0-7f8d-4d83-be92-0a4d23212a76", "comment": "Malware payload (Efimer)", "value": "f0ff9433d77ca5bce3e904dcd48e9745caa24913", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785030750, "uuid": "ff830c68-ffee-4191-bb34-ce0c21fd7504", "comment": "Malware payload (Efimer)", "value": "8c8ae45f27cc30a6fe1972beac3f42f74ab8efc99e42a4c488b1a2f2299b5099143548cdcf938b886313a0ce2fdc55c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785030750, "uuid": "f6413c80-3aa7-4c4b-bc04-d46f26040f9e", "value": "T108E6330C97D023EDE6334039F9A18596E5E970A84B32C3DF0B5993A6AD571E08D7DB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785030750, "uuid": "782c1416-e840-4cc3-9980-919877b4a703", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785030750, "uuid": "a3d50fef-eccf-4529-8be1-9a9776d0f257", "value": "393216:kfFRWqbGeEbx//s1+0zCXMCHWUjX7cuI3/PGTAI:kV6R5/s1+0zCXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785030750, "uuid": "a8a38ba9-30a6-42a6-9142-e62d7ecf7a0e", "value": 14318773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785030750, "uuid": "31ff4fee-9d5f-4380-9355-5e9a22bff77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785030750, "uuid": "327dc995-c480-49b3-9671-de6a13dc7687", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7fd7e7-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "e3efdc97-8cba-483d-80e8-acd91c4f1415", "comment": "Malware payload (Mirai)", "value": "38af800c1c8863a72bd9eaa949f93ddc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "a2b04c3e-c8ea-4d10-b2a1-47fddab136b4", "comment": "Malware payload (Mirai)", "value": "655a1ba46071ee863406bac5cc438de306d7b3df3bb7907a152aef12ee6a58a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "241d8bca-60da-454d-8980-9c0fc19c540a", "comment": "Malware payload (Mirai)", "value": "8349fa8b8d9c7181913a8c30424d11fc013bb2df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "c76a0755-3b90-47a5-bd2c-13baef242f29", "comment": "Malware payload (Mirai)", "value": "9e67635ae4d12d00bf621678ddaaf83cfb02d1f102ec6909a7d304d2b0adb6b86871f79121e1100147b0c612b90d67b7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069863, "uuid": "4911ac5f-ac30-46d3-a609-337c3efeacf2", "value": "T110F2E1FC8662505DEDDEE4399BAA83901A301CBF7D05DF537861A0CA8A120D539D67FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069863, "uuid": "0882a3f2-cab8-4101-a49d-8a530eb0f54c", "value": "768:TGYg5Iy7YoVlxQGX3sV0fY11XICHM2iF7Wc1OFX1vvSFt5FFNB2KkGni3JgGlzD0:TDboV7TnsVqYf4CHM2W7WcgFFXSFPFFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069863, "uuid": "5023b69c-a044-4a5d-9268-83f8e0ccb917", "value": 37604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069863, "uuid": "1773567b-622e-4ad1-8bee-38b15b7917fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069863, "uuid": "33ebc1cc-2962-4031-9ef2-1613be2ae19a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e156cf50-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069498, "uuid": "98455e11-3ff4-4ef4-91e5-db625398482b", "comment": "Malware payload (ConnectWise)", "value": "4b3946bdd11ad71151fedffd845019f3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069498, "uuid": "f6b55d4a-5b95-4851-ab1d-34253ca47b94", "comment": "Malware payload (ConnectWise)", "value": "65c78afd637ee5211bbc712685cd346173e40c5f86061d276b6c71d7233f7879", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069498, "uuid": "8ad738e2-6415-46f7-b4b3-05afb2f8f7e5", "comment": "Malware payload (ConnectWise)", "value": "98b1b256ed200ba7f5322b6e1f100e941e3473fb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069498, "uuid": "083f1c8b-9706-42b8-9623-cdb0b43b220b", "comment": "Malware payload (ConnectWise)", "value": "51b78604f579038bc9c33f1762200ee05dbfd4f56d819425b0b322b6326b0e56ef6729880091b3fb766b867320eaaeac", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069498, "uuid": "aff16828-3118-406a-9dd2-1e4896a7e8ef", "value": "T12E46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069498, "uuid": "49f6dd19-eaf3-41c5-9aaa-a82bf7bcd914", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069498, "uuid": "e6d55d80-72c6-4ab3-8e1a-8097aa5d5dae", "value": "98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069498, "uuid": "d4bcbfc9-1fa3-44dd-9246-51abac5fd0d9", "value": 5653232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069498, "uuid": "e8ceab1f-1ed9-46b4-99d1-6e7db2025615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069498, "uuid": "61bcdd38-4281-4169-b12b-d88a5b92f1f7", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1f2090-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069360, "uuid": "4ce35ae3-964f-4474-8eee-617d97eb9079", "comment": "Malware payload (ConnectWise)", "value": "9a52c8742dbdba189adff031707f6b15", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069360, "uuid": "b8719761-27a1-4e1e-86e6-b9370a2bfd3d", "comment": "Malware payload (ConnectWise)", "value": "66a84357cbf196b5e4f5d660d5a28404a72c3b881e112d8c64f0e40202373c97", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069360, "uuid": "864fe784-36b1-4809-a908-7f21ae043012", "comment": "Malware payload (ConnectWise)", "value": "0689cfee80a122a753f694f8959c76265329c175", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069360, "uuid": "e6c582cc-50ea-4d4b-a123-1db4c3413dc3", "comment": "Malware payload (ConnectWise)", "value": "40a63cda0c7ab0305e0ea9c1fece0a7047d3258a3eeb221d0a332a597e1ce80263d9b5f6af052f11e422538433fb4d33", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069360, "uuid": "db1fbdab-3737-4844-8f5c-0c36b8924d36", "value": "T16846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069360, "uuid": "b17916df-bb9a-42b3-bc9e-344f11277499", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069360, "uuid": "0d1d87d1-0d1c-46a2-89e0-277d4c7469dc", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069360, "uuid": "eb7a2316-c1e2-4b54-9978-fd405789eed5", "value": 5641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069360, "uuid": "2e2c8265-90d3-46f7-a437-afe1765c05b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069360, "uuid": "a2bf4150-a7f5-436c-928e-e98f7bec2d06", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f77e55f-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785077978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077978, "uuid": "e1d31d35-d276-43eb-a993-6d6e4a2304ed", "comment": "Malware payload (Mirai)", "value": "0a3cd6934507edff9ec91c91b0ee52ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077978, "uuid": "9185245d-21fc-4129-ae00-2203ccb71660", "comment": "Malware payload (Mirai)", "value": "66c4333decca94448d7fb7a1b3a352f295d42c0ab2eafcc3a3cb4477b9a1d3b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077978, "uuid": "94418bee-03d5-46f2-81b4-0fe5d5f351a6", "comment": "Malware payload (Mirai)", "value": "f68dfa25fac674191434e67224b642ee38ea8b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077978, "uuid": "45674d30-f070-4e6f-9e3b-1b8fc3c120f3", "comment": "Malware payload (Mirai)", "value": "7e02d72055c986d8f32c31924b69f6be57d046942f96cb8ec9f76516ecef9133ef009a13661c4196a42452e854828f06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077978, "uuid": "634a468b-c8b3-41de-a3dc-98195327fe66", "value": "T11373195ABD419F15D0D526BAFF1E434A33536BBCE3EE7102DE146B2527CA91B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077978, "uuid": "7174e303-173b-43ea-a2a5-23269b8c448c", "value": "1536:ZbnjKDg2VKzAZzU2GPBIz9o3gTsZpouLve/EQMDx0nkdlV6iTHeiO+7mB:hKDRKAz9S3ysfouLe/EQMDcc/HeiOkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077978, "uuid": "299c1f4c-41d4-4bd0-b7b8-28081d22ca52", "value": 80492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077978, "uuid": "c84e7e24-4abe-4a1b-88a4-d261c0c927eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077978, "uuid": "f96d91c0-204b-4627-8063-638db75cd022", "value": "mIa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbf4dc4-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "fa6d134c-553b-4999-8bae-1c9e5debfd43", "comment": "Malware payload (Mirai)", "value": "46c529356d260257622cd88c88dc0958", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "57928851-75db-419e-8c7a-36b646bce4fc", "comment": "Malware payload (Mirai)", "value": "6861943accf457f2ec6e04ccf0b8726f4066d8de7c37d2501b6339aa86916499", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "a8a4cfbe-7ae2-4126-8e95-fc3c3b7f5905", "comment": "Malware payload (Mirai)", "value": "ee886e210a4aaf4511f0a089e7b8db22f3338c39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "98a648ca-82a9-46e8-b880-91416a1bb561", "comment": "Malware payload (Mirai)", "value": "91f759d14b223257f1fd07bd9aef1a17d1c72bc7be498af854e6e39d53de0fd5ef5987303d536f73d01471fa4bb36015", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066140, "uuid": "8eb09162-653b-4c6a-92b7-f37ec5ec96f5", "value": "T13F932A781985F26CEAE65075F44329E5291206083FCDD2E369C344BAFF74B88B52DD1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066140, "uuid": "ec116467-50c9-4b33-a009-766b21cdf50c", "value": "1536://DRXUWheYdS3OQ8QsFE3SlbBFtUBs2FCDcVBIVCCfy0K9Kt365:62eYdasFHBFosSCWu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066140, "uuid": "68572a7d-ce0e-4fbb-8daf-7110d89b0020", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066140, "uuid": "d2e36128-ba9d-408c-89c9-d30bc11610f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066140, "uuid": "5e6ae2cd-925d-440b-b48b-dce6a3bd8b64", "value": "MMaaRRiiOisecTanee.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cadd10-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063545, "uuid": "e9ac2bab-2a42-49f8-b386-bbb0bf96c9a8", "comment": "Malware payload", "value": "0b395caa0d59226d8e510762184398c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063545, "uuid": "26101e91-9458-4c3d-b7ed-a38d22cd94dd", "comment": "Malware payload", "value": "69d1f6d1d1119156c378b252aa58843eefe72bdaa056e79c35f0efcf0429ba79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063545, "uuid": "4b446130-b250-4341-a8da-bd7a7a4d51a7", "comment": "Malware payload", "value": "c3ba973a4a60769484465a837b4d9139b9aa1e78", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063545, "uuid": "8c654d87-0b50-4e85-ab8c-eeeb65d1174f", "comment": "Malware payload", "value": "af186b67e9c77e56bacba3c04ebd1dc4a9cc39348a6f4844e29be1935c012591474549111e3530a0cec78be87500310f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063545, "uuid": "c59c9a23-8cd4-4883-88ba-4d130cda4a48", "value": "T14F3131DBBA61B472B46A04B8D2CFF0945D4314BFA83079503CCE60286B3C4CAB8647E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063545, "uuid": "d8c57ba7-d74e-448a-9583-79f6f54ca441", "value": "48:CWlnxkt4hZjMthmrzqZHvV/J0P7+7LwR1LwRLkCLM0WilRN:nxktDtkyt/CiK1kL3M0PlRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063545, "uuid": "78e6065d-aeaf-4708-956a-7c169462b85f", "value": 1565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063545, "uuid": "48677599-f354-45de-916b-14e60ff80a85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063545, "uuid": "5a52dcb1-04d4-4739-84c7-1ad369946aa0", "value": "deploy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981c4aa1-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063363, "uuid": "b90bb7d5-625d-4b3a-b645-3c500fd0a34a", "comment": "Malware payload", "value": "16bbad81456bac7a22b83c14c42bc07e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063363, "uuid": "00cc76ce-bafb-43d4-bd2f-2578eaf55f28", "comment": "Malware payload", "value": "69e24a70a5257319dfa7d6a972603920be8d6667d599b765a8483e6b8b0021d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063363, "uuid": "6f2fe4a9-d027-4ccb-be0f-938170c1c6d4", "comment": "Malware payload", "value": "55da8137ae9761b8cdffbdf598aadb4dbe495331", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063363, "uuid": "9e9d3627-3874-4705-96ce-da2b2eade231", "comment": "Malware payload", "value": "2f83502d3238e96d8dba136f97d229e45ea4ce5455d34605c998f66ae8e8e7b1e519483516299616c33f8ca52b91eb2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063363, "uuid": "1b1e51e0-545c-4404-a531-18644f097335", "value": "T18785332AEAD300792D23267055DADFCEB5AFE141350EDCE247635E2CCC988CC7165AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063363, "uuid": "9fc3a410-83f7-41b6-bbac-0c11d0550256", "value": "49152:sER1bIjWKOz+ZlCTSVw0s9RjFpqOahc0gQm:syI6nDTSVc9R/0aR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063363, "uuid": "2df28802-e104-4023-8d29-2894f54908ee", "value": 1858096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063363, "uuid": "ce92ecb7-8c33-4603-a254-26d2ab1140a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063363, "uuid": "99874f11-334d-4da2-bdd2-a9055ae0fe0c", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7cf1ad-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044447, "uuid": "3b9edd00-b017-41d2-a0ec-34b096346352", "comment": "Malware payload (WannaCry)", "value": "a519b276895ca931fdc1c09e6d3a39b2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044447, "uuid": "cc456ec6-cd76-40ad-80e2-b99f5ba6d5f8", "comment": "Malware payload (WannaCry)", "value": "69e419b8d5afa5a7a807940ae55ff0d99a8abff865de546dd037a7b7c308963b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044447, "uuid": "a9996853-af8b-4eaa-9239-8998cbac4a33", "comment": "Malware payload (WannaCry)", "value": "59078ad5e45fc7384f7c4097becd27a9074337a3", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044447, "uuid": "7d7c02bc-3da1-41f8-a6fd-8cd58248eaed", "comment": "Malware payload (WannaCry)", "value": "0437cbc42d3cbd11fcb8692968c8a397e7d86362be05147e3e7dad4dbc4b75bd8d8183fc7c6ac505ebf556455e65370d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044447, "uuid": "bf976e56-0eac-4bee-9368-beb25f1b5dd6", "value": "T13E36239D31BC91FCD106667484F78E12E7B37C5A22FD9B0F5B844A6A0E03795BB50B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044447, "uuid": "a9584684-717a-4d0f-bf77-9634cabf0eca", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044447, "uuid": "84477fa2-f0f0-465f-a671-89983aeb2d81", "value": "49152:jnsnsQ2MSPbcBVQej/1INRx+TSqTdX1HkQo6S:DM/2PoBhz1aRxcSUDk36S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044447, "uuid": "72c5cc24-57bc-41eb-9442-fc68382087e5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044447, "uuid": "1505b961-b375-431b-b953-c2f2465a0593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044447, "uuid": "dda4df68-e9ca-4ec7-808f-42ab9e38982e", "value": "69e419b8d5afa5a7a807940ae55ff0d99a8abff865de546dd037a7b7c308963b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c318ba0e-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067730, "uuid": "4a09c36c-e36e-4edb-99c2-62058c21b432", "comment": "Malware payload (Mirai)", "value": "4c657e9f6101668b4595da82b6d39b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067730, "uuid": "ed78a770-8b66-495e-98e2-6e6f801bf794", "comment": "Malware payload (Mirai)", "value": "6a114057aac5be9bc74f818ac9dc4bb547136137a3f229e6ef47da070e7fa519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067730, "uuid": "20c87063-e25d-474d-99c1-cbc59723360e", "comment": "Malware payload (Mirai)", "value": "0663a22ec4b705bba23f34d330912705444fd4ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067730, "uuid": "75d3e546-5e62-451b-869d-e3e160f700f8", "comment": "Malware payload (Mirai)", "value": "0185d684755e679531a1ab475e6d15e2d811439e641a394ad5a2229a5ba7d8f16c73dd91deb173ceea989b568ef03547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067730, "uuid": "673a0ee3-dd20-4981-abd1-1bb8b0d6b173", "value": "T146142986FB81AB11C5C3167AFE0F014933135BE8E3DA76229D245B353BDB52B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067730, "uuid": "4a81010b-8821-4b35-a882-a842081bc5c5", "value": "3072:V8P/cFW6EODPFfS3l8iGC33wo0WCaeWo/y+5E1oNnFuyiCYVnQi:VO/kDPFfS3l8+3gwCaeWo/yqEeFLiki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067730, "uuid": "17888afa-1e4e-42d1-93f0-01d4bfc870c8", "value": 202224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067730, "uuid": "39b89a97-66b5-44d7-b4ff-87b79d554f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067730, "uuid": "bb2128c4-c8a3-4e82-bfc2-939dd88950e7", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a01f8ee-88b7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785045649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045649, "uuid": "3066a2d8-deb4-47e0-8206-d42f229785fd", "comment": "Malware payload", "value": "8d7719fabd1015f75a2e02c213032285", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045649, "uuid": "c8cb2164-473b-4213-a9a4-83fa3b3cb926", "comment": "Malware payload", "value": "6a19cb9afaee639d96896cc266db17a4b260bf4bd67fc8b88e9a214cf86a2735", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045649, "uuid": "3299e3a0-3990-4821-936b-2cdca5d26354", "comment": "Malware payload", "value": "0795c45569fbc8ba2b61088b1b53fffef42c69fb", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045649, "uuid": "871cc12a-8856-4ee6-99d2-6c1747f444a1", "comment": "Malware payload", "value": "b3e5df3a5f405c3b89943e4a5355aa6966ba4c4b87dde5795efce34bb07d5a81aa9bfe3dba287258b127230944a5c9cf", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045649, "uuid": "fa3936a5-6cb7-4c27-b92b-f295e86b0bd0", "value": "T13B3161CB00101B351713CFDDB3722498B20C86EB7987CB919C585EEA828C1DCB662BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045649, "uuid": "0e11d579-e058-44af-b6b4-505c44c468da", "value": "24:3nTCXLdiDO7NXAxmQmGev+o2EoKpDGbABcXABsm4wcQpI1zdZLory2:XTCbd5SxVeeE8kzam42u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785045649, "uuid": "ebcb2164-3978-4bc6-960d-9ef9acbe9403", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785045649, "uuid": "211d6463-0353-4223-ab17-8894321a9660", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045649, "uuid": "c25d79ba-7a96-4951-b0ad-390b6e27f869", "value": "6a19cb9afaee639d96896cc266db17a4b260bf4bd67fc8b88e9a214cf86a2735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957d02e7-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044460, "uuid": "eb3b55a2-bea6-40f5-beb8-02dad450884d", "comment": "Malware payload (WannaCry)", "value": "a22dafac6eb243a8afc1ec6e4f9e467f", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044460, "uuid": "25ca64c1-7a2f-4bd9-b6dc-f8d8d857bc0e", "comment": "Malware payload (WannaCry)", "value": "6bdae86e48fe43685de17171803099317c308488d5f2d16b8de0d8bcc888ea36", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044460, "uuid": "9e681c6d-d0d8-49ec-98c5-5da727f564db", "comment": "Malware payload (WannaCry)", "value": "a3da6fee2030bf102aa89fd344839d6cc1a1d243", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044460, "uuid": "b28c5841-7634-44bc-851a-c6664a67da21", "comment": "Malware payload (WannaCry)", "value": "cb0437218c24dbfe20a7638708c0347cf3331d6fbd0a4b272cb0a23c921fb72accb620116379cfd69740b548e6bb0702", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044460, "uuid": "14517687-c964-48c9-9541-75f21d12d420", "value": "T1943623D18918D5FBD7BE3A75E4A49C2826A17C6E6FE4022DF24849D18EE7FE4D041F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044460, "uuid": "55fa6eec-e6fb-40fd-a7e1-73818b2fdde7", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044460, "uuid": "cd6ea8ee-3044-41c7-94de-5b886a7d81ad", "value": "98304:DXDqPoBhz1aRxcSUDkEQv9Snm1tnr7DRbxyE1CaX+G4Q8F:DXDqPe1CxcxkEQv9Snm1tnr7DRbxyE1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044460, "uuid": "f8553c21-165f-4b7b-b2b1-364942e0881a", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044460, "uuid": "73bf65ec-9f45-4e75-8f19-8277bd96e898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044460, "uuid": "c9825506-dd5c-43bd-afc8-3cccd0bc402b", "value": "6bdae86e48fe43685de17171803099317c308488d5f2d16b8de0d8bcc888ea36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab923a7-893f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785103954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103954, "uuid": "06259b13-f9bf-430d-8fad-f7fb049600b3", "comment": "Malware payload (RemusStealer)", "value": "a21b839850fda4b533d973af7b230c14", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103954, "uuid": "3ec36679-f648-442c-bf38-ebaeadbe0a4c", "comment": "Malware payload (RemusStealer)", "value": "6cd26345cc89c28c8ea226eb8ffa96be4f48af5fa369a403cdfb6fc46ff3ebef", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103954, "uuid": "c20d8abf-a244-4af8-b9c6-3d6b5fc31e17", "comment": "Malware payload (RemusStealer)", "value": "25741d77150d950bde43a0424ebd59f659aaf9fa", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103954, "uuid": "10bf4301-331d-4e26-a271-2eac7457a8cd", "comment": "Malware payload (RemusStealer)", "value": "3d69ee1d6b500b8b38b26f6ef012bc34d14be584bed49459c93e0998ab8e6b6dc1e557fdb9b724d5577a09f80d978cca", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103954, "uuid": "5146b425-5a2d-4c1e-8587-dcab2c1707f9", "value": "T196C55A07BDE109E6C0ADA33189B26652BB71BC085B3623D72E90B7382F727D16D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103954, "uuid": "d24041a1-1f92-4caa-9549-5c0a2da67ee9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103954, "uuid": "a8a6b771-5f13-4757-b76a-c330fd10a285", "value": "24576:KZjxY9ZnVVXRiz0yqBb2B7Us1iM39nFdmBUHrM4YWSKPZoBele5I9DUAK/KGK+EZ:KZjmvnxinqBb2OslABouCCmBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103954, "uuid": "5ef43c62-9487-4f31-8a5f-dd19cd4f21e8", "value": 2612056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103954, "uuid": "93f5ffd1-559f-4d10-b8fb-41db65d5b4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103954, "uuid": "c60c1a8b-9a4f-4743-9154-7e5fe5539c01", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c1e9d8-88e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785064209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064209, "uuid": "174ff84f-73de-4e06-a298-89a900395f26", "comment": "Malware payload (Mirai)", "value": "e3bed0eaa3e8af47088ea97c9e344d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064209, "uuid": "9859a77a-52a7-47c6-a4c7-d4dea8021f4f", "comment": "Malware payload (Mirai)", "value": "6d02686fc6972df21f925384d9304ffacfcdc1f9d6aa58f3dcf074f90ee284cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064209, "uuid": "4e0a935e-c1ae-4d6e-8991-b4a1fd9e80b7", "comment": "Malware payload (Mirai)", "value": "9741604ab59dfd979c36d3a79703d972ccaf9652", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064209, "uuid": "37529600-cbaf-40aa-9441-c28f0c806391", "comment": "Malware payload (Mirai)", "value": "760c2f9cea3e2bd464dd933429c9cd192a85f4212ea6840e765776ff9bf4c2e4fb2fd1185b303faf3f32edaf0933b3d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064209, "uuid": "7600ff43-7ca8-48c5-8131-e2a032ca6ecc", "value": "T14AB39E22D819AC98C1954574A4A8BE761B63E18113731EF71BF6C6FA5087EE4F809BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064209, "uuid": "7fc0b7b9-5156-4813-9bd7-f038427cb822", "value": "1536:w/yQpgyT/+dYtxRLZK8q0EacVMWKQLef75BPxSCmtKDcF9HhnOnm:wKQp16dM7y0EacVMpQoDPxS/aM9HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785064209, "uuid": "2910d9b7-198c-4390-86f1-23a73c97121a", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785064209, "uuid": "aba1220e-11ea-4e3a-ad02-076021cd1c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064209, "uuid": "36dac583-b635-4e4d-8937-a70536877795", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f8185f-8922-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785091858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091858, "uuid": "d97f8e51-b06c-4b65-bda3-340ff010cb09", "comment": "Malware payload (RemusStealer)", "value": "bfe122e52e61f9f83c32cd079e60e3a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091858, "uuid": "caf19b55-3b48-4248-bc15-0564ee486d08", "comment": "Malware payload (RemusStealer)", "value": "6d9bd1e24e5f6bbdb0ae30a6a8de25043b658865f2ad2a84da382966689cdbee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091858, "uuid": "2d72491e-f005-41b5-acc2-be70af60b45f", "comment": "Malware payload (RemusStealer)", "value": "b2ed0f05bd388e35f48601b37a4586b7bf1d6cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091858, "uuid": "4688daca-ea20-423f-94b4-f0ace3abb8a3", "comment": "Malware payload (RemusStealer)", "value": "ec2c22de1c3555e823c829491920cc536560b715e41fe286f9249aa96cefc6bdfebe9ba5e4fa8ec96d6dfcefa88127fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091858, "uuid": "129140e6-8439-4712-be6e-15694cc46d1f", "value": "T152B55A07BCE149E9C4AA933289B656917B71BC084F3223D72E90B7782F72BD09D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091858, "uuid": "9b4f278d-cacb-4334-969e-19c405d1d3d4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091858, "uuid": "67666987-b9fc-4b5e-aea0-5b3cec6f3eca", "value": "24576:Anj8OfE75DXP/bm3zJwU8XQg+WLTFVgu34Y4AzwKSkfMsNTll78LLqJBele5r92O:AnjHfgD3b+JwbnzLTFVteqwRkrNjYwJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091858, "uuid": "bb6b3e0b-03b7-409a-9008-7cf9fa8e44b1", "value": 2334560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091858, "uuid": "ba34c7fa-2c31-4483-8e92-5aa14d4443fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091858, "uuid": "a1cc06e8-7c06-4a91-915c-cfb19765d9d5", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ce2721-892a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785095108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095108, "uuid": "6ed2f224-e432-45a7-8f89-cd1c724060ff", "comment": "Malware payload (ValleyRAT)", "value": "6399e481bee00f73cf825b0dce1fc30b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095108, "uuid": "5b3b2298-dd6f-42a5-b8c9-36def26bf203", "comment": "Malware payload (ValleyRAT)", "value": "6e795be8d4f34f798012d46530c62843dbb74c7cc64fd3a2db37ff68c85f52b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095108, "uuid": "48430d99-564d-4017-a5f1-9710b1b54618", "comment": "Malware payload (ValleyRAT)", "value": "ff77c50195d619514562aee94de25a4a9323d0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095108, "uuid": "48a9839f-9bfb-41c2-948a-40c8b26d7cad", "comment": "Malware payload (ValleyRAT)", "value": "7d99abc485beb02ba9257ae1b67b2446e98ab3dfe5d54aa36c96fa8ccadc7a2ce3cf24f398be843a5ad2bf2a4a9a9da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095108, "uuid": "e1656e32-e07f-49e4-9a12-e1b618e118df", "value": "T172E38C20B5C1C473C8B6283149E4EA75963DF8725F2059DB63881BFD9E302D1AB3DA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095108, "uuid": "52ae2188-377b-404e-a2ef-876fbbf8d3f6", "value": "2e526d5d63c1e746ac85952051c8bc45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095108, "uuid": "da9b3ba6-6ebd-4c96-bb71-b0944703a721", "value": "3072:Bz3EDHbOGYzbn0rtsMpxDC0XNXPgOc4rnHBFpGzIEIJOV85u0VMNYM:Bry7OGYX05sIY0XNPgd4HBFYz1qRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785095108, "uuid": "1643e122-1af6-441d-8fbb-66d29bad5b0f", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785095108, "uuid": "606cc2fc-b136-43be-b819-7f8147ce52b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095108, "uuid": "b92239f6-9c5e-4bc4-9588-f8eb7277fbd7", "value": "6399E481BEE00F73CF825B0DCE1FC30B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884d96f2-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088247, "uuid": "70fd46c4-3790-4f36-818e-e9d8b719afee", "comment": "Malware payload (Mirai)", "value": "ef4b516d7191751dc72bb1b47adbc178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088247, "uuid": "ce8406ad-acc1-4ef6-a3ed-9c0dd65e0d40", "comment": "Malware payload (Mirai)", "value": "6ef41d3251793644f01d1a20990882ebf15abfb564a5e4001b4aca76242013dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088247, "uuid": "1bb54294-fe92-4dcc-bbff-a79576794e48", "comment": "Malware payload (Mirai)", "value": "7e487dc2e36389369b5e6b331222ce19bf5d5a32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088247, "uuid": "b75f5cf6-62fa-478b-b8b1-ba16b39b3f7e", "comment": "Malware payload (Mirai)", "value": "883937918b83755efe9115b901547c7a59540846df71d609105960e18a8d0ff3b2fdc038fc1bf360f8b5913dae459cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088247, "uuid": "b80d367c-5917-4c96-81a3-b82b59d0cf1a", "value": "T1E023F1F72337EB39C26BDD7609CB26E0FA7175B27D02A7E635A0909D89F75864211900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088247, "uuid": "49b00423-89a2-464b-ad7a-bd51c600107a", "value": "1536:DdoBwyWBscPsfgXUG9a+uuf+mXJqH9D5IONcFbXm2IZjDY:AwyEscPsfgXUYuuP5i5IONcpzIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088247, "uuid": "14b79fd1-675c-4666-b384-1a74be27b4d8", "value": 50056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088247, "uuid": "bd40f882-84f6-4c7c-bb7f-6a1e942e28f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088247, "uuid": "16b94958-eb96-4b29-aa3a-4afc9545778d", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c03296-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070011, "uuid": "2e4a07f5-2d99-4a29-8c72-65a8d637dfc9", "comment": "Malware payload (Mirai)", "value": "5e257d625861913b9b380fed406a7842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070011, "uuid": "c54a810c-b70b-4266-8f86-328caf0841eb", "comment": "Malware payload (Mirai)", "value": "6f2c95090cf592c5f14f2367fb9fb7ad62f4b48f3312c03b9f2166b242e03456", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070011, "uuid": "dcd6610e-803a-49c5-92d7-74c29b1181ee", "comment": "Malware payload (Mirai)", "value": "0bd9067a84b5e35ca625a3c95609ba926296efb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070011, "uuid": "63ae6f3b-f7c6-4872-aefa-4c49a14175ad", "comment": "Malware payload (Mirai)", "value": "50198e6cd9fa639c24bb333ae9d18b0bb28ffc037623cd330d0ea6cfe4f7250634702edf1f188db351d77ddc4193a2c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070011, "uuid": "d2d9520a-901b-405f-b6d8-bdd9b14377a0", "value": "T116831A5AF9829B11D6C111BAFE1E928D7313077CE2DF72266E24AF20278756B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070011, "uuid": "18c4b2f9-4a6a-45a1-9de3-c806f3b36836", "value": "1536:SMn8E4DLQCafOS4bfxFLIpiYkZaee4RatfKj7xUVB58YzcqoZ:SE4DLQCa2HZZaee4RatfKjWVBuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070011, "uuid": "819de861-6edc-4a97-bcac-63d9f2c0c10f", "value": 87444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070011, "uuid": "f42ae5ab-be02-4fde-bf33-45cca9b96b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070011, "uuid": "4ce9a0f4-b56a-48de-92f9-6918a7cf6d35", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91cfa95-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066908, "uuid": "c3fc1f15-cca8-4ed5-8aec-f4c9f25871f9", "comment": "Malware payload (Mirai)", "value": "174adb2ad84796af149f31c0862df7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066908, "uuid": "52d0df7f-f0cb-40dc-ad22-3f89b9d4177e", "comment": "Malware payload (Mirai)", "value": "6f3b7ff901c100b81bbcdc4bb6bf5d98b7d198d8718c2ab4b23ec6e5f275324e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066908, "uuid": "5b6c0f16-c24d-46da-8567-cd7e47c955c0", "comment": "Malware payload (Mirai)", "value": "9b98bccc1bf93ce91f43ec1f533e1a5d64039860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066908, "uuid": "17e962e7-277f-4d72-bc3f-e55897d2540b", "comment": "Malware payload (Mirai)", "value": "7d9a0fa5d59ae4cc80e04047306648459ff0c09e99d0ee09cf79788d2ca911ef78f6e3b0ca9672f9473a6d8d1722b451", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066908, "uuid": "db74fd75-6292-4ca4-831d-5e19e6f10d51", "value": "T1BCD36CC5F783C0F9DC5605B12137BB3B9E32D47B212ADA83E7B81D32A861541D616BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066908, "uuid": "a0eafe24-331b-47cd-8444-66484de0d93e", "value": "3072:zoJyA1lMsCtS/eiE1WJTJ/Z7pUR/QEOze3IRYm0hIB1XC/MK:EJL1ltC8/xEAJt/Z5/YmZC/MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066908, "uuid": "4bc65f9c-07ef-4f1a-8a02-d130d6846831", "value": 130592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066908, "uuid": "17b5d471-b591-41af-8a4c-6f430ac7c73d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066908, "uuid": "50723453-78a5-4c7d-b4bc-77c99e017b9f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accb395f-8890-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785029038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785029038, "uuid": "9b872645-6f87-415b-a212-0bc413a73046", "comment": "Malware payload", "value": "06ddbc00bef66d0048eea14759484ce4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785029038, "uuid": "31b9bb28-a680-4c23-9b07-d0a5f93a599f", "comment": "Malware payload", "value": "7053ae123ff7a0f94df6b88f2110e66c9797b8b32db55e6d78d3035221a268aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785029038, "uuid": "93c34dec-6c29-4e39-bf61-7291dfd0423c", "comment": "Malware payload", "value": "e63cb7bae6256e4f1d96fba3ed93a8e0c05e130b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785029038, "uuid": "e82e0e9e-5ef4-4532-bb6e-74dca0a57516", "comment": "Malware payload", "value": "b3ca02e02b844554f8fed5727769c43c34c659ebb0677ddd25bf9c08541fb62ef95d3f3e28e8c41fdab81520b33958c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785029038, "uuid": "434679c4-d63e-4c08-8dbc-251fd4483950", "value": "T143235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785029038, "uuid": "74878667-3b6e-40f7-8c54-20ca8e947cde", "value": "768:z+49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:z+lcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785029038, "uuid": "6f8bf8f6-07d7-4ded-8543-88d52b37319a", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785029038, "uuid": "0d577032-03bc-4044-8040-4eb8d7047723", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785029038, "uuid": "b6335709-8d48-4e5c-929e-8a48bb10be55", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72b3ed2-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068971, "uuid": "e663f9a9-1dca-4c24-b6d9-df3c91e55ac7", "comment": "Malware payload (ConnectWise)", "value": "bbd90a954ab2674a933d2468e18421b9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068971, "uuid": "5c26e455-1669-40fa-b33e-7df45dd7a7ba", "comment": "Malware payload (ConnectWise)", "value": "70ecab8852e70c2cb30ac61dd24ec4af9d1672a2428a7d4e5723d26b3f3d86f9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068971, "uuid": "b73178c1-cd23-4544-b4d2-33784bb12c6e", "comment": "Malware payload (ConnectWise)", "value": "c4144896f760d44c246babe84a6bc03a9d5422b1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068971, "uuid": "3f719e23-e51a-45c5-ac0e-12c27dfc1c50", "comment": "Malware payload (ConnectWise)", "value": "8901fdad2049f47a8d7ab0e79664237cb6fabebcf683f8a305e506cae7f955b41eda8d1ab5ec1cab80667a829c76205b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068971, "uuid": "827eb616-eb68-4ffb-a6bf-6b738deb435c", "value": "T1B5836C43B5D18875E9720E3118B1D9B4593F7E110E548EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068971, "uuid": "338dc255-d8f0-4b70-8e1d-e86f489ca9dc", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068971, "uuid": "45cff0f7-be9a-4d3f-8da1-4960fb94241d", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYT77Jm:IenkyfPAwiMq0RqRfbaWZJYYTxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068971, "uuid": "56cf3d77-b2ca-417a-9d00-e31bcd25c98f", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068971, "uuid": "fabe490c-6407-4a36-ba22-21323a588df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068971, "uuid": "cb651f94-44dd-4be8-b41b-416cceb2a2bb", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65d5446-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069024, "uuid": "705ac7bb-4ff1-4228-8d21-b4e5f152c152", "comment": "Malware payload (ConnectWise)", "value": "a7cfe909930bbe99629a534741d6e86b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069024, "uuid": "f6d49074-13e7-4f68-99b0-303117502e74", "comment": "Malware payload (ConnectWise)", "value": "7110fe82fc5e4c418d9ff4ff0734fad3b846e90779436195ee92c9a16b902820", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069024, "uuid": "39d390aa-4fa4-4a46-9fe5-fbf16962ed1e", "comment": "Malware payload (ConnectWise)", "value": "0b419531cf863a7912cdf6320dc50e04b826077e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069024, "uuid": "81660369-897e-461e-b3cd-0973e3a0b114", "comment": "Malware payload (ConnectWise)", "value": "02caddef0aa743d25c499104f4fd3004f85f4b44f2ccfae841ea6219156ea1c1a7dc2263fc8c6294c56a49619505cbc8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069024, "uuid": "fc7b8af0-ddcc-421b-88c7-bfef574d2e99", "value": "T171C61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069024, "uuid": "38ba30bb-ea34-4ac3-bdb1-674bd318a9fe", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069024, "uuid": "4fb5dc7b-7f6a-4770-90df-88093053ec17", "value": "196608:n1TfefPqUQyiixtMjGZ1jhlrwUNQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMjR:n9PnjGrrGPnj5PnjgPnjqPnjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069024, "uuid": "15bf5f8c-397a-4e50-9e67-bd719493a38d", "value": 11624136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069024, "uuid": "5d921753-bff4-47bc-9bf9-1eff5d4f70ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069024, "uuid": "032bbfcc-b174-40a9-8a19-0915a0b7efe9", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ff918e-8917-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlakcSeeStealer)", "timestamp": 1785086923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086923, "uuid": "ec50866f-8ebe-4e32-a2d8-aca12448d0c1", "comment": "Malware payload (BlakcSeeStealer)", "value": "6cea19bf252870cbb5cd166121c181e7", "object_relation": "md5", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086923, "uuid": "628adc11-08d7-47fe-9037-7bc62a423f00", "comment": "Malware payload (BlakcSeeStealer)", "value": "713b84ceec4d9d6b35c0851f73b773ad84689e2458b811a8be11449eebaef298", "object_relation": "sha256", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086923, "uuid": "07a7623a-8634-46fe-9377-40d2a04bbbd8", "comment": "Malware payload (BlakcSeeStealer)", "value": "81862b32dfac3db4cf61d0603daa2fa949bc88ca", "object_relation": "sha1", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086923, "uuid": "9a059dd6-302a-4b41-8af4-467d985e6103", "comment": "Malware payload (BlakcSeeStealer)", "value": "37cff553f9d25f136c9b5c403039da30a5ac0f193d75112fa15153a17b8f378d9a7c3b1e294002f763c801bbb4b55654", "object_relation": "sha3-384", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086923, "uuid": "6c7a21ff-5742-44ed-ac3f-3c03fef6aaf3", "value": "T1EA16C095B3C46AE9C412CE399714F232C1B2B9234B76D0CB5A96C70A1F7AD524F3EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086923, "uuid": "658b878e-cf56-458b-a661-7e01c186c721", "value": "3fb6a9dab44411de426dea40f784f564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086923, "uuid": "14cd1750-71eb-40fb-96e7-1b376d27495e", "value": "98304:TCAhaB4eIYmKEzqEx7oZPyatA1khagVL7ZcMxaD9WyVLjtcxBWdVwjsMOv39L2Kg:TCbueILK4hza+1kh7VL7OhD9WyVLjtsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785086923, "uuid": "f189934d-3ebf-4727-a9f4-f19e59118534", "value": 4045312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785086923, "uuid": "33105359-a24f-496a-9034-ee0cf54f2639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086923, "uuid": "43be6a68-03b5-47c9-ad84-de3404776d48", "value": "msys-magic-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c175681-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081167, "uuid": "0b14c603-ef3f-4269-bead-66a1a0213b45", "comment": "Malware payload (Mirai)", "value": "4086b049441d38d4648924735a3811f8", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081167, "uuid": "815b6077-8e8a-4952-ac1d-60f7858ec3b7", "comment": "Malware payload (Mirai)", "value": "71f4a9d7ab1b0485517bd56905ea87870102a1469f770c4d832a4404c9591220", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081167, "uuid": "a92c860c-d4dc-4568-a2fa-6f7aa47973ea", "comment": "Malware payload (Mirai)", "value": "5c17f050182824d1b67a72f73344aa8f84692dea", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081167, "uuid": "f36a5788-152d-4a17-9fb4-bb995ade5224", "comment": "Malware payload (Mirai)", "value": "c81a35af65047586bf0f6d07ae553e3abfa485ba0630e217d9d661519f4475b1f7d74876668ce12fa0a9142e0f973c3d", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081167, "uuid": "3566a374-42d8-4633-9fcf-52455d1271ff", "value": "T136C312BF8D43D435E8045F3BA3812BEAF1BC463DD6E8E55E40885319EBFDA6A5240C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081167, "uuid": "b9e4614d-fa7f-40c2-bbb0-71833c1e0a6f", "value": "3072:euP96tqntuYQzPOt9fEOozCJXcxbwPUTwsJslb6pD:dV6tqnwYQzPOt9fGzCwmUMOvpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081167, "uuid": "7372d80d-b5f1-4d04-8d4e-e92c2572ff0c", "value": 126256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081167, "uuid": "b4b5ae5c-f9c6-42f1-8a4a-3422b08b051a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081167, "uuid": "26479e0f-9dd4-4031-8ea2-92ac5a97d8ac", "value": "flutter.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4c9b29-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "ccd9e6e3-0126-4030-b124-dc4e9d805f0b", "comment": "Malware payload (Mirai)", "value": "8cea59a8475203ecc5e6cb61d1c1110e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "246e6046-2eda-4189-ac5f-47d5a31418b3", "comment": "Malware payload (Mirai)", "value": "731b9eed72fd8bd7dadea67cbe1ad304793165f2bcdd695b8bf6734a5625919c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "911ba351-cae8-4280-97fd-ae5e99b795c5", "comment": "Malware payload (Mirai)", "value": "fc84962a56a67d3f2366230a240a2cba43b98c8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "f76d21cc-944f-47f6-950a-73f42c085d95", "comment": "Malware payload (Mirai)", "value": "056222d1265226de3c4a8d4d625fdd7edc7af98e414087ef3ef1a44631c142781811b3054b7703572f542b1da05ea3ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069867, "uuid": "91a491ed-bce8-466d-9b66-01cb673326dc", "value": "T12F536C67CA523D5CC6254BF470B0DB706763616080A75EFA29AAC6B8C0C3DCCF5863B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069867, "uuid": "589a7ffa-4fc2-41cd-89fe-8ea422ab7b80", "value": "1536:WII2IKBHaoK0zihCLRubOSSjFcHFCbQms1:4+6P0LLRIO3+FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069867, "uuid": "c89cd6b3-a5d4-4418-9c0b-77331ba7d320", "value": 64632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069867, "uuid": "dc851b09-90d3-404d-aaf9-d62eea342011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069867, "uuid": "135e0f55-4e5c-4226-95e9-f3e6c7bad00d", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89937e51-892b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785095550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095550, "uuid": "9cf1948c-0ae2-4897-ae31-a80bb008dbe8", "comment": "Malware payload", "value": "9cca1ed778b5b2450d7010cb1a024535", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095550, "uuid": "2ff214d0-b8da-4de9-ab85-5ffae96f610d", "comment": "Malware payload", "value": "732b8cf362f486b7569eaa85d9e39f71fe1438ba68214300a9b33c204c447264", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095550, "uuid": "777b291e-23f4-4dad-8f77-5f4f443d37fc", "comment": "Malware payload", "value": "00b0292f6e85a6e31efb3c223626dbff9d42612b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785095550, "uuid": "14ae0101-172a-4197-b7b7-b0f8ca5f3419", "comment": "Malware payload", "value": "c1c5389cbaaea2fee47de5b13cfa04170a019ef09ba1561a5a50226952984acdbf5071b698168f6e822f674bcf597b1a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095550, "uuid": "d6f6bcc9-8b39-4fb9-a8a3-168937dd959f", "value": "T1D2E63348B5E021EAD2B3513CEDA11595E872F1725772C5DB07E847B86C2B1E08E3DB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095550, "uuid": "224079f4-3227-4c12-8a5b-0d50f493df12", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095550, "uuid": "06f20ae5-3140-4bd7-8e7b-40b5b288812a", "value": "393216:8qbk6dy0JDwNo87jH3w3SFQTsXMCHWUjX1cuI3/PGTAI:8R6E0Dg5bKAXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785095550, "uuid": "4d1c808e-2674-4d25-a9ec-d27b7fc57c2e", "value": 14303156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785095550, "uuid": "e304f770-712a-4687-b0bf-4bcb1f2000d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785095550, "uuid": "0b48ba54-b9a1-49a3-a81d-277f853ec58d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd8b8d2-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "6ef86888-4687-4306-bb38-4cfeff6d7cd9", "comment": "Malware payload (Mirai)", "value": "07e1e715688854cedba6d8d445325561", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "ded6dd6a-e80d-43fa-9444-c9e095beab84", "comment": "Malware payload (Mirai)", "value": "733080846995fdfb86151fb5cbf247b2625640f918527af9956b3f659c17bae9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "4e0505b1-5948-42cc-9534-d7aa26fd4b5d", "comment": "Malware payload (Mirai)", "value": "b9d8cfa0fcc701a5947d9d6982e9ce40d6fac0bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "59a88ca9-13f9-46fe-8b3a-2c05bd2314a1", "comment": "Malware payload (Mirai)", "value": "31f131b7957e86d121f76e9fc02ff3905bf23953ecb50c49872107e738cc8f2c620e4ed46d6cc0810eb2a5dbb45564c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066137, "uuid": "26ef639f-71e0-4a46-a6fa-0431de8577d9", "value": "T1EB835B46EAD7F9F0CD4609B4106BFB31D53668323121DFF7EBC8B967A9A1601A05326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066137, "uuid": "ca1572ac-95fc-4df2-a1ba-0e57539da8bd", "value": "1536:2PfGfiOz1mKjfs2ajfYsyGsxuWIF9sdOWvd7/TiAiSbWNgIV:We7saL4sxwOTpb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066137, "uuid": "154856f2-f51a-4f76-a384-afb285bbe534", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066137, "uuid": "5896b77c-b13d-4963-95e1-894994f0bba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066137, "uuid": "3839c2df-94c9-41ec-9738-33d968b705f1", "value": "MMaaRRiiOisecTanee.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7a961d-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "2e201bc8-8101-4283-9b18-e29590303f67", "comment": "Malware payload (Mirai)", "value": "331437e60f0ea494f5d350ae640c5292", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "246cbe42-cdc2-47ff-8a7e-531c7512159a", "comment": "Malware payload (Mirai)", "value": "7356937d1f57d753b4c11b6f152733f6f65bb0ae9c0afe252bc06686bd1ffb50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "210df482-6d34-4b1e-b1fe-798877692021", "comment": "Malware payload (Mirai)", "value": "6ab76dc028d401e92f71dd8e77e3fcd05ab4a884", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "f4dd2554-cdac-4685-bb1b-036a1818a0f8", "comment": "Malware payload (Mirai)", "value": "4e8c33d0163016ab8dff0728ae7b0b020b048796ae0a366af22f4913e4d67f3b7e933b5f5347459ecd51bf10177dbbdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "d1922623-3886-43dd-bb3e-7aaae4d0b617", "value": "T17921CB9AA7D3AD1BCC540273DC9F5710E362AE45868EF403E36222250C7E21A2F2108A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "1b805853-531f-407f-9aea-4b34cd21ab59", "value": "24:JYolMlgP9qD0at6EoNGhrUlFSy40VzLCkIdsx2HuGIDpNfc7:JYolMOFqDPtjrkFSy4CzLfGIDpNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "4307e99c-73b0-435f-87a1-b1db4a1251e6", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "f3edf4ab-5582-4230-b674-5202ae15db59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "b8ca15f3-3d30-44ea-9707-b421aa009c45", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52cb8a7-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063438, "uuid": "7463514e-e510-49a5-9bb2-6ab4376643d8", "comment": "Malware payload", "value": "8bb8bed68c5e2af6ebd6619f111e6aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063438, "uuid": "506edf1f-11b8-4bc6-b522-b71aadf68472", "comment": "Malware payload", "value": "736c54367a6c51c84a13e7447b6e40c510a67138481fa4ef37ba0b95a698bd06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063438, "uuid": "d7c648e5-5f56-45f2-980b-c3fe60701083", "comment": "Malware payload", "value": "0555f8c3d65a5910c1b428e89e24fd9d269640bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063438, "uuid": "21bbfbc8-9bc0-457f-9c56-ac7a50b3ac12", "comment": "Malware payload", "value": "277abf29a980e1c36435f6a50779da8faa357bf46ff4758f0b5cba8d0fdabdfb137307815e232c6c88ee3bdfba585e7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063438, "uuid": "ad7e924f-9d52-4073-88a4-0b2b64136632", "value": "T1AF565B91FB48A126D98A0B3248730F70B3A16D42C2E48D6F5709F72F45B26F6694FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063438, "uuid": "3aefe4bd-3ab2-4cc2-9fcd-0be3b0e94100", "value": "98304:Jq97NCuNFPzRGnz2r4Oaur1EGUrRCJnEjEe:aCUhRMOjrf3nfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063438, "uuid": "e89a8baf-8480-46ef-9a5c-e293801ed6c3", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063438, "uuid": "e1ecf3fc-abaf-4887-b175-9ef46e673f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063438, "uuid": "32e3b336-0a27-4c64-8663-5dd3f9d2c6e9", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4dbfaa-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081226, "uuid": "364e6c7c-01e1-46cb-9308-54cb08c8e23e", "comment": "Malware payload (Mirai)", "value": "b796cde8ca29ed08265bcedf132ba47e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081226, "uuid": "6460aca0-945c-43be-9dd1-213535406e44", "comment": "Malware payload (Mirai)", "value": "73dafcf553427f833c2559a66cd4273309c89af9de4930e691950a0b337763ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081226, "uuid": "a36c6c4d-454b-486e-b8b7-882b2b90ae46", "comment": "Malware payload (Mirai)", "value": "392c6e2ba07f6022ebfaa7e76cd85ea8611bfef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081226, "uuid": "7835bc6a-8f32-4bc9-8932-004ef4f40851", "comment": "Malware payload (Mirai)", "value": "988e1a0324e9f0f5ada51c199d975ee5b4fd967ca831afd35da19ffa956ed4510a1568d7a9487ee07f6eddb344815248", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081226, "uuid": "9835b9f5-055b-445a-a6b3-639cfd01718e", "value": "T1A3046B1BEA43E170E0739031414ADBB78639A9354342C417FBA63F35EDB46C5D68AB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081226, "uuid": "4ed4ab31-2e12-48d8-8b0e-e9fe23a1aff0", "value": "3072:jd0RVke0elWIB8fvahoxauytqRQqOowFS5PRariTqWcNavvtMx9:jd0keHBOahoxauycKqwDWBMx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081226, "uuid": "cde39da7-0af2-496e-9938-f776beb702d3", "value": 173372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081226, "uuid": "768fc2eb-91d9-44c7-a5cb-603e2dbaea6b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081226, "uuid": "feffed1c-3dc0-4aa5-83e5-3dca67819073", "value": "flutter.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9f51cb-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785077973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077973, "uuid": "f2ee70ba-46e5-45f3-a036-4e10fb73f08c", "comment": "Malware payload (Mirai)", "value": "fbef644141799c27a83f02f947cfa0f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077973, "uuid": "d30cf2b8-f224-4f3e-8c7a-e9c6d37775e7", "comment": "Malware payload (Mirai)", "value": "74510c1413fba279600c7bf733fea79cbcb77b0c5bbac04d64b381d4356a4844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077973, "uuid": "482cf217-6086-41d0-a913-bd62aebab6f7", "comment": "Malware payload (Mirai)", "value": "82ae1faca5ec62469c560a7c9d27cb2667f62f69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077973, "uuid": "448fb8cd-87cf-4b9a-b7a3-63de66b71e82", "comment": "Malware payload (Mirai)", "value": "d79599f449845c8ff2a44104c2ec30ffeca1981d9ff625820180dd9be07b2a5ea606f5c39faa1afad55f70cc4be3c682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077973, "uuid": "83d473f6-e816-4d79-9ec4-30dedb740e2e", "value": "T10263082BB9518F15C1C1567AFF1E534E331327B8E3DEB213EE146B642B8B46B0E2A445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077973, "uuid": "3e6c3a35-ed35-4738-ab0e-0e99be019c7d", "value": "1536:DLnvRrcRcujEPd8SBYhft1GutAqexLyvAIjiH/vhJj4E79x:PRrejQdK5GyANxLYm/vhJjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077973, "uuid": "73f5a842-59b9-4e14-b07e-d03bffc8951b", "value": 67528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077973, "uuid": "af374e9e-bf4e-4c91-ba31-4ede5cd85c5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077973, "uuid": "2a77dbc5-5e5c-408d-8341-e92bf4a64563", "value": "ph7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd480e6-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070167, "uuid": "54928ccb-38b9-4e33-bd07-8d9343fa09ae", "comment": "Malware payload (Mirai)", "value": "16fc238bcc9ddf0b5387687515c02eab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070167, "uuid": "e386976c-2c25-4017-b1af-93c7c7a3bea7", "comment": "Malware payload (Mirai)", "value": "746f9a8bc3b21bf1139a1c24520d6a457dc637aad8a59f850e0a8fc6ef5443f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070167, "uuid": "23538c0d-999b-4e85-962a-76bf38cc5ad3", "comment": "Malware payload (Mirai)", "value": "dcf3f63c1913b178444d996083dda57f0a829184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070167, "uuid": "72287b97-68e7-4e60-877b-fb301199b3a3", "comment": "Malware payload (Mirai)", "value": "f97dc86f01277e1b40066ff1c9d9d1b25f4dd256930de07b6a9286e0f2b36054eb4f1f317a9ac490e2a4b3d8d077d9f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070167, "uuid": "3854c50b-b022-4b90-97af-1b661351c3a2", "value": "T1D4637C07B18180FEC899C2B567AFA131E573B4AB623DB3A927C4EE103E1ED116E59750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070167, "uuid": "f0306fa6-e370-46bb-828b-82addaaa0870", "value": "1536:SeQ65XdNRuOppJB1fNjjzmQLVGRl9A3GQsURu:ST65XdNjfDXjjzVGRl9UtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070167, "uuid": "ad3d530e-d6a4-4f1c-b567-455b0e0322dc", "value": 71592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070167, "uuid": "63014e88-9f67-4694-81cc-7931b9bf4aba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070167, "uuid": "2ca26fe4-2a62-4191-8411-d2dace49dbc9", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd95c3d-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069657, "uuid": "fb3c857d-0c35-4b27-851a-be7d1a24d9ef", "comment": "Malware payload (ConnectWise)", "value": "af7d2507954af45beb5350206202c41a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069657, "uuid": "881f2173-25e0-42e7-982a-e47126368de6", "comment": "Malware payload (ConnectWise)", "value": "765666767edf258d09c2c5ed3da997daff7ebd2acf6485e267d2358ed14c9f2b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069657, "uuid": "209d43f1-1ef3-4e87-b5cf-518972539789", "comment": "Malware payload (ConnectWise)", "value": "acd8e82318cd974801df038fd6246ef5527b9e78", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069657, "uuid": "1999a085-ebee-4e47-83c3-b047adde18e9", "comment": "Malware payload (ConnectWise)", "value": "0fdf03bfca06dc8f75b5b7c314879879ad69bb1d16941a24493a50cd522daccc683f13824a320b113cafc60399d34ea8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069657, "uuid": "cf763bfd-bd8e-41d1-aa85-47ed40d29b06", "value": "T172646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069657, "uuid": "b3444e59-2844-4f7d-b9cb-33fa7db13e4f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069657, "uuid": "0f6d5ae4-8e01-478b-b173-700fbca4256c", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069657, "uuid": "5d468ebc-b21e-4954-8c28-44853ba64d7a", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069657, "uuid": "0b67bd12-547f-4be7-a09c-163274690276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069657, "uuid": "7196d743-c144-4050-8a45-e551f4f8b616", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4874b718-8889-11f1-bd95-42010a9c0009", "comment": "Malware payload (Hajime)", "timestamp": 1785025863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025863, "uuid": "93d27585-ccfe-4887-9105-d0f3bff24e37", "comment": "Malware payload (Hajime)", "value": "3228c751712188ea561aa314880e6300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025863, "uuid": "f630b2c2-ae66-4137-8009-e3b03e523574", "comment": "Malware payload (Hajime)", "value": "77a84e50efc64c4248f38bc33aef956f4f8ea899760185f17caed1711da14981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025863, "uuid": "202eda14-a692-4267-9961-af18dc9b2109", "comment": "Malware payload (Hajime)", "value": "d624ed6b2849f43cca656bab30c63b799d7effef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025863, "uuid": "d0da32af-0c60-4488-967e-64645bc7b871", "comment": "Malware payload (Hajime)", "value": "4cfa0ca9d581b5e1a73d4d9020215586110d520572ad5d9522e8c28758db3fa49533832c3c0b7b6e234a7d64eb25acba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025863, "uuid": "cd0203b0-e3eb-4001-928b-8792d606a89f", "value": "T1ECA2F146269C3743E86255F1F37DBFC9B2026DBCAB7B58275088212370A314B62088BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025863, "uuid": "b6e4a160-40dd-4f50-bd5a-78045220a9cd", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qsb:YTYIDfYG6ZmewZ59+Nw1qsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785025863, "uuid": "155ffc42-9d9d-4431-999f-ebdf71accd63", "value": 21896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785025863, "uuid": "a7bc3a77-686e-4a40-88bc-318465baee99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025863, "uuid": "7456fd78-3c6a-4ba9-92fe-bc842e4a0235", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f517224-890e-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlakcSeeStealer)", "timestamp": 1785083051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083051, "uuid": "f23c6dd5-1963-42bf-bfd2-9780ef3c80a1", "comment": "Malware payload (BlakcSeeStealer)", "value": "58813057d929f6d79e69ffd26161fad1", "object_relation": "md5", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083051, "uuid": "942c749a-57de-4618-b7ab-579c756036ca", "comment": "Malware payload (BlakcSeeStealer)", "value": "77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9", "object_relation": "sha256", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083051, "uuid": "4cda3d7e-2483-460f-8377-80d902f3dd09", "comment": "Malware payload (BlakcSeeStealer)", "value": "580ece933e9f609007b1c8605ef245f5627dc4f3", "object_relation": "sha1", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083051, "uuid": "12cef700-8406-46d5-b6de-08a392df3d79", "comment": "Malware payload (BlakcSeeStealer)", "value": "2610da4172e3ce7e14ef2f89be1f1fc501d54d1f63772bfdc54dbc92357167c626f8ece0ff7d9febe34b14811f6a1332", "object_relation": "sha3-384", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083051, "uuid": "c42a11c6-6ad4-427d-a345-b08f51b3728b", "value": "T10716C095B3C46AE9C452DE399714F232C1B2B9234BB6D0CA5E96C30A0E77D524F3EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083051, "uuid": "90f6502d-56d0-4645-a0d7-84c8df4e120b", "value": "3fb6a9dab44411de426dea40f784f564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083051, "uuid": "4fcd965d-9003-4d4e-8c96-89223af5b4f4", "value": "98304:5oYyPPnNtxXxTCbJ7vOoq68ilpAvTaV/PBmWnHq0OCv5oF+RdarURFln7qoFiT7I:5opN3XRCVjznpAveZhnfcSgYFooFi/xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785083051, "uuid": "a1709424-facd-4178-be7a-5506a8dd4e76", "value": 4045824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785083051, "uuid": "8858caeb-2e6e-4bfe-8830-dee69c5bd0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083051, "uuid": "9542595b-3c3e-42e7-af38-d9f8ab6becd0", "value": "msys-magic-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4e8fd5-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785106350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106350, "uuid": "940c7db7-e437-40b1-81c6-5c0e443a53a2", "comment": "Malware payload", "value": "e70e3254dbab0a39f52dd81cb82123d3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106350, "uuid": "c1a4187d-aa99-4883-894f-5f56f6b2c74c", "comment": "Malware payload", "value": "7805b06ffc78058b2dd8f41155c9fc353c1267629aeaf3ee8f8e587fd11f013e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106350, "uuid": "6baab8c8-f5e4-4e65-a15d-c7a2b4d5eb36", "comment": "Malware payload", "value": "0555b030cc6625fa3a3840dde59150f337af4d82", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106350, "uuid": "618217b2-4b71-44bf-b78e-5a4c8015fab6", "comment": "Malware payload", "value": "49daf61ccf638fcedfcdc788c8d11b8ef98adc10c34adea44fcabd7dba6608266e2bbe64d64af8df0858b4d133cc96b6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106350, "uuid": "e0b88a3e-ba58-4cf7-8484-5d5c504753e2", "value": "T1D6E63304B9E017EEDFA3013DEE810995D1B6B81A1B3AC5DF1BA887903E571D0AC3D766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106350, "uuid": "65a8fb6f-07c7-4b65-9b31-8eddab338317", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106350, "uuid": "f952fafc-c3db-4d2d-958e-534e762f12d1", "value": "393216:2MRwI/ro+wGJfDaNpojXYmgUNoXMCHWUjXYcuI3/PGTAI:2MpccJ7gpkYmZoXMb8XtH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106350, "uuid": "8a417851-59e4-4669-a238-3888bba6cca7", "value": 14291577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106350, "uuid": "d296932a-a47c-4293-938a-d279d70f7f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106350, "uuid": "3a09c3c3-1a1c-442b-a11b-22b2320eb0c3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7af05c0-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785069858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069858, "uuid": "95905575-1158-46e2-af2d-250da96ec118", "comment": "Malware payload", "value": "50dd20682ce8c11ece4a3dc1e571b30b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069858, "uuid": "fc4c1d38-fe46-4590-b7de-7f6fd1dcb43a", "comment": "Malware payload", "value": "78d5460db4f6d3b4ea29595b7f8077d3aa73922fe33ce3a4f18547e73c02d60e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069858, "uuid": "99e1dc55-a632-4bdf-a43a-cfec2aa800db", "comment": "Malware payload", "value": "88f8eeefa2c5510464c062f983b41674a68cc28e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069858, "uuid": "8b5e8b6e-747b-41f8-8bf1-31ea2ccd7cd2", "comment": "Malware payload", "value": "2b0e72e43cbb9fd08b2d7df983b0314fbae7d228540981d813c7c3b77402f3b8faf8207970d15b92931e52efa67dc0db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069858, "uuid": "3af9862b-fa57-4038-aca6-aadf393fdbd1", "value": "T1A7F0E58AD4AD1D360E7D8B13A320EB78301524A1ABF2BBF9D485DB219B570387341F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069858, "uuid": "89bf11dd-e721-4f23-acae-dc37d8179ce4", "value": "12:ZCVWp7Tyyy0yowq9Ov0GyVpoQGy76ULnI+yLd+JM+0RwbFUO:ZCC7Tyyy0ytq9Ov0GyVpoQ976ULI+c+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069858, "uuid": "613ab2e4-7689-423f-8424-70b952379a02", "value": 451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069858, "uuid": "5d08233f-3ef2-4dd5-846b-647d32d10c7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069858, "uuid": "1e85a163-1785-4198-8e9a-ee5a57f41ab2", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be75e3dd-891e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785090056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090056, "uuid": "db23f5b2-2b97-472c-a297-efe0ff5f4d1b", "comment": "Malware payload (Mirai)", "value": "350782dd6d104126edd57e7f164b60b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090056, "uuid": "37b3da49-1817-47cd-9863-eda29a23e08f", "comment": "Malware payload (Mirai)", "value": "78f61a43ebf56b0d0f5724c2db32071a4b86da6c1aaef4cadc1b548c9591ce29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090056, "uuid": "bb18151f-5411-4f26-a933-39967babba40", "comment": "Malware payload (Mirai)", "value": "3e7bada984a340e2030d394f0b06395f9be7a50a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090056, "uuid": "1221cc13-4dab-4ab2-9326-b4d85666ad17", "comment": "Malware payload (Mirai)", "value": "1fbb0f7b2fbaef9f3515c996b9374d894b1e5349eef0de1e79851f009e102418d9b120f1a79c00e831f404222c334fef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090056, "uuid": "89b3baf7-0fea-47da-ad8d-a6884866d1c5", "value": "T16E142A56F8819B15C5D111BAFE0E528E33232BBCE2DE72129D246F3077CA96B0E7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090056, "uuid": "b346d77f-c508-4a5c-b232-62ff4ad89b3f", "value": "3072:/T3QqtiKV/xQRuESWRUEJVsqzXObSDQaL2+gXs9/QeEWOdPC7d8Ovp:diKV55E9RbfNzXCSca6+gXsNEWg6d8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785090056, "uuid": "8e66ec03-7409-45de-8980-bac33e13dd98", "value": 195420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785090056, "uuid": "6b0d834d-538b-4ffa-8e5e-d1326eee9abe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090056, "uuid": "6bc425aa-4a94-458f-bcfe-9fd33398fd2e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6639aeee-8927-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785093773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093773, "uuid": "aba78e5f-b7c1-4bb0-9f73-c23264d1a9e3", "comment": "Malware payload", "value": "c8488bddda51e1c92d0977499a348ccb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093773, "uuid": "d7807488-871b-4379-bbce-317d2f6cf6a0", "comment": "Malware payload", "value": "79c7de724b8d91a50fd7cf1d4bb572fedba37d33f9e705ce37957af43c0e8b9c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093773, "uuid": "409a9057-4cee-448c-a635-b5bf832b1532", "comment": "Malware payload", "value": "9d33aedff877aff887020cdfe756ee1fb3407b13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093773, "uuid": "fc322ac0-af0e-4813-8b96-3aafaa9e16c1", "comment": "Malware payload", "value": "e8eac4d0e216b6ccbc5f79198f4397a6f3083fb092b11eadd0ea021055fdc2d6f658905d915914dad3feb3daa746c393", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093773, "uuid": "515b44df-8b10-4d19-bf99-c62feb742c9e", "value": "T1CBC28D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093773, "uuid": "03fb80c4-a127-4bce-9393-6505b1d5f017", "value": "768:88vCB+25j6es8Ru9FYpMSUpi+20qUpi+20YQX:88l25JId2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785093773, "uuid": "20403f3f-976a-40b1-87f8-a12099e6bd45", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785093773, "uuid": "2a45b58f-e4cc-4639-aa37-992a613de787", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093773, "uuid": "78453963-c212-4efc-ad61-0754457f4ec0", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4db99b9-88bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785049264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049264, "uuid": "6c105940-22f3-43e8-bbc1-f12f006e491f", "comment": "Malware payload (Mirai)", "value": "5427e4b2c253dec8986b79af1b15bb7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049264, "uuid": "f2daf211-fd07-4517-a828-776952f2f969", "comment": "Malware payload (Mirai)", "value": "7ae90d4fbada82f98d951dd3d081208e700b57eacc1a5de3b6349d4b24c1a88a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049264, "uuid": "6f6d27df-e619-4c05-af7f-13e0df4dca95", "comment": "Malware payload (Mirai)", "value": "2358538cae6841fb47139c2ab1b287a0fb837a3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785049264, "uuid": "aad8db54-0a10-4286-bb02-5d3d27e53fcc", "comment": "Malware payload (Mirai)", "value": "7d85b873969c39d0e705b5acff61a72b3c532e7226a43f3ed1455910a0bc9ed2be7431d82892ab52a5aa714342f9dd21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785049264, "uuid": "deae9b87-38a3-479a-8e90-b09a24faf109", "value": "T1F8D4C70B6E228F7DF674873147F74B24DB6D22D627E1D980D1ADC1142F2128E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785049264, "uuid": "10aeba73-4da5-4366-aae0-8fba5962e9b0", "value": "6144:MScrLRIvSimzkKaZmK9rXEdIMn3hA3Q8QQ+Gtfp6yQ1zvTQ5obW7ThHDmml6l2b3:UrLRcfoK9bAS99wonIimIqnlMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785049264, "uuid": "3e7f3c8e-8229-48d2-a238-4edc9ed24edb", "value": 652420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785049264, "uuid": "2ba96593-186c-40e3-b115-fb4aee250092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785049264, "uuid": "165d6927-abc9-4fcd-8603-c845e7036921", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f72ed5-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066850, "uuid": "6047f789-5420-4544-a21e-22367cfd483a", "comment": "Malware payload (Mirai)", "value": "f724aad540a9c3b3535e203180b93b21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066850, "uuid": "86e8b41d-9153-4523-a32d-b75da1152a16", "comment": "Malware payload (Mirai)", "value": "7c1d821a6c0d74cd374fc5d31d71b1ea6804d649bc35e708eebf4520fdff23c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066850, "uuid": "8bb692f9-022a-401b-a901-94d16aa6a17f", "comment": "Malware payload (Mirai)", "value": "65ed2132d410929e44a244d575ca96fa230993a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066850, "uuid": "4980678a-9583-4557-ac80-e92fbbc06988", "comment": "Malware payload (Mirai)", "value": "b862ba0423f268fb557c1a5fae86cb308f0c20213d04355b27c810032b58d78307847e739265545c6c18b3c92757af82", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066850, "uuid": "c9ecde76-e054-44ee-933a-124439831617", "value": "T1E2830220E6F1D611CB30283ED539C3D276601AF5C2B52A9BC7D8DB9CC5CA444AF2682B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066850, "uuid": "1bc2dc88-0b48-49fb-9c9b-3cb6c294bbc8", "value": "1536:IJQTAzwGnbUUFjJzfNeJh0T6yZ9LajJ+pnOQ:IJLNHF7N+h0T6ALyJ+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066850, "uuid": "6d086504-c08c-4784-baa8-a4952297efde", "value": 82544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066850, "uuid": "c46e2121-8576-49dc-a5c1-26f6e243f902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066850, "uuid": "0322f270-dfbb-4d3c-b934-89fcc52648bb", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3fe38b-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088255, "uuid": "f97db1ce-0b4d-4d4b-b699-88e07a2f2a5e", "comment": "Malware payload (Mirai)", "value": "e4f3cf0402525c370e5dd2f47d597280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088255, "uuid": "8dee3d01-527d-4e1a-b881-3159475ac6a0", "comment": "Malware payload (Mirai)", "value": "7c523fd967fedaa44c4b03988cad297bd3e75bb411b666ead7ca276a7167fa21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088255, "uuid": "ecc8531d-2c4c-45ed-8e2b-34979a96b8f8", "comment": "Malware payload (Mirai)", "value": "54987b664393982de1bab8eaef165d068a3f70d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088255, "uuid": "3ae4ae6c-4213-4806-b87a-ddc15f28cb03", "comment": "Malware payload (Mirai)", "value": "5c656d4dc9d28993729027ff53f141bb3bfd24af88fe224fa84743ce9ad63811cbf2a3ce3977e03bcf37702fef567971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088255, "uuid": "535c0fbd-591b-4da5-a9ed-0f17f27383c2", "value": "T1D133F2CD103288E58A20387F98384A8363D16EF1E4E7B3B5365E599C25F1983CAFB951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088255, "uuid": "8811fcba-25c3-4865-a8f3-c276a7e18a84", "value": "1536:10E8Df93tKbHsTC2IvbAhgniT4dxPDYI3HDMsLK:C799KbGeBbTMsLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088255, "uuid": "15d0ee89-24c9-4e12-a761-a1b361162a90", "value": 52404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088255, "uuid": "5af8ccb0-36d2-4984-a4b5-a2c30f0dbdf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088255, "uuid": "0eca2474-5ab2-4ecb-a851-55d85903eb02", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a506922-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104491, "uuid": "5f3df752-cd4b-4efc-bd97-77a4637226ab", "comment": "Malware payload (RemusStealer)", "value": "19e84ca8fa5f649584b7baebd8d01f1d", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104491, "uuid": "0fe1ac5f-055b-4936-ab37-21ac547382f8", "comment": "Malware payload (RemusStealer)", "value": "7c8d18cc4785264f3a7d3423ebaeae8bf95d1ed9916dc4e6aab4f1f523747bdc", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104491, "uuid": "37f71d1b-f771-4326-85dd-c3aceea44454", "comment": "Malware payload (RemusStealer)", "value": "94932c0d201345ceb252ca61d81df0dec1187ae7", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104491, "uuid": "a7828e79-7a77-4e27-9cef-f79844dc7779", "comment": "Malware payload (RemusStealer)", "value": "4cc7f94813055ac76f48e7cf89cc20b69d762d7293e80572cb47abc2f286aac1ae23eb8c7edeb9eaaad78c9a7e107642", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104491, "uuid": "550fa1f6-7dcb-4b0c-ad41-268c3d67efb1", "value": "T1D8C55907BCA149E6C0A9A33189B352527B71BC085B3633DB2E90B7782F727D15D39B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104491, "uuid": "e3461aaf-e4ad-4130-a2a4-d9e3991622e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104491, "uuid": "94427504-448b-4670-9e18-f9c5c775e39a", "value": "24576:YA6VTL/rj0G9iyGYQVSHT52Sxxbq3fkdqKYOhMSrnPZoBele5I9DUAKyKGatEVL:YA6xL/lMydQVc5HpQx3QvCNeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104491, "uuid": "ca39c73c-3ea6-4148-b90a-fa33e12864b7", "value": 2614120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104491, "uuid": "23897eb2-ee71-424d-ad90-faae88bd9ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104491, "uuid": "eb15698b-79c6-4d6c-ae4b-a51ce26f7f8d", "value": "KLLNMF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70afa0ef-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785068880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068880, "uuid": "897da116-12eb-4265-9a6d-30ca40fbe7a1", "comment": "Malware payload", "value": "98b912dfd29aa642575542164e449dc5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068880, "uuid": "935bc892-a145-4fbe-aef3-92c632246507", "comment": "Malware payload", "value": "7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068880, "uuid": "ed2c3153-78f1-420d-bbe0-f4ba171b8114", "comment": "Malware payload", "value": "7a228610a539de18de12ad8fcc7547cc7f8d2bd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068880, "uuid": "93afaf24-ae88-41f3-97f2-4b5481e18cc8", "comment": "Malware payload", "value": "c1fb80d7bef5c2de08e5aeb97ac8bd27009ef0e0539bba93f4e304673651ed93ec2f3a5dc51946f48018e2b6c6fd9761", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068880, "uuid": "ae6be8e9-424b-4b21-b706-caf390637ed7", "value": "T1F4E6AD02F3F842A9E5BFC278C5625517DBB2784A1720DBDF159485A92F33BD09E39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068880, "uuid": "e6e591a8-f642-44a6-ad59-aebd4cdc5875", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068880, "uuid": "81cfa0dc-ff59-4111-bd36-a8d0f1ba9919", "value": "196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068880, "uuid": "7eb2b71a-84d8-462c-91b9-f2969f0ce8a3", "value": 15082489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068880, "uuid": "37f9bcfe-1274-44e8-bf75-9ff55e7bd76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068880, "uuid": "8e107860-60eb-4156-8e07-f7d0f69e10a8", "value": "svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df80dc4-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785077787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077787, "uuid": "d98653dc-36cf-4667-bbec-1c75c15356a1", "comment": "Malware payload", "value": "b0d11485495f01fda897da752f657c47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077787, "uuid": "45f13a30-9723-46a4-aaa4-7433da43822a", "comment": "Malware payload", "value": "7dfff5cf63a9ce54ee0bc7c8f734d077c8a8ae50aec49f518504ccebf16dc0f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077787, "uuid": "018f7f3d-ca6d-48a0-bbfa-a332113e55a9", "comment": "Malware payload", "value": "6ef119e809dbc1779984664d8786917bf88e7f3c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077787, "uuid": "2f09c502-6894-4cf1-b7ea-0e450631fc3d", "comment": "Malware payload", "value": "ee76aa1ada3bbd1a7264d2bc8086e48c13c0548fd4e04284260f68bfba643f4e90aadca2a0b7e4e5a837f6635bf03b55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077787, "uuid": "98d0b16d-968a-4930-baa8-37bedc594119", "value": "T1A621EE5168165AB785FE8DC2EDD6F226A040EC835604DDE833BCC2CCF31257A1936BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077787, "uuid": "c268e64f-4060-4047-addd-c6674e96cdfd", "value": "24:bDyPTujS6ubisDT7tqlsFd6/ZzTWUjEefU7TaMyHmWVyHpMWCkMQ3KVyaoc5AC:bDyPTuO6ubbDT7tQkd6/YUwec7Tx/4/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077787, "uuid": "182a0371-9fd8-4cee-a7ee-37ea839710df", "value": 1183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077787, "uuid": "8fa38d2f-a16d-4a2e-8f67-f98e91c336a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077787, "uuid": "e4cc0b56-8242-431f-bf58-c1d056d31696", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902eccee-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063349, "uuid": "7e6030ce-81fd-457a-b1af-d6d36245560f", "comment": "Malware payload", "value": "07fb0d400560637a3aa567725002100c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063349, "uuid": "2efd5718-a0b7-41f0-bc04-7fb5e853bdb9", "comment": "Malware payload", "value": "7ebb9e0c2fc769e6b867af1485d9fa8df3c42d52433fb52944b0229d289bfdf5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063349, "uuid": "315941b3-2ead-4aba-8354-b49dccc5ccd6", "comment": "Malware payload", "value": "fe61ae2316e2add7ac270e4f5404bc1371d22f8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063349, "uuid": "5b0b67d5-803f-487d-90e0-3d7d5956d2e3", "comment": "Malware payload", "value": "540377cfc66c0021978291be311d79ba702dfc020ad1f8d0d8ae12eead1dae1bdb386f70e2fcd0b198d1cadc02d731fa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063349, "uuid": "49167fa7-f248-46d3-b3ca-d0d08a808015", "value": "T1639533A4F6BDCA54E867273F3D6B60368D3BB5EAAB13D171BF21BA6860400473321456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063349, "uuid": "4de8c2aa-299a-48f8-97ca-9b7abe46bb22", "value": "49152:ROXtufZ1aZJhUyz2ASYDJrNC/89N7VTA1MhCRz42:ROdufZ1aZJhUyyASmrNC/g7VE1LRz42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063349, "uuid": "1b3c1d9a-8d52-42cc-b45e-83b626349b92", "value": 1993128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063349, "uuid": "c7dd30de-372a-43a7-bfe7-78d6a66ba7cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063349, "uuid": "85cd0c78-7d29-4781-9c81-548bbff04bde", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd06987-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084899, "uuid": "2757e67c-84d0-4890-8b96-e6fe127e902b", "comment": "Malware payload (Mirai)", "value": "458537d49bfa3a7c6442e3351bb8dce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084899, "uuid": "7cf8a52f-3573-46f5-9904-64c602d0c3e7", "comment": "Malware payload (Mirai)", "value": "7f870046babe6b9a05ea52a8f791306745f636238b564941b63409f9c198d83e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084899, "uuid": "691d7be9-9fa5-4c89-83bd-c5756ea41765", "comment": "Malware payload (Mirai)", "value": "228095f2a37ca56faa5c114459ec98f274f27256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084899, "uuid": "18d4a20e-dc04-4d0f-b5f9-b9ef96f5b277", "comment": "Malware payload (Mirai)", "value": "ca53dc2d701adf5eb26d519bd5ff4e00da30793203f89bf3d0c3f130c9002c3f1fe7b9d2b9bbceaf1b8efc1cad4df709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084899, "uuid": "f918befc-c819-404d-a1ce-6ca73513aeb5", "value": "T11D638C7AE4291D58C0850570B4B48FB40F63E1C4825B5EFB6AA687B2540BDACFD09FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084899, "uuid": "4692b28c-0f18-4701-91f4-45506ed584e7", "value": "1536:Oa6qCR6ABRmDml2YaK3PhsaWotC1FIWha10dZQ:O76ABz2s31Wot1WQ8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084899, "uuid": "b5656f50-a2cf-48a0-a70b-ecce655236e9", "value": 72268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084899, "uuid": "3fd1f447-21fa-4824-891a-32abf6847ff4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084899, "uuid": "c5d0fe8a-0601-44e4-96e7-41426e30638b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b370da-893c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785102763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102763, "uuid": "c6b0424a-485e-428d-9e08-841b4e9715ef", "comment": "Malware payload (Stealc)", "value": "3bfcbc6d80962f4d6313d9102e4ff3d3", "object_relation": "md5", "Tag": [ { "name": "160-20-109-33", "colour": "#DCF17F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102763, "uuid": "be66ca58-fc6e-47da-a4d0-ea16ad93a0ac", "comment": "Malware payload (Stealc)", "value": "7f9e2dc8918ea3f90d35ff18dd92963b81e331651d234d6373e269e036606762", "object_relation": "sha256", "Tag": [ { "name": "160-20-109-33", "colour": "#DCF17F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102763, "uuid": "7f976146-cd40-4714-8abf-7d2b5bd54d93", "comment": "Malware payload (Stealc)", "value": "3a3d3f293e52d151062c51b62fd39e543c9e6a85", "object_relation": "sha1", "Tag": [ { "name": "160-20-109-33", "colour": "#DCF17F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102763, "uuid": "0ab2edc5-15a1-495c-8e4b-abb190466f9e", "comment": "Malware payload (Stealc)", "value": "79241d09d93569d9b6230588d2ad51aac8a4716e39abf9bd5c11d58646aa29bea8b60fd8f2ad9232e2bf3bd3d62fe088", "object_relation": "sha3-384", "Tag": [ { "name": "160-20-109-33", "colour": "#DCF17F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102763, "uuid": "956410fe-5630-4a50-bd86-a9bcd0980020", "value": "T108E501D39241C7D4F4382935F06E690E02323D7F858CA05EE559B5126BB3D86EEE3A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102763, "uuid": "1586dde7-6acb-48c7-9983-6deaf5442649", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102763, "uuid": "986f123e-eb10-434b-b495-4eabbc9f4c3a", "value": "98304:NFGyooooogNfENTEHnVaQuQM7HNiJV6Hv7dHBt:jnNfEWVaLtrEV6Hv5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785102763, "uuid": "6df44948-2ae7-4a36-8211-ec69e62dce8b", "value": 3249664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785102763, "uuid": "fd8737ed-28a3-47bf-9f73-49bb0e54fb7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102763, "uuid": "2eb072c5-cb03-4029-acdb-252f27249997", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415ee40f-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1785067942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067942, "uuid": "56ec2657-3456-479f-9921-0b7737a1a748", "comment": "Malware payload (Gafgyt)", "value": "32f0bc57875e72406669bb9446284b9b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067942, "uuid": "a711877a-93ec-45e6-ae01-f5f0377deea0", "comment": "Malware payload (Gafgyt)", "value": "807fe3ad7a3d7c013713b120e077b30ca1978a48fc745c164011e029c8034371", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067942, "uuid": "658176fd-4ef6-4981-882d-4f5805f16e42", "comment": "Malware payload (Gafgyt)", "value": "6ac1451bbe231136b6c6d385294076be1c81b636", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067942, "uuid": "84b09f39-260d-4f09-8832-b60b1459d9dc", "comment": "Malware payload (Gafgyt)", "value": "bc298839a546ade94d88b7b2b0c1abaf1a695cda60e4c36ada02b0913ff3bbb4e1aafe374b3e0d04a91a351497e3eb26", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067942, "uuid": "2c55e8b2-3e3a-434b-b431-037144579963", "value": "T19B635C03B941C8FDC89AC2346B6BB53BD833747D0278F6AAA7C4EF26785AE501D1D905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067942, "uuid": "8576a01d-a125-434a-a741-292da5da255a", "value": "1536:SXNLQIF7XjCZ7B2vBTlBTv70qmDrSYSs+Rc:WcIFPCf21DzgqmDrSXs+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067942, "uuid": "0cb9e45d-73a9-417e-be00-4f16f3c9f178", "value": 71216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067942, "uuid": "99b0cc54-67bb-4a2d-95b0-f50a408878e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067942, "uuid": "c79da709-0d94-4ff1-95f1-7f9a14b6b09b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2dfc77-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785066245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066245, "uuid": "7c481470-a7a0-4c8e-9410-21fd65b1eaec", "comment": "Malware payload", "value": "4e33ec00ae359b546620430a07765b37", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066245, "uuid": "49f73e74-cec9-4f91-9121-b5ac994db299", "comment": "Malware payload", "value": "80ded01ce97f8e1fae56b57d377eeaed376cb3b1929bcffea21b3aada58091bd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066245, "uuid": "53b62be9-587f-4193-b824-fe52d91d91be", "comment": "Malware payload", "value": "6ac6615663610fd70a85b3527d1f7926221651ef", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066245, "uuid": "620801b9-d51d-41fa-87fc-cd33ba3143ca", "comment": "Malware payload", "value": "57cedd6edb13b312bf002de8712f40fced9a17347e0dfa13e38270fbf95dc8cb509384c96b0e2ef2b585cd7af3936b21", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066245, "uuid": "a7e0ec43-79e2-4382-a642-5abf360e2964", "value": "T154183341DD9908BFE62DF97CEDF3F2298695845FD1B0F16802AFC6D9AD29F4A944000B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066245, "uuid": "caaad4c5-1770-4ca9-8709-4c1cd65cde6f", "value": "1572864:2e4hdV6xf9GD/DDnFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzy:2e4Doxf9GfDnF7z3V7vl385ySor0Tzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066245, "uuid": "00209f9e-5ce0-4903-a2f2-f9f3ff820883", "value": 89515432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066245, "uuid": "9ce6b73b-c808-4d5c-b407-de2735046560", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066245, "uuid": "e8858e6c-c0e9-4516-b3da-e4a950528a18", "value": "app-64 (4).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed0e906-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081171, "uuid": "6ec8ec0c-ff8f-47cd-b996-6f06acf3e927", "comment": "Malware payload (Mirai)", "value": "a0a2733803335c53c2bcbb842c31a9c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081171, "uuid": "097c0e0a-b575-4a07-8fd0-3ab4e3426fee", "comment": "Malware payload (Mirai)", "value": "816f7277222f6793571dde9002054cfad63ac022dc8a558b758bda9ee598387d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081171, "uuid": "12cd9d5d-7420-424f-9b79-1fcb0d52812e", "comment": "Malware payload (Mirai)", "value": "1ad4112bb0e5d7d39e3073794da42d9c7f7bc56f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081171, "uuid": "febe885b-01d5-461f-8739-de6dfcc1431e", "comment": "Malware payload (Mirai)", "value": "75c362a10838cb02304d70bc99d4720ee57ae53e792740017773e815861df0810ca6533b90718d724f96148f901c3b3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081171, "uuid": "f644bcfe-17f0-490f-8ab0-7b02ebadab5f", "value": "T17593120B3448147BDE316E36362117B579415019AEBCF71E8AE2027AF2DB16EA3ED705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081171, "uuid": "e7752f53-91e1-4d52-9409-3376938c6621", "value": "1536:y3VkpSBnbsnpSV4zlGiAHQWgBoekkdgn2W8hKlOSk4MKnsDJ0ZMblM:y3V+SBn+8VaGiWYxkkdg2W8hK3MwMJ03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081171, "uuid": "8ea574ab-2580-4f43-9afc-9d0f47997bba", "value": 89832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081171, "uuid": "635c9252-ab4a-47f7-8663-699190aa89bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081171, "uuid": "38422e1c-7d2a-425f-a704-bf723113e655", "value": "flutter.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cc704b-88fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785076250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076250, "uuid": "f9f819f0-b8e2-43f8-9894-38a0b875aab2", "comment": "Malware payload", "value": "b9fdf930964edaa587c352d0b2d066c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076250, "uuid": "88b24f9e-654a-431f-8c69-b2118f516d22", "comment": "Malware payload", "value": "81bedb0639d5857c6d28b23b06cf87f812c1070d2c7c6ee8c985362a0ef2b873", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076250, "uuid": "a4afc790-917a-4f24-a2f4-dec0ce9c7678", "comment": "Malware payload", "value": "5883b460906fb8be030bb96872a288cc8d14c688", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076250, "uuid": "f64f8b60-fa96-4bf1-bb29-1e2b0c777ecc", "comment": "Malware payload", "value": "2d0586d3171c8b3fdfec097e00bb8673fb108112c8f11dfd774708772472aec4e84336b1d01c6ebba7f9595decca3286", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076250, "uuid": "cb16aadb-ba53-44aa-99f7-b47aa2f5a801", "value": "T14FF42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076250, "uuid": "5b98c16d-d1c9-47f0-80b0-aa3265d633b3", "value": "12288:WU7wAcpxXAIIETE1UWLwJrr1nuwynPUcyvmByHaRR1L+:WU7RyAOTtbvPaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785076250, "uuid": "92c7f62f-0a43-44fb-b027-597f56a21b31", "value": 750400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785076250, "uuid": "804a95a0-06a5-4608-800d-bf5d7bd0c9ef", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076250, "uuid": "e7cd54ca-3aae-43dd-b3df-923649124e47", "value": "Yipibul", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dd8ea4-88c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051016, "uuid": "81253bf6-b738-412f-b45e-f7842a2db9d9", "comment": "Malware payload (JackSkid)", "value": "f1ddb28c578ffb3acfff331a8478d238", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051016, "uuid": "88f5a5f3-f188-453c-85fd-1400e1884d4d", "comment": "Malware payload (JackSkid)", "value": "828b14ea14038a29a666d292d6698a6c062a135959b887e97638d7030644c4f6", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051016, "uuid": "6b000cfa-0191-4a25-b608-583aa3c71f0c", "comment": "Malware payload (JackSkid)", "value": "465db224b6927c522b0a3c66411d04bde5eb2a2c", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051016, "uuid": "e14b849b-99b2-4042-a1b4-da9b83519c49", "comment": "Malware payload (JackSkid)", "value": "0298228d8978c98f590c9b93ac3091e74123174349437faf47a1b474c605f61cf7af998472404ab412b9c35d77bfc2f3", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051016, "uuid": "fbfa3db5-dea8-43aa-b219-65a6a7cec830", "value": "T10F3215C70A7091313D0CC62C24B6B4480CF04795D9F9779B6ADA68A76F4B42FA19BCD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051016, "uuid": "bc905eb5-75e5-41db-94b4-287ab5a7b00a", "value": "192:kuupFqpTY7MxoahBJpTY7MxoahMpTY7MxoahK:XupExBxUx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051016, "uuid": "6bfa168f-5216-4c82-b0c6-471bf7224c6f", "value": 11022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051016, "uuid": "9ac854f4-339c-4224-b616-77e1d04b01dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051016, "uuid": "f4c73fdb-7278-4f9a-8b7c-cf7a3fd59c85", "value": "stager.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9676ddff-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063360, "uuid": "ffd1aa6a-5b46-4e3e-8b01-43368bc5d098", "comment": "Malware payload", "value": "c40e657e5a63b77f3cec011c34d86e6a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063360, "uuid": "cb8d247c-1b12-4008-ac63-dd0f1f049fdd", "comment": "Malware payload", "value": "8297055ef824184cbaecdd158bcc75213646b4b36c508c0c38f56240f9d449e3", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063360, "uuid": "05c7a5af-1699-4729-846d-04569841a32d", "comment": "Malware payload", "value": "561df585f58b19dde22d91be331783dbdf007549", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063360, "uuid": "de952f0e-f9e2-4023-8347-2990e3111b7c", "comment": "Malware payload", "value": "22183cff9678367f0122d1d85a2178655b29ec207e798c808256d88b895c9adb151b3047903a69ad24c6627215eab7bf", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063360, "uuid": "489ef74f-55cd-4fee-8a7d-9f238281de7c", "value": "T11585337BEC6B71858045E80BC1D3524933AC4EE62106F1CC1AF7357BFB9B9DAA58B094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063360, "uuid": "df6cf5c4-14c8-4d13-a043-ef18b2832f1e", "value": "49152:yFw6G2CnykiG75O0l3OLgo9FqNai5nioCo:yq6G2tkii5ReLgoONbniK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063360, "uuid": "57b4ca65-40e6-4f3b-a7b6-56042ab452d7", "value": 1718056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063360, "uuid": "5342cfb8-dd21-4c4a-8a66-61e7e54e7478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063360, "uuid": "3026f699-15a2-483d-b9e8-0510452d6a37", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dc8c38-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066901, "uuid": "044563bf-c308-49a6-be59-df4ac5bbec0a", "comment": "Malware payload (Mirai)", "value": "c6d5b77f731408eeb17e3115d7e59e24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066901, "uuid": "58277e9d-7d75-40a2-b509-a02957ace268", "comment": "Malware payload (Mirai)", "value": "82edc5e3d57751fb5fc6307af4d66a6c009a6940e1dea0d30e39ff905eabe97b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066901, "uuid": "88cd4b3a-4cdf-4fc5-9461-5671467e5a5f", "comment": "Malware payload (Mirai)", "value": "77929bf2a221890e0b9202174e50220dad7036b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066901, "uuid": "a3928312-535e-42bf-89b9-489c6f9e0187", "comment": "Malware payload (Mirai)", "value": "5b04899f9964d7ba0261f08eedf3b7fbc9f3ba3d64ab515c40a8832b2ea69fde55665718493188f31c4ecd058df1bef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066901, "uuid": "590cd9f7-c3cb-426a-b148-8667b5cce2a9", "value": "T159F34A02731C0A47D2532EF03A3F2BE0C7EFD9A225E4F645654F968A9271D361589ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066901, "uuid": "6681dc44-833f-4938-bb65-091ed0c61547", "value": "3072:Ty7BBtHTSh+xNfGaxMOVpVS1oFQ6hh1XjI:TyVzHWoxNfGaxMOLgqvjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066901, "uuid": "cdcfccbe-9a97-4297-a45b-3496dc2e231b", "value": 167696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066901, "uuid": "785a5ebe-4ed0-4459-82e3-a2c7de55a09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066901, "uuid": "7fee41d5-c47a-4e3b-99bc-daff9a9d9f8e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5a64d7-8926-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785093488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093488, "uuid": "888418be-c7eb-4883-bf76-89c898143b2d", "comment": "Malware payload (RemusStealer)", "value": "4ae6397d898c18b1356dedcbe225e639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093488, "uuid": "d3684b73-1d59-402b-9f73-f16578d5f123", "comment": "Malware payload (RemusStealer)", "value": "83554baeeb700815f9b6492584a1b1a40c64f752d1ff1a67cde079ad524b008f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093488, "uuid": "df30ee5c-d3ef-4d76-b066-bc7c30b96d0e", "comment": "Malware payload (RemusStealer)", "value": "8ddc91dd3c92113e654815c91c9accde8170dde1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093488, "uuid": "dc0b0f4d-568c-4bca-8a87-6103f2b095e8", "comment": "Malware payload (RemusStealer)", "value": "29c5f9089416ce6d1fda77214b7a7fc36034eff5a59b9599e3bc6ca16ef767b0b6e8313c117e0878ee18565cbc20c157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093488, "uuid": "4229cc7b-0d54-4c0c-b54d-21b6f3f46dbe", "value": "T1692733289FEDE638C19647B6C7945A34CDA908C911DC7277934D2F13EEC3A2A507B1B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093488, "uuid": "1f2ed3f4-7e11-40f0-b754-34187f107e12", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093488, "uuid": "9f454ba1-2b3b-44eb-a665-a2216664ad79", "value": "393216:WBuh88jMY2LToqSLIGug8C+U1C39YGOFEEV6DnyPQTKH1OZVozeXo80BkpiQv8v:WSwYOOvu/CmY1FE1jWQTY5C0mRvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785093488, "uuid": "9bb4fcbd-684c-4ef0-9cfa-db47136b5c34", "value": 22075099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785093488, "uuid": "d4f34161-ddaa-4102-a19e-c68633935fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093488, "uuid": "84bdf63d-95e5-4ec8-9443-c7635e17efef", "value": "dd_Pkg_09_yrxp12x2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fdb60e-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "968a5348-6f8d-405f-b225-bf6f6c064cb6", "comment": "Malware payload (Mirai)", "value": "b69abdfceae394faa99f6a2c47269390", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "c9e1fb31-0e80-41f8-820a-7fd6936181bd", "comment": "Malware payload (Mirai)", "value": "837a54b8faa5698fa05095fe03d82b9609f7ed04b47915399bedf4bc6bd95af6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "f3d5e328-6c4f-4af3-8d11-fa0d9a547346", "comment": "Malware payload (Mirai)", "value": "6b0300433a25f859cbde0f5c52c746ce7e0b9521", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "fcc02075-6fb6-476a-baed-033d755e6da3", "comment": "Malware payload (Mirai)", "value": "6ef12e786c416917e809d8522340aa9cc0d2043175478d2e47a73b6b6542ae3d4b54a53f14a7a1ddda22ffeeb6607fb8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066852, "uuid": "7cd241cd-9a21-4c05-884a-d4dcbd945ff4", "value": "T125E38C73D8259E98C621D4B4B0288F751F13D1A982476FBA69F6C2B14483C8DF619BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066852, "uuid": "72def6e9-5883-4b7e-8b84-f0067d4de4df", "value": "3072:JypSK/8jV5Qwtbx2OzCYyQ/WaqNozf6hh1kZ0M:J2SKaVtbx2OGyuaqGz+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066852, "uuid": "96a339b4-22b8-4bf1-a4f3-564510ee486d", "value": 148664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066852, "uuid": "ddafcac4-9985-4085-82c9-9ee4987b9b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066852, "uuid": "4b2aecd1-2efd-4719-917b-d5b0648023bc", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0587fe2-8924-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785092582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092582, "uuid": "07e4035e-7dda-4e5b-a28e-9d7f017b3c13", "comment": "Malware payload (Mirai)", "value": "5427516930974c7f43189c4cd94522a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092582, "uuid": "5614023e-a380-4a66-a709-bae0f6ebac0b", "comment": "Malware payload (Mirai)", "value": "83b8de55cd477c75eac4280e38ab0c4184f0b43de7467729d4acd6d1830ecc95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092582, "uuid": "6091e81e-5be1-4208-aa51-baad1412b8e6", "comment": "Malware payload (Mirai)", "value": "6ae9a5e0de8424cf88133470314dce66fa71c7b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785092582, "uuid": "d1cb29af-1807-482b-b64e-6b916e1af96f", "comment": "Malware payload (Mirai)", "value": "6e003881adbf64cf7b7e2c412660e6cef5f7126aa6dc3d27e3a171856deb4bf46eab2795c33924d8e601843ce7833b40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785092582, "uuid": "6b867aee-e9d2-4a29-b6d7-7bc4cd65fac1", "value": "T1CD442946FA404A13C4D617B9FA9F42453333E768D3EB73069928AFB43BC775A0E62605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785092582, "uuid": "6a29ab1b-6cc7-46e6-90fb-b1d94052f217", "value": "6144:NiW98sKU6NdkCZILad8guAUc6YfdkxvtEHxdjEV/GCemx2cLis:NiW98E6ICZILad8guAUc6kdmVwk/hemX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785092582, "uuid": "46382651-3e4c-4559-8f39-d5ba03755e98", "value": 258349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785092582, "uuid": "fd3bdf46-9682-4881-a9e8-275b5af99241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785092582, "uuid": "4477e2ac-8362-4f6d-98b3-be972d61eb28", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c126db0b-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067726, "uuid": "1a6eca2b-a165-44f3-b929-aef0a848b6b6", "comment": "Malware payload (Mirai)", "value": "7d41a5debfbfed512a46f5e4756932ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067726, "uuid": "896a3dae-5d12-4a14-ad81-54b510dfd605", "comment": "Malware payload (Mirai)", "value": "83c33ea51aeccc3e354b175ef963451001b0b228a85b74f827b8eeb36b52a361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067726, "uuid": "9b3633bc-963b-4498-9fdd-2223d0df6b72", "comment": "Malware payload (Mirai)", "value": "4b0b9805c9a21be2fab26a1f8b93d5f6afec7dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067726, "uuid": "3cfbea75-f5a0-4709-b125-8a8bc08d01ac", "comment": "Malware payload (Mirai)", "value": "863ea2f79703fafb378722b2bbea0247c869f9b401dba6471f8949578912f8498d1705eb62424ed99f66e72afe060fa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067726, "uuid": "734eb14e-a7cd-4719-b210-e4dd01148e67", "value": "T15E040946B8826E26C6C74A7AFF0F014D33965BECD3DA73328D181B74368752B0E76916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067726, "uuid": "bb5ddf95-696f-465f-9ed8-d625b58907f0", "value": "3072:B82AVj36SJNT1/ZrietYyC33FRa/b/YWO8oOAMZpjCYVnQ9:BjAdPT1/Zrieu31RaT/YlOlnk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067726, "uuid": "7619b606-e43f-41c9-9f85-91dd609da0c0", "value": 189556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067726, "uuid": "0a3ae88a-7378-44e3-89a6-04f9f4943bba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067726, "uuid": "a036b21a-ea1f-4f00-ad70-471ec673e0b5", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebde1f8-88fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785076312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076312, "uuid": "7b27c442-9767-47db-a838-1bf33d0bcdbf", "comment": "Malware payload (Prometei)", "value": "5e966c7d8db879a7bdd22c8722f8ee13", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076312, "uuid": "dd3f8b1d-a498-480f-84a1-2dae4604998e", "comment": "Malware payload (Prometei)", "value": "840cc54c1bcdf282a66cc6482e99f7e2b4ce6eb322123f469067751377e32a97", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076312, "uuid": "cd79a755-43a3-406f-99e7-d6beca47aabc", "comment": "Malware payload (Prometei)", "value": "501947b6a176712c87b2352709ca9a1b00da88a8", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076312, "uuid": "4f82a6f8-54a2-4e33-9047-e882f1100028", "comment": "Malware payload (Prometei)", "value": "9c14d9013cf599dad5598ac386d5846dc20a42d687da443ac351d5b67d03aed02e98037fb68744a687d3c6699f2be0f0", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076312, "uuid": "bb3523f7-c178-42f2-95cf-7860ab174183", "value": "T1AD31DFF1B4298DA57558C07CE55E61583DC9705B38243E08BC2F7C706FED21860AD5F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076312, "uuid": "e57933f5-2197-4300-826f-51ce0443febe", "value": "24:MIlwTlf8OBpT7KGga+IavpDA9Y5AalwNUCla+uaMkYaL0dT:1wpf8OPT7KV5I6A9YealW/lpurkYS0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785076312, "uuid": "fcfdcc65-1324-49b0-8f2c-837a4f262671", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785076312, "uuid": "0fea3b92-666a-4235-b18f-de3864d5fb54", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076312, "uuid": "67af1d3d-b405-4562-a3b0-0d76ddc7d265", "value": "840cc54c1bcdf282a66cc6482e99f7e2b4ce6eb322123f469067751377e32a97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff056ed-893e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785103910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103910, "uuid": "c4a0c3a2-f5d5-47a0-8290-3ce51e0b0b88", "comment": "Malware payload", "value": "2b60ddaa02a5fec2ec3151f6f84dc5c8", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103910, "uuid": "a27e6571-29d0-4992-acd5-c1d9e31d5607", "comment": "Malware payload", "value": "85287c739d9703b2909c65478ee803897192d43144d27a3ef3eb7c2dd7b3e393", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103910, "uuid": "71208952-49d5-4e58-b4cb-c153fd763c79", "comment": "Malware payload", "value": "7ac1f357f35b350994d83ff83008d75c4b6f16af", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103910, "uuid": "5bfeb641-3e6d-4b54-bd63-c7d7f0550b81", "comment": "Malware payload", "value": "c91c9679a57954ac6d397b8c629d7c12e2c07e865ba498102b0674f79bb5669b4e2f92369e2a35971bd2739d3674cd8a", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103910, "uuid": "a741d568-ed36-49ee-9097-6d2f74ecaf71", "value": "T105C55A07BCA109E6C0ADA33189B252527B71BC085B3633D72E90B7782F727D1AD79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103910, "uuid": "d6b589af-56e1-455b-a986-34ea3ab179f8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103910, "uuid": "6f824092-2f8e-4c80-a593-d563a1e27e02", "value": "24576:GGVlWSWvYM2s+9Xb0B27AQKJzAbg2XM7iogiOaP7kDSXc2qXEPZoBele5I9DUAKi:GGVYTvb+2B2BcyIzkDSXc4CVDps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103910, "uuid": "27147f89-7352-4d63-b241-8f37d7ee4b2f", "value": 2614104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103910, "uuid": "994db299-e7fc-4b3d-ae05-cb330ddcc8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103910, "uuid": "0579f14e-3056-423e-b7f3-4ddbf90ffa53", "value": "crazy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974c4598-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063361, "uuid": "39e6ac0b-b10a-464f-b3de-badcfe574b03", "comment": "Malware payload", "value": "c4c0e17a9e72a5b7d876c4e059538148", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063361, "uuid": "d7a81dd3-477e-4bcc-a36b-a6d19e5313a9", "comment": "Malware payload", "value": "859cafa7563806f9e84e06bfd2be319a25413f6a05742ff2c49fa4592eb23384", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063361, "uuid": "7f07402c-913e-4ba0-8e09-3d98f0044f3d", "comment": "Malware payload", "value": "2b1b334173b0327d350ea6e6870323b14bf064bb", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063361, "uuid": "e4ebe716-dff0-4791-86d6-e22f03a7d8e2", "comment": "Malware payload", "value": "fd44a630d8a0ba9543f5fdf9180b0c1d2a193650a78fc5818eb0b015ab3c732511109a1fd79f55af959a8208f0967d9e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063361, "uuid": "3ca67a14-e88a-45fe-86f4-8d66660f8971", "value": "T1B585338C88C327DAEA5B3E7DC29E9353A477206448AD9EC65B1B0E05F08086E7C5D75F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063361, "uuid": "3968f4ab-bfeb-48cb-a5eb-3f314199543b", "value": "24576:O92eLSwrWTmrkbipxFB81c78BIoZTWyMwIeeXUPMKw3E+D/G3SxgWwRDXK4VHIk:uTQLmpxL81c/eWyMnFUP3QEgCSv8VH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063361, "uuid": "2c2aaf3e-ffd2-49b8-9bff-c0585f0f742a", "value": 1735796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063361, "uuid": "0310605f-8989-4336-8f29-ab98fb7fe311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063361, "uuid": "de9a3732-bcdc-47e4-95d5-2f4eb14df1cb", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e09d587-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785077975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077975, "uuid": "9aaf85b2-d90e-4aa5-89f2-23a1a17947f7", "comment": "Malware payload (Mirai)", "value": "a7c5df3b68cce2a69142cb908228290a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077975, "uuid": "f53ebe6b-5654-4aa4-96fa-12ee4f5ddfce", "comment": "Malware payload (Mirai)", "value": "893bae32b89081ce1d7131f45a4e09c865046adc800e8a448dc65aa9155bd07c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077975, "uuid": "b86e651a-09c2-4f15-b289-a60c843576bf", "comment": "Malware payload (Mirai)", "value": "8d56d7b694c18cd72c890412b3f9bed7c4d80741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077975, "uuid": "103a5b7a-7e0f-4dab-8da5-6bca3ac7dcb4", "comment": "Malware payload (Mirai)", "value": "0f6786e19cf8cab4ece5e8199f09de75c87c75371dc54ba6746b30627625d7bc453d3674f6d7e971154c3c4bd65c86a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077975, "uuid": "1e69be64-5eb7-46e7-abec-e37018e48131", "value": "T157632916B861AF1AC1C25677FF1E8389372663F8E3EB7103DD106F66338B41A0E2A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077975, "uuid": "16f776e2-516a-48b7-9807-f8c61c537f3c", "value": "1536:ZVxc4TQpTvudTWI+QYMwQe8rxvaMlJrRF6O3ZctQFFEB/xYp2:ZVxc40pT0TnbeKxvnlJFFVpmQFFEB/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077975, "uuid": "26601d74-9444-4b21-be67-5555659fe35c", "value": 68156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077975, "uuid": "d602908c-5ac6-4185-a6d3-d8b570697017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077975, "uuid": "9945070b-8aef-4969-ac91-8e75e8ac2c6b", "value": "pu0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca069b9c-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088357, "uuid": "589cfd16-80da-48ea-9713-9aec34cadf64", "comment": "Malware payload (Mirai)", "value": "00d26cf2278d5e995632c2e70dae2829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088357, "uuid": "d49a3f78-8b5b-4cd3-9361-966b2e377698", "comment": "Malware payload (Mirai)", "value": "8accaca2507e31b46ef52fa0369d11259d527580f54104a61ff003f93da94007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088357, "uuid": "417646ec-33ed-4976-acf2-d292827031bd", "comment": "Malware payload (Mirai)", "value": "9f5e3c901a1a115b346445bd5253bf4a15ccb9df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088357, "uuid": "bf23b4eb-6d18-4ebe-ba17-78d6b0ba2352", "comment": "Malware payload (Mirai)", "value": "0d61ee6e850ebbd40a67cb45e003a90aef9719d5df68b412fac56c3c775931a1ec9972726861122d955eda2c351ad15f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088357, "uuid": "6ac40115-91cc-4030-a543-c0b88d23372b", "value": "T123F30715BB610FFBE89BCC3705E92B0618CD565732B87F36B530D918B64B28B25E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088357, "uuid": "88e69b4d-f7c8-4ce4-a2a5-ff281b145385", "value": "3072:KSMQ/jMdZtaieD+fK+QKWGNOjwolzt9sDUzZTH2:KSMWMdZsjD+fK+QKWGNOjw69sD+H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088357, "uuid": "da4d37b7-bdd5-48ff-83ae-1a5686f0cdd3", "value": 161088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088357, "uuid": "167391db-5217-432b-a3ac-7be82ed900a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088357, "uuid": "cb1c851d-81a0-42a8-9911-f1494388c53e", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6728c5-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088250, "uuid": "050e08a9-4d4a-4aaf-b99b-a0f0ede694d6", "comment": "Malware payload (Mirai)", "value": "adb27a0994885eaa5103e8e4b8925318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088250, "uuid": "7475be9c-53b4-47df-8c66-eb5a09824753", "comment": "Malware payload (Mirai)", "value": "8c0da2c903eaf8aeeaef90db5ff708313ff807673da59e70edf2a2569d77b332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088250, "uuid": "e6273c50-6437-4e20-a669-381c6abfe80b", "comment": "Malware payload (Mirai)", "value": "2844572bce7e4ebb4903e370867592794365c043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088250, "uuid": "c7b58694-0298-4dfe-889f-b4951473d6e8", "comment": "Malware payload (Mirai)", "value": "7a62b20136f20fced467e347e65f480a893283b0a8d22333d5de1406aa5947b1263ff0dee6c33f9363e9c083b7393515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088250, "uuid": "39528381-7286-42a7-875d-1562120878bf", "value": "T15D33F12D0E3AF56AC1ADE0F9AFE717507ED51FE67516900E2D78A6C388A2046BD407C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088250, "uuid": "8027d0e2-7342-4384-bbe9-5a8468652dcc", "value": "768:LZKFqsnxUZUDYDFUtRHcAlJFGRXhaPdpNVKG/MJYzu7f3fFJgGlzDpbuR1JAt:LbsxUZUDUKHAXIBVHCBH/VJuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088250, "uuid": "21db7373-9bb0-4f0d-9f8c-6a3c89b4beb5", "value": 51044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088250, "uuid": "b14334c8-2d29-4be6-ae79-e47fabb7f1ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088250, "uuid": "22bbcfc5-2dbf-46b3-beae-1d1e38fca0b1", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6808e1ee-88f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785074019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074019, "uuid": "904aacb5-944a-4c45-a01d-8a00ad1489eb", "comment": "Malware payload", "value": "fc6a3f6d4c73e6e08206eae69639b6d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074019, "uuid": "411ba86c-3784-407f-9838-4827ef63e990", "comment": "Malware payload", "value": "8c45e459524a09f560d930eedb1b1446e21606d9b22b71a80485c8a9077d6ec0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074019, "uuid": "acdb59a7-48b4-4415-8322-ee8ca7c4d2f2", "comment": "Malware payload", "value": "96699f4904f9f305b68ee6840446e71a42a87da3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074019, "uuid": "62f2f402-6973-479f-ac63-4901037e77c9", "comment": "Malware payload", "value": "acd28385e4e56dc4cb978dfc1bc66df5f0bb8c3251cc78342f849329a5b28142e1aa5fe1e79d119b8962bae647e77f54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074019, "uuid": "983229ff-bf86-4fa2-9b1e-721e27341adb", "value": "T184236C652A817C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074019, "uuid": "0e3d6285-2291-4fc2-8fd5-ca0f7f206006", "value": "768:fXOGVv99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:fLGcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785074019, "uuid": "e727914f-7fe5-42c3-a801-f9ac7e7337e1", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785074019, "uuid": "b2b3b196-c424-419f-b76f-df3405c23443", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074019, "uuid": "94b40350-ee57-4277-802c-a5f6df167ead", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71d40fa-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088352, "uuid": "fa3a2175-7553-48a4-96de-0116b506ac86", "comment": "Malware payload (Mirai)", "value": "2f973fcbbbce7cbd4e57f1e866a98a81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088352, "uuid": "c94fc670-0db6-40cb-ad84-df4a4ba24c2d", "comment": "Malware payload (Mirai)", "value": "8c489571934e1f1ec80d415e9ded80f0c8d94788732e4be8ab84edc55c98e846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088352, "uuid": "e148c310-8578-43fb-b744-ab723c13348b", "comment": "Malware payload (Mirai)", "value": "5557e7b834b1de8c08343dc9ad0abb9e424d46a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088352, "uuid": "294303c1-03aa-4fe7-81be-2ecd27ec3415", "comment": "Malware payload (Mirai)", "value": "1218d22824b80eee786fe6a524a9238a71f70532461279a7682c0b1c81674b1d9e5d97d1ac2e0fd348091af223df2bb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088352, "uuid": "f071f6bd-baa0-45fa-a94b-6981fe719e9c", "value": "T109E3D61E7E618F3CFBE9823047B79E26975833D636D1D595D1ACE6001E6028E242FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088352, "uuid": "865db115-5423-4086-ae8a-2971a1250486", "value": "3072:pJG2CYTcYpA5C7gMtspYX29A8uXENQDw/HKK9tpdw+T+7oywvyMiRZtkpUptH/tM:pJG2CYTcYpA5C7gMtspYX29A8uXENQDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088352, "uuid": "0d2ff82c-2414-4e01-a83f-8ab9e2895116", "value": 156992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088352, "uuid": "cfa16f95-5d2f-4b6e-98c9-594571760277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088352, "uuid": "a04f8ecd-0075-413f-a26d-1d7ba0d9b424", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099cd348-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081162, "uuid": "ec8c927d-38ae-4fd8-bb6b-f1dfdd26f90b", "comment": "Malware payload (Mirai)", "value": "7ae29ecae944a9004680d5bd50bc625d", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081162, "uuid": "b00b75c4-2aa7-4f8c-80b9-5ef65e05b6aa", "comment": "Malware payload (Mirai)", "value": "8cfb30ee7cd0486e66c325c52a161b5f01be4bf96d3611066f0dc002a5931ac4", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081162, "uuid": "26bafee8-2a8e-4edb-bab4-a7966398ab34", "comment": "Malware payload (Mirai)", "value": "0c16a93a6bc9724874ba393348553e83e0c4283a", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081162, "uuid": "08160b42-2803-4b4a-9fd1-398ec83ebe20", "comment": "Malware payload (Mirai)", "value": "b004ce114287b88f4c7faf73e70dcfff734a71aaf4e7519826547c7f60a529e0670780725ae850678d8873dfb2892953", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081162, "uuid": "dbf47003-3823-43ff-b7b7-ce32ec285834", "value": "T10AC312FA6C428BEEE0FCA77451E20AF8830A7E21F422B4A51771D1E57C7A10DE54256D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081162, "uuid": "3a7c8add-55b6-4fc5-89e4-281aaa754a30", "value": "3072:fgeR+9o67GW0eNbIoH+Y6G0kWjdQr6zfdzoFG:fgeR+9oZWlNbveuKjY6zFzoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081162, "uuid": "044c98f6-ff60-47d4-8cb0-42d7776d5092", "value": 126064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081162, "uuid": "872bb2e3-db4b-4aee-a8d5-33645a1a73fc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081162, "uuid": "3a1bf3ec-c2b3-4c40-ba58-0213340f9dbb", "value": "flutter.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e87dd2-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088370, "uuid": "bf79ccac-8123-4283-b805-cbc7990b7361", "comment": "Malware payload (Mirai)", "value": "855fb277e8b91de4f9e6398937a3b5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088370, "uuid": "f322d9b8-ddc4-48af-a326-97a91d58fa83", "comment": "Malware payload (Mirai)", "value": "8d7e60bd3155b0cd63ed531124e1e82fd8e8a15776a45b5f20a9fd28bffe7a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088370, "uuid": "c52fa99e-af3b-4e10-866e-e5a4c850285c", "comment": "Malware payload (Mirai)", "value": "bc8e0130bb64c631e67f1389f8f465b517563b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088370, "uuid": "6acbdd00-4281-42d5-98c3-cf8e0e1b766e", "comment": "Malware payload (Mirai)", "value": "61ba795c78143180614f0384db92a2c30fab95229b47dcdaab44b415bdb8714f295e02cd33dc34b23c112b5cfb28079f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088370, "uuid": "8b96a13e-2a0c-44c4-a4f1-60a61ae756d3", "value": "T1FFC32980F58F85F6C50B8D3060A6F63FDA31D5A981B3C66EDF949F72CA63581921238D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088370, "uuid": "b9ea4caf-d823-4e0e-a997-0e0b2d72b521", "value": "3072:w8LBPXPd4yN/ExuVLgv3fv7/tYnntKAPRX9qs8Hr:wsPXPd4yNMIVEv3X7t+fCrHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088370, "uuid": "e87f66ab-58ac-4fea-9f23-0d4695a5c726", "value": 121172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088370, "uuid": "0e05e6f9-8f8f-4001-bac6-5669cc90296e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088370, "uuid": "53469ec4-1df5-47b6-a17e-3a49d77cc0c7", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f77c6a-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051202, "uuid": "62497adc-ae3b-44a2-a2d8-6f71837a92fd", "comment": "Malware payload (JackSkid)", "value": "6d0b7ff3be9c45d66b444e933b6919f7", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051202, "uuid": "8b0c7b55-a2f8-4bba-ae00-108ec62227fd", "comment": "Malware payload (JackSkid)", "value": "8db1b95bdb5d8aa6a0b2c2357df49e537bcafb65e15582884b2c2588c74963df", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051202, "uuid": "1bf5eb7c-759d-4196-b2c6-de6b6d95dd48", "comment": "Malware payload (JackSkid)", "value": "c04a7a70a299fb1a1d05350bf12c30d220422710", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051202, "uuid": "36e21b5c-2ce0-4e64-99f9-ed067a282680", "comment": "Malware payload (JackSkid)", "value": "43b333944ef3d5ab31fc89c2e3af608251ac5091d0d7e2d1795900e0955f01e7dee031d422cc8bb901da675caa9750fe", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051202, "uuid": "67a4c87f-c53b-4284-9ec3-ae48ab5cfa3b", "value": "T19BF0782122B10E702A4A096D15C37C46A11A1C443DF21DCA62ED386096CF8AEE3A38AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051202, "uuid": "6cbbe489-59d7-4053-9462-9dfe11876ce7", "value": "12:9pcgaOWpcgaOxcgaONyFQcga7jv+aQCROLvmPjwvmGSpvmPjm:94OW4OwOy7jv+aQfbm8mGSZmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051202, "uuid": "99d9020a-214f-4c58-bf96-e25fad25f1d5", "value": 598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051202, "uuid": "d9185e04-5e47-46f5-8a77-e5d7fa505a1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051202, "uuid": "97f5d74c-2abd-4e25-b8c2-7a1ea055f759", "value": "stager.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825e4f87-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785066762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066762, "uuid": "d9fff814-a6e5-49d0-a85d-e47ca855b0d5", "comment": "Malware payload (Efimer)", "value": "25566accd0a1444b18b3178e38955c2a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066762, "uuid": "5b88daea-a8d8-425f-a4e1-26e0483b4c4a", "comment": "Malware payload (Efimer)", "value": "8e885a5a91a3657d47ca23d52659ea56b7010ffb24a4ae3eb184f8783b4223e3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066762, "uuid": "b69379ce-0f51-4bf7-9f36-89e4437dce40", "comment": "Malware payload (Efimer)", "value": "a329bd2564e6d570581bfcfe10bd3e07d8b7ee84", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066762, "uuid": "e0fe918f-9a8f-4e0d-88f2-007616ab4e1b", "comment": "Malware payload (Efimer)", "value": "a1958d835164519adc83cfa802dad5d903602888a4788a732d4f4f769fbf3fe694d790a8a81dc93fdeefe77884d2da6f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066762, "uuid": "057d22bc-2a6a-4e11-88b2-3789b3838e07", "value": "T149E63358B9D003EEEAA3413DDEA25A90FA6070B25373C9DF4B5893B51E1B1E04E3D617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066762, "uuid": "d3b63d1a-34b6-46e7-809a-eb778bfed703", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066762, "uuid": "526013f3-feb3-4fd5-9d53-84c08717229e", "value": "393216:geQNbAgN3EuTazMA/MXMCHWUjXycuI3/PGTAI:gdAg5E06Z/MXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066762, "uuid": "705c9523-feab-4b1b-8736-a598306d1b90", "value": 14287509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066762, "uuid": "372628fe-c02e-45e8-8006-9d339571dbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066762, "uuid": "d1296682-f554-44cf-bba1-6b316b0825e4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3dd921-88ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047208, "uuid": "931f3a6c-a44f-4361-b081-7acf0750df93", "comment": "Malware payload (WannaCry)", "value": "9aed790a18f214b04619837cd71546d3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047208, "uuid": "e0c890d4-3ac5-4a5a-822b-ba46b934fc89", "comment": "Malware payload (WannaCry)", "value": "8ec6066000f5585d6fefbc1d5a30fa094ac9893456dbf4085fec81e6b71cef3b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047208, "uuid": "574c1f98-094e-4085-80d1-1c09b0531af7", "comment": "Malware payload (WannaCry)", "value": "0f9a253afc55a8ebbd29a70c43d0e3cd668920f4", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047208, "uuid": "5759892f-6619-4c32-8699-b128a8750375", "comment": "Malware payload (WannaCry)", "value": "c6026ae2676faa9aa16b0fad2c0dbe574207e32ffaaae4c5eb76712067af83b3b8e7d1bfb0948b446d61f2163893a721", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047208, "uuid": "84afca8e-fb0d-4ee5-a8ec-e277198f490d", "value": "T1B436238932AC90F8D50663B4E4B38E15E2B37C5A227D870F9B5487661D03791BF78B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047208, "uuid": "94e2674d-0d7a-43cf-b25a-75be05aec12a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047208, "uuid": "f5b5745b-b7f8-4c46-be19-5160cdacdee2", "value": "24576:jbLgBbLgurgQhfdmMSirYbcMNgef0QeQjG/:jnsnsQqMSPbcBVQej/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047208, "uuid": "35cd91ba-0d74-4a85-ac74-a829346b0d6c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047208, "uuid": "433b48a7-d6a4-4dfd-bd25-4768391ee8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047208, "uuid": "925aa59f-945e-43ae-9ee7-516d811f2bad", "value": "8ec6066000f5585d6fefbc1d5a30fa094ac9893456dbf4085fec81e6b71cef3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a61502-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785084749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084749, "uuid": "44cf8eae-d2f0-4349-940b-101563e28b6a", "comment": "Malware payload", "value": "0d56f4cfcfaaea23d92cf688e5ac4d0d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084749, "uuid": "61ac798d-485c-4005-987d-faea0dc71226", "comment": "Malware payload", "value": "8fbbea30016a3c3b2763ff274bf511508f3df99c0d33f518b9a0067e7aedd8fc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084749, "uuid": "6247872e-92bb-430c-9930-327d442ac34d", "comment": "Malware payload", "value": "b40d0fab5e206d4609433a1909676a0e08cd734d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084749, "uuid": "4608bd58-84ed-4a97-a0ab-b5addf5a035d", "comment": "Malware payload", "value": "45f15446ba134b152d46adf35e6a760213ace5e0ae3f181a4e19468631cbb2445828fddbc6b91284cfbea87b2ad93e1d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084749, "uuid": "42b34e6d-f208-4e1c-90b8-49a57232dd5e", "value": "T15AE633483AD012FEF4B3413C9EE29160E56578725B36C99B07B45366BEE32C08939B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084749, "uuid": "863f2229-aa0d-4399-8a43-800f5d953db0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084749, "uuid": "1375a700-222f-4a6a-a543-694a2547222e", "value": "393216:/cFCd0wgpign0zETIB+zRLXMCHWUjXDcuI3/PGTAI:/Dd0Xx0wTfxXMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084749, "uuid": "fdbd4ae9-6246-4908-96e3-538afa11e585", "value": 14274644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084749, "uuid": "e9cd0559-620d-430a-a9ee-2956922a5603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084749, "uuid": "a64ba77b-5793-4017-9247-cd393ca027e3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3f4787-8885-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785024047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024047, "uuid": "3df5fb74-ed8c-4491-a3cc-46778d743f9b", "comment": "Malware payload", "value": "c3d9860e56afe4138d644068b2e275a7", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024047, "uuid": "029e7eef-dbc7-4cab-a76f-eef91998b5fc", "comment": "Malware payload", "value": "8fc661e3c83b3108e1281d1270c26fcfe19038916ee7f14142880a6807416343", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024047, "uuid": "84644d31-c549-4fc8-be14-829d3db09acb", "comment": "Malware payload", "value": "88f7eaf50f58205d0f50f7eda50b1f21c037b5d3", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785024047, "uuid": "e0c4e999-63e2-4820-9b7d-aedcb96481d8", "comment": "Malware payload", "value": "fcf3af2c739b6bfb35690cbb863caa479db3c99364142a8ef5d01d9b8131cafb4c0158d22db9a5d7f9a7b3171d72ad01", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024047, "uuid": "7145c9f7-e009-4d8a-9dc7-ebab9282bad2", "value": "T16B3141DA09655E391217CAEE73723588B14CC1F72C9BC7E4ED0C0EAE86589CD7291F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024047, "uuid": "7b32b00c-b3ef-46f0-85f1-4daabac25be3", "value": "24:gWeFFKDkDwVXhyFG2TJDe1Ysv82j0PBXxi8Q8hFK25Evuc0v:ghv2yw2TJDe1rv8y8Q8hF5rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785024047, "uuid": "185fc995-99ac-4065-89b5-f8191ee162c4", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785024047, "uuid": "a677a928-7f5f-480b-8a81-c32e46df06fd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785024047, "uuid": "8ca887a2-4f43-45ab-8db7-b996d928b874", "value": "8fc661e3c83b3108e1281d1270c26fcfe19038916ee7f14142880a6807416343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317ce5a6-892a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785094973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094973, "uuid": "7c09650b-1084-494a-a9ac-84edd0c602ce", "comment": "Malware payload (Mirai)", "value": "a4ab5bdc2dcb031b43ad0a41df487ce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094973, "uuid": "5b960a65-bc93-4eca-8202-c2c221c62600", "comment": "Malware payload (Mirai)", "value": "90233ccbb540fad9ec81ca3ae88266ed2df968f559a64bcc133ea5875ac7e2c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094973, "uuid": "748ce179-36a8-447d-8f32-b1be4db6fe00", "comment": "Malware payload (Mirai)", "value": "aa323314cb7224410bb1b68fbdb9d327a5c8e558", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094973, "uuid": "8a44c841-1da1-4026-99f1-722a02d8ac59", "comment": "Malware payload (Mirai)", "value": "9dbafe6eb9e7ffa41c48d4f84e05e54cd1d9eee70bb6d0089d14e384f430660cbf8f37bdd25a90ae14041a0bd1efa58d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094973, "uuid": "1bf1ad55-98d7-469a-83ee-f7b2cba556d7", "value": "T119730A91BD82566FC6D0637FFA5F528D332563E8C2DE3223D9258B11338A51F0977AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094973, "uuid": "6f0ca667-db93-483d-88c5-5e582768d2ab", "value": "1536:EjqHGilvIQ92VEAl/sywGoQvmGtPzygfPS2mWffIydIy:xGwb2VEAl/bwCvGUKePX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785094973, "uuid": "91dcc328-ec25-41d4-a274-a5ff8d8269cc", "value": 80460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785094973, "uuid": "97f0238c-51f6-4c8b-aafe-7c552c4862bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094973, "uuid": "f35bbaa0-f250-434e-ad4d-3e9ab3a95186", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2d2d55-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070059, "uuid": "863a1898-4705-460e-b12e-276a877230ba", "comment": "Malware payload (Mirai)", "value": "942dc1ee8b06de5818d83611522233b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070059, "uuid": "83a656f9-68e6-43d0-80e2-3a668bf293bc", "comment": "Malware payload (Mirai)", "value": "905648070f74afb7adca94f62308d34ed12e684192125d2153d832e13aaef5fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070059, "uuid": "ad7acbad-2bfa-4da3-8fb5-c927a200fe4e", "comment": "Malware payload (Mirai)", "value": "5e90a57a6e09727a9e16977c2f64bee61ee84ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070059, "uuid": "affd29d5-542a-4c24-9754-da8e84e8e664", "comment": "Malware payload (Mirai)", "value": "d9f8d083c6d9e464d7b0b5dc5086608b7685b4ed4bc2a4893eea1b55f06bd0b54e045b17bea905114e57a550c7e3a972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070059, "uuid": "4a425dc8-5355-4d82-923e-a3f7a497bf6c", "value": "T1A9A3F706EF100EFBD86FDE3746A90B41358C564722A93B3A7674CA18FA5A94F09D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070059, "uuid": "9c06537a-fead-4be3-afe2-d991b10fcb0a", "value": "1536:ggrFfrz89ahbgSQMK/5ZG+3QBoK/QMhYoJv5d+XuvksVHcqis:gurgkbkMA07mUkYas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070059, "uuid": "8f7f18a2-d83b-4954-b41c-b95b0552be8c", "value": 98260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070059, "uuid": "24de912a-d35d-4a77-b666-36cdb7dbc54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070059, "uuid": "4faa0691-256f-4fa2-a769-2c68f2a89be5", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41b127d-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785068107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068107, "uuid": "d5bacf61-d26d-47bd-9dc9-6c2717a13480", "comment": "Malware payload (ValleyRAT)", "value": "2e847533ba6f2c90b9a84e9eaff14cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068107, "uuid": "6cc70fe9-f599-49a4-9eae-8cfd4d9de283", "comment": "Malware payload (ValleyRAT)", "value": "92965d16cbf235f131ca72f8d698826de2a3e4eeb2df4f3d97ecdc9b443d998f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068107, "uuid": "24e95c2a-3e35-4a1c-be5e-0f4af6bb74c1", "comment": "Malware payload (ValleyRAT)", "value": "4d33b3a66096f81f7c6eb70e304bea226ed3f7a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068107, "uuid": "237b9098-59da-4e0a-9de6-859fbf01b9f7", "comment": "Malware payload (ValleyRAT)", "value": "bf5d0aebeb8f35190c45327f6bdc4d2a5ba472751a72eb4e6bd2d38d746360be33ac3e7df9c9ff57290cd8a5441b4da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068107, "uuid": "54ed2a4a-543c-4663-89b1-9e28378f4db1", "value": "T176847D15EBE504F9E1778538CAB28503EB727C9D07A0A7DF23A489561F23AD09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068107, "uuid": "6d4bc74c-b588-4685-b9da-2e7a37fa96b0", "value": "1450c9beddf63875e8aaa9b4691fb1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068107, "uuid": "199271be-3d39-4259-82cb-6fc0eb31f5c7", "value": "6144:7hwQwPpZ+UPwGihxJ6GcTHhjvP5lJ/yVu51vAhW6gj+88dA:2QSpQUSs/Hhr5l9qM1vMDgWdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068107, "uuid": "75bc5e33-5b26-480e-8029-9ea7236cf9e4", "value": 405120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068107, "uuid": "26a49621-b62a-45a3-a497-b8d18e619dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068107, "uuid": "2a075b3e-6745-4b98-8d5a-47ab7b1e47fa", "value": "92965d16cbf235f131ca72f8d698826de2a3e4eeb2df4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25748eda-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069613, "uuid": "b0b04db6-ec7c-4932-8214-cab0ee906429", "comment": "Malware payload (ConnectWise)", "value": "5044e89dda33f28743b3b9e79d6f6572", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069613, "uuid": "dbe00e07-5b8e-43cf-a584-753185712a98", "comment": "Malware payload (ConnectWise)", "value": "92baf0856fb02488b0b764f29b51dc76aa60cdb0eba3355a1bd395f0b008bd56", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069613, "uuid": "6dc9b418-25c4-4ff6-bcd7-a348598e004a", "comment": "Malware payload (ConnectWise)", "value": "32304df03f427ba7675efd314bf7f9f3d4e8113b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069613, "uuid": "84a3e660-6eb8-4a72-9eff-7fc4c419a078", "comment": "Malware payload (ConnectWise)", "value": "00c1831927a406e7d8fa50ddc81b31df5cd7646636bb6ee7ac65ad7ca3f6340d644cc665a83fcb579acb3487d35b2da3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069613, "uuid": "8996bec2-4451-46b4-82a3-505fed95c61c", "value": "T1F346E002B3D695B6D4BF063CD87A52A96674BC044712C7BF57D0BD692D32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069613, "uuid": "7c2e36b4-8ade-4de5-b18a-e4877ce182bd", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069613, "uuid": "28a16682-1aa5-4940-af28-f704cb492374", "value": "98304:kzs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:0fefPCFF3bBR1H9773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069613, "uuid": "33837844-0614-47f9-9783-35d3aef23dbb", "value": 5626744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069613, "uuid": "4927ee55-36d7-453b-b446-49863d91c981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069613, "uuid": "7f79b5f9-7b67-4b5e-a3d4-51665d496997", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f681198a-8927-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785094015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094015, "uuid": "eef6aa1f-34c7-4656-b90b-310d4304d5d9", "comment": "Malware payload (Mirai)", "value": "980a95174e1b4b381c764ce52e80d8d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094015, "uuid": "15cbc913-ec89-498e-bc4c-adf2df9ce21b", "comment": "Malware payload (Mirai)", "value": "9346840245721ecabe3bbf50b9c55882b7bb99e978d30329c1f9be9a19f6e61f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094015, "uuid": "a2ae22ff-cbf8-4d67-9bfd-bec051bdec65", "comment": "Malware payload (Mirai)", "value": "4064c69afa49c8bbb822b6e07999678d7b985f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094015, "uuid": "af1147fb-4356-457f-b0c6-8d537ce94d7b", "comment": "Malware payload (Mirai)", "value": "7ff83cc1ead63435dbc5584ada591bf1e4dd0a19251e93a6591baa44455a76ba8d4a9d4373c1b0977ed5648a673521b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094015, "uuid": "7b6da164-f9de-4ce5-821f-6f2fe89107c6", "value": "T14FD39FC1E743D0F5E85605F01037A7219B7AD43A983AFB52DB692E31AC72A819F1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094015, "uuid": "d772acdf-6031-48ad-9956-63d927abca8f", "value": "3072:sOmi2V/36JDFK3fBbsn01d2qB4GAs8iE:sOm5/KOvBtB1H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785094015, "uuid": "6effc277-2ea0-432c-8b84-5825c9e9d154", "value": 133452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785094015, "uuid": "5e5dbdd3-f323-44c8-9a5c-3eed504bd76a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094015, "uuid": "50ab4413-41a7-42e9-a138-68aee9709a7d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f0de88-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063708, "uuid": "b4d81293-4ca6-47a5-acf5-696c50b56e41", "comment": "Malware payload", "value": "f3f5dd22edaa6f54d70a5e1cda33669d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063708, "uuid": "cdd1561e-0078-4f63-ae6b-4e0a4f9c6a3a", "comment": "Malware payload", "value": "9370e9e0cb13ec4dc91de5768b2e1f9248979fdeccf64057103d6c3d5955afb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063708, "uuid": "37ec3463-ac7e-4ed6-9d08-02581d6a03eb", "comment": "Malware payload", "value": "68344db668c6b28b534d87ac04626c1debcc2c30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063708, "uuid": "940abea2-f857-486a-85ad-71139fb631b0", "comment": "Malware payload", "value": "eca9fad97170bc3150fa1934137d2b23e2af3d89b69294c3b1206111ada985888a14533bc1f5f4722abdb5b32081aea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063708, "uuid": "959182f9-351b-48cb-952d-307129d0ce3d", "value": "T168567D55FC1D7462DAC976752F7612943238BC089F82C7272624BB7DEAF23588F132A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063708, "uuid": "21b66883-11dd-4c63-863e-446bee2afb05", "value": "49152:0hqobJlm5y17MhLujL5c6UwhdtxVxquW+puUYxJt8/35EE:0YobJlb7zL5jUQdt7YLaBEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063708, "uuid": "32eb7f40-4408-43dc-b60b-fad08565d682", "value": 5898388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063708, "uuid": "6a1a5ccc-f60f-48f9-98d2-56a6424d1a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063708, "uuid": "ee476981-3d77-491f-a2ea-36fee07920af", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8789bee-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "7e7717b8-d062-42f5-aeb4-5da6b563f93c", "comment": "Malware payload (Mirai)", "value": "81429e33a0d55ce4f5428d4c43620b2d", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "51fc6682-57bd-45d1-bc5d-2f0495e23413", "comment": "Malware payload (Mirai)", "value": "93e296808fcc673737d0e5003676e4d811b78c0a8a284ee6d0fc7da78aec1279", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "14d55bbd-3dca-4a35-befe-a24a56e40872", "comment": "Malware payload (Mirai)", "value": "489bdf785028ff249f67604d126c5d029e0db472", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "d3d9c825-8649-4ae8-b46e-a4e8d65b0276", "comment": "Malware payload (Mirai)", "value": "43d7165fb8e2d1bee9c4811f37edb0773ee658cb7cd6b7176d6ccfbbe0e1ba4a800f8cbb92efffcd9ea8c0c9e5d5179e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069859, "uuid": "a62f131b-f710-4223-b96f-7737268112d1", "value": "T1FCF2F13830CAB920CD9318FBF31199C227E245692DF53B36675909DCDDC681A647E0AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069859, "uuid": "69d682b3-7692-4c12-9ef1-f2ab3279245f", "value": "768:tHsOMWvsg7LT15Bv0h2zPxtkBKTeQYy3e4hns3UozE:tHOIsev3PUBKPYme4AzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069859, "uuid": "f63be54a-9017-4423-a9ae-bd8e02bcc47c", "value": 35040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069859, "uuid": "ef688a1c-37e0-413a-bfc4-159fcee4a699", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069859, "uuid": "85acb9a9-9d56-4265-a448-455ecd1cc730", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28787cd-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063407, "uuid": "b85b1c30-eb87-49ee-8327-7619e7397242", "comment": "Malware payload", "value": "3672b6ba41a51e91a0f8e41e4a871e9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063407, "uuid": "723d8891-9822-41b4-84bb-7bfac3480977", "comment": "Malware payload", "value": "943d8e51b916e7b33022acf2ff4740e2001751040205d2d742b196402ee71199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063407, "uuid": "e73fb675-e10c-46c2-9b5b-6f271bb6ab25", "comment": "Malware payload", "value": "a5a6b8d4351e30a8b1a81753975286bc197a8691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063407, "uuid": "83926388-d4f2-43f6-ae65-aaeabafddab1", "comment": "Malware payload", "value": "8f1d2437d7b4289f1005241816bac1a865802837a665ff58182c8cfce5b475418845cc0cbec5185ee1a5e43dac711f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063407, "uuid": "ba2a591f-d7d8-4cad-a669-0c50b85d6435", "value": "T12166F6176B2CE70FC62832385DB1DA88276A1C4645DB9517B346F309E9F20AD4DAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063407, "uuid": "31b6f105-5d9f-4d01-94f1-ce4ef569eb49", "value": "49152:p2L1btd4YHWwwFThFsN6fp9EjGmYFXPYqQOOpyOtrfLpCueHHEt5EFX:qUpRXgzpCZnEjEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063407, "uuid": "ac656071-408d-4e4f-a30f-5af94529d864", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063407, "uuid": "40e96de7-a084-4c77-9412-d9ac2cdc7358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063407, "uuid": "e657c551-239f-4b0a-9bc4-2288c99b2bec", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a967585e-8922-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785091738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091738, "uuid": "eeb65183-50d0-4b4b-a3ea-0526d07ff964", "comment": "Malware payload", "value": "e1005d9b43af652c2dd5b8942ac78972", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091738, "uuid": "d8003f30-b762-4142-9e5a-2749e45a2426", "comment": "Malware payload", "value": "94e381ba36dcbf27e4907f9049eff1a8694dfafd4af899be0bed6b781f13b5ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091738, "uuid": "5ce63c32-c033-446e-a43c-89f9d134f0da", "comment": "Malware payload", "value": "40433f49ac6459c4340ca78265ba19fa79ac36ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091738, "uuid": "f05116a4-ecd2-4ddc-8c7d-dfe5693f136a", "comment": "Malware payload", "value": "acce39409bcbac61f836e62d9d429fc8be561b5054fa5027d36b52d7eb2a1887747891e2b130c82a49c3f421dbde0714", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091738, "uuid": "acba9f37-a5b0-402c-878b-b6d68c1a5068", "value": "T102C27CA56A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091738, "uuid": "79c23b71-0771-4d43-890d-3c97c4fb48dc", "value": "768:R8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:R8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091738, "uuid": "6c25bcb8-b046-470e-b4f8-cda6061a97d2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091738, "uuid": "948a96b9-cbbd-4456-87bf-cb5b5ad41e48", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091738, "uuid": "07675745-2947-49b3-92d5-72e760e15bd6", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1a3e0e-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081217, "uuid": "955f534d-f059-49fc-8571-fd582b3de221", "comment": "Malware payload (Mirai)", "value": "0a9f5ec83292ed310bbd6bced4bd12e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081217, "uuid": "b806b2c9-5023-4c91-ad50-5deebce65a27", "comment": "Malware payload (Mirai)", "value": "952fc35385baffa83a206326fb41efcf8146be37a3f60937e223d0e6cd876707", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081217, "uuid": "16f6b175-f643-48b6-8a2d-23a6b5877b57", "comment": "Malware payload (Mirai)", "value": "19106d58fbcfe0312b798f70189921c15900b4be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081217, "uuid": "a9bb465f-a7f1-48f7-9136-b5c955ec19d7", "comment": "Malware payload (Mirai)", "value": "20546a8d196ebd6c1bb07ecdf2e4230e62d405e9553cef12b96623a93abba1db33d2c1fb3ece7fc764656cdb83ca64ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081217, "uuid": "1cd19dec-288b-4301-83c7-5be891b1d4cf", "value": "T1B9147D01FB184653D5D25FB44B3B0776D32D499308BAF10D1A0BBB1A1673EF6A19B788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081217, "uuid": "9de34b18-3749-4208-a7b2-8628900700a0", "value": "6144:et452Eir2kd1PD5yP/l9iG+N9sJsCR6meKK:etkkrP69YsGKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081217, "uuid": "a955e259-62b2-44db-a0f0-08cebf15d950", "value": 197948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081217, "uuid": "c0d8271d-4ca1-421b-a451-03712df3182a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081217, "uuid": "3ef1f28c-bea3-48e4-a28a-b5740bd03e5e", "value": "flutter.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f9516b-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "4291b7c7-04c5-4e87-ac39-39dcd224d5c6", "comment": "Malware payload (Mirai)", "value": "3e9b563e77720995cc3438675803fa68", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "64ab01f1-3760-411d-9203-44a044727ae0", "comment": "Malware payload (Mirai)", "value": "954b12e29a26b5e45bdf1214a2a0981b533cd8305ad46858fc253bba48f83078", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "3c6f9e30-f2e3-4e5f-a881-4c4523ad29ae", "comment": "Malware payload (Mirai)", "value": "15d29ddde632bd07362bff5c944185fd9dfd39fe", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066142, "uuid": "83b7959d-370e-4455-8f04-57ce45c12f18", "comment": "Malware payload (Mirai)", "value": "d85c44670f2f983704c84b732a578719b194fbb8b30cf3df9cefc2cc6772b1afe43bd3d7b04f80f434be8bb14beca1ff", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066142, "uuid": "1f71c8f5-22c5-4965-bb71-ec3591a31368", "value": "T174832A02B9C085ECC089E138077F763AC425F1BD627AB2D73BD5BF1A2C19E511B1EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066142, "uuid": "8cc5df2d-f159-4930-8341-06c733adb767", "value": "1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQWDBiqYRKROEbMgU:cHBePDNnlNub63gbyL/Y2hMsDDBiqdR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066142, "uuid": "963aac28-3e61-4d09-8af3-dc8ac7e269ce", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066142, "uuid": "7aa54747-e34c-459a-b024-b9be7ecde05e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066142, "uuid": "b2161e87-637f-4e0d-9dca-238d2cb0e4d2", "value": "MMaaRRiiOisecTanee.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7d6b41-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "5a794215-2028-4a72-9a22-dc29775203cf", "comment": "Malware payload (Mirai)", "value": "303e1896563ade09ca182b69538acc43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "6339e46e-ab46-4514-9ced-b56f10d39b17", "comment": "Malware payload (Mirai)", "value": "95e9c60154a0bd948db5947e71a20d38bd20786918c5b87627870f49cd027a42", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "0f7a9eae-3f10-49e3-a818-d34700746d27", "comment": "Malware payload (Mirai)", "value": "8be6214eb428d4102274b933fa0c7553585cab37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067930, "uuid": "4c518893-f8e7-4c7a-adc5-a24579033be3", "comment": "Malware payload (Mirai)", "value": "6b47424d1c9ab6d99772ad8469e60cbafcf9c5bef1ee441c2b8a99e5271101e618c76d20a7cd9e327de12255e7da6b21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067930, "uuid": "914dd4fb-9e3f-4e12-b694-6ef45401ddac", "value": "T1ECA3294AFC81AB10D5D526BAFE5E018E33535BB8D3EE72129D205F2573CA92B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067930, "uuid": "ab223b0a-0a76-4dac-8d8c-7ffe7f70458e", "value": "3072:ATW3ZbP64xb6e27X2iQJ0QDawGnwVzrG4nELoh:AT+Bv27X23jDawGnwVnG96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067930, "uuid": "4f97dde5-a506-4ba7-b71a-ee1c2d79573e", "value": 98320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067930, "uuid": "aeff7a41-117d-41d3-9fe2-77c697a61c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067930, "uuid": "052d3e27-138c-44cd-af81-3dbcb3a774f5", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9839b400-8900-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785077107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077107, "uuid": "242172f7-f6d3-439c-b911-108872b969e2", "comment": "Malware payload (RemcosRAT)", "value": "0f569f749662f7691fe6c44abbbc16b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077107, "uuid": "a124fa9e-3b8d-4fc4-9e8c-c11e9ec05f81", "comment": "Malware payload (RemcosRAT)", "value": "967b1f49ce0642e631efce3bd1c03d535e0403c852d2e9ebc166967f50b70352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077107, "uuid": "6be225f1-791f-4afa-95b9-3044014a96e6", "comment": "Malware payload (RemcosRAT)", "value": "3467d457902da9168060d7fb53e0e0e956f924e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077107, "uuid": "5ec4e7af-8bb6-440c-b51f-02a2a18144e6", "comment": "Malware payload (RemcosRAT)", "value": "43699e8218a8a11e79a169501d35dc2d6aa1083e12cb703d7fec406ca8f1272ba4e9445efb5b9231c9a6e5cc5518a7ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077107, "uuid": "13cf3f29-6b53-4e9e-ad43-9c2e5720e1ac", "value": "T154B4BF01B6E2C172D57660300836E735DEBDBD2018369D7BA3DA1D57FE30290A739AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077107, "uuid": "58ffcef3-7a40-46ef-98e6-0196737d6f9a", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077107, "uuid": "6d7158f9-8b9e-4741-be46-fe43d70ee49e", "value": "12288:jg2cpfSUy6oFGNfZvCcXmw0z38qsPZ0Wk:jgdfty6oFQfNwz38JZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077107, "uuid": "e1f8ede0-c318-492f-989c-a0d7af224249", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077107, "uuid": "4d9dce92-09cf-4827-a0b6-87673bbf1804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077107, "uuid": "bd263bcf-949e-4403-a5ed-331d7b9de6d4", "value": "0f569f749662f7691fe6c44abbbc16b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409bc205-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067940, "uuid": "54c2e30e-d184-43eb-85cb-859ccca817c1", "comment": "Malware payload", "value": "2bc2c43a63e92b9b0a9d8b426ef5cca7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067940, "uuid": "b5b4afc9-db56-49f3-829f-ff9f5c0aa66f", "comment": "Malware payload", "value": "96856b7814c5af4ee984aac9ded443fd7d6ebd8c2f2df7e47b0ae65b75639722", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067940, "uuid": "5afdb42d-78ad-486d-bb92-35f32d76e24f", "comment": "Malware payload", "value": "266cf0f6842a5e2766c21480019416a5a208b5c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067940, "uuid": "5bb37b01-455b-4970-9fd6-db2d35341334", "comment": "Malware payload", "value": "50c49d62d410c225f6838383cbd7d5b88a53edd3953598793ef70bd4881e623b9719e4bb81b91ef864816e00c9611081", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067940, "uuid": "6b7f12a2-b553-4524-b77c-60f96201701a", "value": "T118F03CCD0163AA318E43CCF7B5638578A450E8C87B928BDDEC8E96605180A90F862E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067940, "uuid": "e76a7d62-0839-4b03-b839-d93133f4fc45", "value": "6:hoewVyipIbxa0EUDmpG8xa0EUDmps3Mxa0EUDmpGVxa0EUDmp1xa0EUDmpRMxa0h:G0EeVr0Ee5370Ee720Eeb0EeA70EeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067940, "uuid": "1cdad39e-72db-486d-9176-c72f4ec9b7ad", "value": 584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067940, "uuid": "739ecac5-e9b7-4d9e-ac29-ef495bb37da0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067940, "uuid": "3dbc7a2e-7a88-496e-8906-fda6680deca4", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57159b44-8918-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlakcSeeStealer)", "timestamp": 1785087305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087305, "uuid": "2d6e689f-9998-4c57-ac04-fb7b320b2c0b", "comment": "Malware payload (BlakcSeeStealer)", "value": "5199716fa194845ff7b91382f9686216", "object_relation": "md5", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087305, "uuid": "729ba52a-671a-44bb-8e05-eda3707b0913", "comment": "Malware payload (BlakcSeeStealer)", "value": "96a44769733da70aaa63e62a88d3cf15c0da78ca1d2f3999ded847b6e6fada00", "object_relation": "sha256", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087305, "uuid": "6102de8f-9fb4-4dbe-b8df-f65dc113c17d", "comment": "Malware payload (BlakcSeeStealer)", "value": "0c86e0e41a6c45ce7d25e52c4582d06ed2edf60f", "object_relation": "sha1", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087305, "uuid": "ae4c8cf9-e4a1-4796-98b0-8e9e2cb6a971", "comment": "Malware payload (BlakcSeeStealer)", "value": "0077308fad82f1dd801a9accf0df4ed9eccbaaae75f98b3cc84a3326d002a2f3da2c2ef2f2cf9fa04dabb3f8510c5729", "object_relation": "sha3-384", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087305, "uuid": "a279e187-b016-489d-824a-479fce8403e4", "value": "T1E616C091B3C46AE9C452DE399714E232C1B2B9234BB6D0CA5E96C70A0FB7D514F3EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087305, "uuid": "c7fd0e90-aee3-4c19-a916-55d0cd88b101", "value": "b1c022f21e313c400a3bd74350a836c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087305, "uuid": "cd144b68-70b8-4ee2-baaf-fee3359e2d90", "value": "98304:B5K1hoM1VR+6w96rOIy/BDH5Bw9JW5/GNw7TCexxeW96oGhagcpjW7BDYuMHMOig:B5K1hj1m96Wr5+NOGh8pi7dYXLiDaWcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785087305, "uuid": "80ef6c52-9517-4fa6-92a8-25bd6adc7ccf", "value": 4045824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785087305, "uuid": "39eb4129-c9a9-44ba-9b0f-ef9371fce3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087305, "uuid": "0d8f0a84-8f5a-4d8d-99f8-100209bb8d21", "value": "msys-magic-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5693526c-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785077856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077856, "uuid": "2e34d0d5-b303-46c8-87a4-9938b4d21896", "comment": "Malware payload", "value": "56d98bc56584eff99cc16fa7d35b14fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077856, "uuid": "97cae5d5-976d-49ab-917d-8f81011d35bc", "comment": "Malware payload", "value": "96cd3eca1a022d09542aca18095821cd8cfac06e12204ad3adfdc5b51a2e8de6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077856, "uuid": "2cb17b08-5bad-45fb-90f2-29f0fafc096f", "comment": "Malware payload", "value": "91b88046d3d0c8bbc8aa0854b25faadb39451b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077856, "uuid": "0d3f255c-a894-4bc6-8b41-821d198c7846", "comment": "Malware payload", "value": "9d1bf9a8681c42efdb23a6c9fe5929260d895b3108a9a9ed3fb5492b184ec3a072cd61e005c1db3aa68f6a56bca86105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077856, "uuid": "4ec27fed-73d8-447a-8fff-a661899dfc7d", "value": "T17CA49D45B54F7D52D3D7E2BCED0DCA61B20B7AB8C1A3A0B27E42034CC1669E1CAF5961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077856, "uuid": "b999ed8c-dfee-4473-aa76-72d3ca41fc13", "value": "6144:6TZ4wKD8A0xDmcvWKFyuK4Ma07SGGVcj3vPmrGjaRaZ+QqdSlE:WrxZMu9MaPGGqfIwZN2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077856, "uuid": "04c2e05d-0a3b-4f86-b3f0-eaec17c52149", "value": 464008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077856, "uuid": "2d48393a-b77a-4df6-b8f4-a6a72e72dd89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077856, "uuid": "ff471129-039e-4994-820f-2dbee64bda54", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60559a3-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063466, "uuid": "85609de7-ea5c-4659-86da-c3d40c40ddca", "comment": "Malware payload", "value": "63721b55ba8e5373ef7e42b861f66f0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063466, "uuid": "3ac0e605-fc14-4da2-aa78-79eaf8c6f831", "comment": "Malware payload", "value": "97202c459d240d6510d46ebf8e3e481a6add5b2d146635ee7f1773f9d5f6e28d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063466, "uuid": "792e377e-fcaa-4072-8a41-38e450e2c8a9", "comment": "Malware payload", "value": "46c692b2a14532237e1b7baaa61a3e3d55e36dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063466, "uuid": "4628425c-82d8-417d-b1ea-3a5a244903fd", "comment": "Malware payload", "value": "cdb854ee8c5277e52d475aaa1a61f76a81b2e0b430571f0013dca0ee31a7695a91235b4c6e5fe6277e0481b3223ff49d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063466, "uuid": "0625d1e4-501e-4a99-9ec2-7f5e95063732", "value": "T1FE564B42FA092F95C924493389A34EA127626D446B315793E754F3BFACF33060F5AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063466, "uuid": "b41665eb-7364-4f5d-ac29-014812590e42", "value": "49152:3oKbMXPMtcqR750qdNtlJNfwgLNFpnxRcKmCbjV8sCd35Er:4KbMXPMtNR7uqdNtd6IjGsMEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063466, "uuid": "08b8631d-f761-49ba-802a-38f6fbd222ee", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063466, "uuid": "e1349d06-ab19-431f-86e5-44bd8d335d95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063466, "uuid": "f1a2e55a-799f-4e84-9af8-67365f6cec19", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3ffc55-8887-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785025035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025035, "uuid": "d3f1c358-86bf-4859-aff7-23493cb47023", "comment": "Malware payload", "value": "9178cbc7e2eae63e8a491fff565d6272", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025035, "uuid": "ced298b1-97a5-41df-8bda-efc7e8871d9e", "comment": "Malware payload", "value": "977399df67a510fdb6fb6f9eb7a63a5bc8a178e0dd6cd6321c02b68c94681cef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025035, "uuid": "d10afa7c-afa9-4565-9276-39c79f3387f9", "comment": "Malware payload", "value": "4a2c8e355fccffaa60869e4e6e4cf0bc55ff0aa9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025035, "uuid": "a820ce62-21de-4636-9364-9c5d8d81f30e", "comment": "Malware payload", "value": "4f81573383017c08ababc848d5c8e7b3c40534353e300e3e420048365a7514c3521ab813ba2887125b468c827d7bf8a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025035, "uuid": "6eadba67-c39d-4d19-bdc5-0cce7ab27f47", "value": "T1AFC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025035, "uuid": "ef02be7d-396b-4064-b33e-cc99b776310b", "value": "768:h8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:h8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785025035, "uuid": "413fdfb5-6921-4bb7-8df4-3d36a2203ad1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785025035, "uuid": "0e3e556f-b453-4e4f-bd30-53f1a24cb0a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025035, "uuid": "274f4dab-a80e-4ec5-bdec-be52b0146fff", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d7e85a-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084891, "uuid": "5b493306-fe6a-4471-ac60-d0fec2a32425", "comment": "Malware payload (Mirai)", "value": "b4692e857af2a0a989aa7a11c2996a94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084891, "uuid": "d906885c-1f29-4d3f-b393-f2ae244b5588", "comment": "Malware payload (Mirai)", "value": "98570144dbe4960a18d94b729c81371f0e8177e4678f6fdb5fc3b139b5cefac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084891, "uuid": "97ea749b-024f-4d62-8cc4-27f758908e0f", "comment": "Malware payload (Mirai)", "value": "8914026cd12adef55532ab2ec9ef352bcdbe32c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084891, "uuid": "30a6e05e-9dfb-4e95-8204-e0bf0bd908cc", "comment": "Malware payload (Mirai)", "value": "f6e79a081138a3c52e73b4ae1d89db38506d4ea40ac690d9bebb6929a24f0fc8b8aec9ae8668b19e90de006d4787b02e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084891, "uuid": "ce56c7d1-b155-49c7-bb3f-b9c7b0d13158", "value": "T16F735B12731C0F07C1A35AB02D3F5BE087BAE9E121E0B685655F9B869675E33148AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084891, "uuid": "9e0b396d-e0f2-493e-9d23-f490b503a94d", "value": "1536:XdP03hQBTX2c/9vhoG8M1jgpSlktmvIFBwRYlga101om:B6SlGivhoGQpvmvIgRolQom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084891, "uuid": "e2ade0f8-2e0b-4657-8607-c95aaac9583c", "value": 76824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084891, "uuid": "34548b25-4bc9-4973-8e62-5b7209744040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084891, "uuid": "e8e60d9a-03c9-48ab-85b2-a10a98a0674b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e40847-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069095, "uuid": "3a98178d-52ef-4806-b0b1-a6fc2b16b703", "comment": "Malware payload (ConnectWise)", "value": "abbe0260e695691d018b8114dcaffb47", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069095, "uuid": "d0092bca-7e3d-4104-b026-999041d20a1a", "comment": "Malware payload (ConnectWise)", "value": "9921dd7232b1b524677996a6167fd08c41789c45d241bb8f2aaff17e4c4fbd08", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069095, "uuid": "840590cc-7ae7-4de9-bd75-75228de1431f", "comment": "Malware payload (ConnectWise)", "value": "0de4ab234ef55c5ccc27d08feab35a1ee215cdb0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069095, "uuid": "4a5e8cf6-11be-4e88-af34-050ecee59e88", "comment": "Malware payload (ConnectWise)", "value": "3df19856720e15757b81e2cc9dcc5823e178752d9f93a7b286f8a2d8cc4e32b89bb5f6e1d135d7ef082eaa5b8d58311f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069095, "uuid": "f7944864-bdb4-4750-afeb-d668777499e3", "value": "T1C2646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069095, "uuid": "bb95307c-a0b6-46d4-a9c4-7fdf8af73a20", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069095, "uuid": "2240b53c-a83f-4cd1-974b-5e62d24077c3", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069095, "uuid": "4a8d6615-4eab-4bac-8ce1-9d30ff3a4aff", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069095, "uuid": "71fd5a05-d434-4af0-9f0b-c64eec09a5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069095, "uuid": "efebae23-3ca2-4707-bc4c-75a9ae73df02", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2fe42d-88f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785070647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070647, "uuid": "39f5e7bd-a101-4425-a480-237228c91a5b", "comment": "Malware payload (PhantomStealer)", "value": "5a71c21a28192c43fc0f01a20fdfadde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070647, "uuid": "a167960c-0cae-4a8c-b9ee-c48ff2c52344", "comment": "Malware payload (PhantomStealer)", "value": "993030fd181cc67dcaa0948f536539aff5ae10bce1aff5265018aa335365e802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070647, "uuid": "3f835053-b5a6-42d6-b0e2-9fb9f4926cb9", "comment": "Malware payload (PhantomStealer)", "value": "3c8837bcb81a29e1e43556381977ec2f84f0ccd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070647, "uuid": "a9b0e1a9-55b3-40e7-881c-05173edab0de", "comment": "Malware payload (PhantomStealer)", "value": "360d4bde13fc78d2178c0ed30275e3fd60ec6d56f9357181545975cfd22b94c15a9dec86662a4fa29da7a0f7720c623a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070647, "uuid": "6cde996d-7aef-43d6-a79e-8390bd6a90a1", "value": "T1DAB5CE25A3E811B4E977D738CA559333D6B078521734E58F0699C20A1F37AE2AB7F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070647, "uuid": "4e353cd5-c53b-4332-b077-0784ea0369a0", "value": "bc5915915ad1a7296140438aea2928df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070647, "uuid": "d8f6fe96-57d1-4d2b-8eae-65a00727699b", "value": "49152:lVhnUadGMDDMiIWGrjOFKuOTV27qOvzdxFV21QOFi:2a3piMOp2ldxFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070647, "uuid": "500c8948-5ac0-487c-a931-c35b73ced8fa", "value": 2470912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070647, "uuid": "4123f06c-6339-4eb9-969a-f3e5063a146f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070647, "uuid": "14a6a7f6-996b-4bf2-9574-aa09eef1f25f", "value": "Purchase Order No. 2026IVBIOT000022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aba8ba-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785068318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068318, "uuid": "de0928b4-1c9a-45bf-a144-f4f44f6a4259", "comment": "Malware payload", "value": "b38f4661624f8dddccecda9010888393", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068318, "uuid": "077ad05a-1805-458c-9e2e-3ad2259fc299", "comment": "Malware payload", "value": "99c30d4476c1ce38b1edcc234899abe763bded155519d90266f4c7ac8efc25c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068318, "uuid": "7df53456-fb77-4a7c-a133-3b606935f269", "comment": "Malware payload", "value": "05dad69d979b444b745a016819dd38e5fe7923f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068318, "uuid": "8769b25d-5123-4bfd-8901-fecedf78ebdf", "comment": "Malware payload", "value": "359ff299fe0ebb6ff6e9b5fd8443114ce892facf940c129a136de1ceade948f02314f1943fd1ef8f41f1fe8da36228ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068318, "uuid": "9e60cc97-3ff4-4bb8-ba73-f2a87244e4ae", "value": "T19F236D6516857C14AE99C4365C7F2F0CB9AD43E6314492DE7FCA3CF28C4A6ADA208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068318, "uuid": "829e5203-ea4a-4cf4-9795-5c71566f8d5b", "value": "768:Kr9NyXsZztCg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0HusZAcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068318, "uuid": "ab903d39-f17e-4286-87ca-4a520a1d4171", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068318, "uuid": "5dd2f1d0-b306-465f-a9ab-680f274e6575", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068318, "uuid": "b8cae26a-bd13-4699-ad6c-6df52febd206", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d044d17e-88ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785054008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785054008, "uuid": "b2521055-cd47-4563-961a-f9991f1ee0a7", "comment": "Malware payload (Phorpiex)", "value": "d8336b1ff9bb24fe0e116f909e3c9fc7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785054008, "uuid": "f48c6373-df15-4b07-bd0e-9527e30c3872", "comment": "Malware payload (Phorpiex)", "value": "99eae3c904882be5ffe456421a80ffcdfcfd743958ebdbf83c4e46a7bc3f525a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785054008, "uuid": "0152973b-6907-4f01-8b8c-999457aa9d2d", "comment": "Malware payload (Phorpiex)", "value": "58d0501f33a9eaaef0daafea1707df9d84177a58", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785054008, "uuid": "b2faa93a-72ca-4376-a975-036f6f13affe", "comment": "Malware payload (Phorpiex)", "value": "df6be4cf982d084d5402783ecc720a51b21a21a7804006562259ddb483a7e6a1a7fe8287ac25e260eea8bd24b3e9ea0e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785054008, "uuid": "79679887-8a8b-4e90-ac41-53f885633865", "value": "T16E92191AD603C222E0A0417092A3EB77597E5672374724EFEFE0499B2A391D16D33E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785054008, "uuid": "c5103c7c-aac3-486e-b43b-49e616e97280", "value": "ab715c6137c66e37d651b98bf65b445f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785054008, "uuid": "8940f9b9-68ca-434c-95b6-ea70d7e971da", "value": "384:K/Jh/MnJbr75EEFS8S/9kWhuvDZAfLUOQPcjDw:IEfFSbmWhuvD2fLUoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785054008, "uuid": "69679a72-425a-47db-9eef-305cbb54f97a", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785054008, "uuid": "c4acc417-d31a-4000-85fb-ec2b37cacefa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785054008, "uuid": "7ede93c5-5a0e-48b7-a1f4-3c8942926023", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5798d48c-88e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785064113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064113, "uuid": "5adea7b0-842d-4ab5-8b95-287f24033a9f", "comment": "Malware payload (Mirai)", "value": "394f8793fa711169bde7008fa7cff071", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064113, "uuid": "618ed313-b80c-4af4-a5f2-5638117bedc6", "comment": "Malware payload (Mirai)", "value": "9a7f8288210b6ee00084f324ff30ee48eea67af6ced7f276b8d1b2aa23317b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064113, "uuid": "46d22ce6-4d60-43f7-a4a4-b91d450293f8", "comment": "Malware payload (Mirai)", "value": "65f8c7da88429f8f20e4c6947cd515fd024367d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064113, "uuid": "a2593f66-bf05-4653-8784-857150dde28d", "comment": "Malware payload (Mirai)", "value": "cc6577e6fb696d3a0c1df23e4338ba029583dccbcb76e51d35acf80a19a667c8802126febd68eed52219c00f0ea02586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064113, "uuid": "9b48eabe-15c0-41c9-9449-a1817ff34858", "value": "T1E2C36D22B5391E27C4E0947A12F75766F2F257CD14A8CA0E7E720E5EFF152902907BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064113, "uuid": "5599a85e-582e-467c-817c-65e3f3138cca", "value": "1536:UlITTILIMV1nW/cQM3PK8A6kT6ciM8GvTyEeodvcHyHq4gsawJ1Aa9St+UQPYm5t:TmXH3SeoZHz1B0cUeYOQuIX/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785064113, "uuid": "a648bd42-8565-4954-98ab-3638b13f8c83", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785064113, "uuid": "b995ef23-2429-4c29-a7b9-8db044795c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064113, "uuid": "fb29938e-190e-474e-9577-96807d2100b8", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5cf577-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063348, "uuid": "93a4448f-e451-4639-a9f1-49b59d80cd1b", "comment": "Malware payload", "value": "c78ade551d0c8bf4ea643e7a8cecbf4a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063348, "uuid": "ee09a55f-b9f6-409b-a498-a50dc0c5da42", "comment": "Malware payload", "value": "9a99a1fab980a526fe57b8e5f021832006108a0fba181b516082b44164cdc934", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063348, "uuid": "77167322-4721-4d2e-aa88-dd62a813a880", "comment": "Malware payload", "value": "50a5b85336102661cbae7d1f91eff5c3940ff3d3", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063348, "uuid": "dfc7fc77-a056-436d-a93a-c7fa23a2aa36", "comment": "Malware payload", "value": "1f9e3b00dfa6e79ad40e5dbfda9f38c061d3f9e1bce6e75577c7cf52a67ca9e225211ef5598e40a4760151d408dacbe9", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063348, "uuid": "a5c6bc51-b427-4396-be1b-ede4597da973", "value": "T13975339C85123B3BDAC41EB9A3DBB62663A2CE17072101133F2EB6589DF74C51D4B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063348, "uuid": "79b2f287-0ad8-472b-ad3b-009a76595d41", "value": "24576:l07bLhLVJxLnvsxC8uOI1sVKu205TO3uQ4yjQvQQOROleYPGCfGOwDkR3ZBB:KpSxsi/TFMQoX0u2pFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063348, "uuid": "baa451e2-cfa4-4829-92c7-4ab6660e4673", "value": 1689528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063348, "uuid": "a3e62f26-b955-44af-9a9f-8f8e4891538c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063348, "uuid": "56de8808-7568-456e-a453-5476fb0715f5", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c07b817-88bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047263, "uuid": "007feb19-6f94-4909-8917-15826589b47e", "comment": "Malware payload (WannaCry)", "value": "f6ed2d18961a10d7f3683f68ae2f9645", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047263, "uuid": "a231827d-89fd-49a8-ace8-dd20f0d6a80a", "comment": "Malware payload (WannaCry)", "value": "9b845a21eca8799253ef65d7d218e8e7a404e1491951cf64105c25c19c2d484e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047263, "uuid": "2ee88674-c41f-40b4-a247-c6ec5e8e717d", "comment": "Malware payload (WannaCry)", "value": "8df947bc316beaa2147abbcd25f797c16319c010", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047263, "uuid": "c230c01a-2261-4232-a185-eb4fb5767566", "comment": "Malware payload (WannaCry)", "value": "ac940239dda02fd1cdd822a4915f9b916ebd847cee262d32ce60d49d66d0dff55128bf4673ac34844eeb665c965d1167", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047263, "uuid": "e0e5211f-bab6-4798-a04c-c62144d5c2ab", "value": "T15D36235A32BC81FCD006267944B78E27E7B37C9A12FE6A0F8F4045AA1E13755BF64742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047263, "uuid": "4b4872d0-bd57-4c4b-aafe-76b484105764", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047263, "uuid": "4b6ed0ea-62bf-4040-b07b-14ccf1b0e255", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DXDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047263, "uuid": "b87d44ab-175d-473a-96f5-810433513dba", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047263, "uuid": "b248953d-5e18-4578-8d7f-f6d4076b4d74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047263, "uuid": "e8ed1d28-b7bb-4142-9422-b56eccd99b79", "value": "9b845a21eca8799253ef65d7d218e8e7a404e1491951cf64105c25c19c2d484e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f37ee71-8888-11f1-bd95-42010a9c0009", "comment": "Malware payload (Worm.Virut)", "timestamp": 1785025418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025418, "uuid": "6b4195d2-2e89-4426-b5d0-ce224a2ad4c7", "comment": "Malware payload (Worm.Virut)", "value": "c41d08dccbffc2447d518b80726303ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025418, "uuid": "922e450a-60bb-46ee-8773-8ec32538ee74", "comment": "Malware payload (Worm.Virut)", "value": "9be1d33e17a0048a7b145cdc604e60048dc8bc26decd065ec3b5404a58bce9ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025418, "uuid": "0b043174-0dab-4d54-a4b3-760a41ad46ab", "comment": "Malware payload (Worm.Virut)", "value": "de31dada1dcffe49288518afb66c321ee2a96263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025418, "uuid": "0ba4e6b0-9055-4e7d-a8be-d78047fa6803", "comment": "Malware payload (Worm.Virut)", "value": "dc1dd05bb58c064445400589d5df7a8524c86423d67d6ae1fbc962dbb7bfec25773fa1f8e0f464d6267b4c1e8094ada2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025418, "uuid": "72911dcf-efe1-4381-8771-1be2ed0cdeea", "value": "T12DE3D02572E080F1D1AE01F425E95F7BDF3CE67241359A93DF98E9962E24CE0E12734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025418, "uuid": "c1e1173d-c193-47f9-bac5-547a32f6a541", "value": "60d4babbb56c8e3577a277a2e561f73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025418, "uuid": "2d3ab8b7-24b1-4db9-9989-eaa2a64acfcd", "value": "3072:JLXIQ7qz1YneW+pzYMvfXjuek5oN4Oh+UyBsEN:JLxoWUYMvfzu5issE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785025418, "uuid": "109709a2-a7d9-4138-b1b4-4c61bad5b0fd", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785025418, "uuid": "34bd7da4-7f0d-4bde-8c73-6f59f33f488f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025418, "uuid": "392112aa-0acd-4faa-b854-df6291667c4d", "value": "studiomdl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257ec939-88bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047279, "uuid": "4dbbc6ab-c92b-4831-972e-2245417f6c74", "comment": "Malware payload (WannaCry)", "value": "846fd66b3869f763ec131f18bec3468d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047279, "uuid": "0babef68-62cf-4598-ba48-c073ea16b4a7", "comment": "Malware payload (WannaCry)", "value": "9ed8f01f35c2635b26d24b8055828dcecf789f225e212c95672db1919f735aec", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047279, "uuid": "e4ca6e2f-f91f-4484-8abc-ef89d2091dd4", "comment": "Malware payload (WannaCry)", "value": "0008035850df2b3808d1674e0ddd280ee5fbb980", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047279, "uuid": "5b9693f0-8f8b-4ff8-95d2-a7160f4d0039", "comment": "Malware payload (WannaCry)", "value": "725662dc8f0f3ca358e4178c94e9f36290be00fa630411517b9d9c5f5bab22d061110de9d5fa42273f687fffc2d06223", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047279, "uuid": "88563b25-23cd-4829-b093-6865be10eb30", "value": "T19936235931B880F8D206257484BB8E12F3B37C6A22FA6A0F9F40497A2E53F57F754752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047279, "uuid": "2cfe7074-f405-4acc-8c1f-b912ac554713", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047279, "uuid": "2bf25393-41bf-47a3-b68a-279ebff3f4a9", "value": "49152:jnsnvMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMvPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047279, "uuid": "9125a290-1341-433d-895e-80c94ef8b09b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047279, "uuid": "4707dff9-0ffd-44fe-b7ea-ed654ec6c013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047279, "uuid": "ba17d30b-2e32-420f-aafd-671abd713964", "value": "9ed8f01f35c2635b26d24b8055828dcecf789f225e212c95672db1919f735aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3a971a-890e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785083103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083103, "uuid": "81ba055b-a0ec-40a8-acb4-9406376bcc5b", "comment": "Malware payload (Mirai)", "value": "cd87ae21eaa978e96d0fa62dae7be5c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083103, "uuid": "107b286a-4aa1-452e-aa01-09acc7fb69df", "comment": "Malware payload (Mirai)", "value": "9eed50991069462889815379a57a3b3462934652142f74a4aeb609e9176c282b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083103, "uuid": "17f8bd6b-81e5-4b97-a2a9-ba77cc299bbb", "comment": "Malware payload (Mirai)", "value": "7914fc7f5b1d341b9e0e48eec381e8a234cb58ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083103, "uuid": "1425c913-a53b-4b70-80a6-64209a58cfd3", "comment": "Malware payload (Mirai)", "value": "8f0b890fdea20cd785181d509dd7c25d7287a35d4c0c0ddce9ae4ba825471f93744e4b42728d75e89d6d6564e3aed099", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083103, "uuid": "66fa40a3-c4ee-4573-98a8-a4155ea407c8", "value": "T1B82183C000244ABEED839E48F37B49C8E65D01E7FE427E9AD598042EE55CD78E1CD2D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083103, "uuid": "0917d47a-a194-4c94-8529-661b32ec802f", "value": "12:MCdvWIAWAAKWeNIyJ8WDfKiAW3vWkHWnW4H8WSWGWpW2n:HY8peNIczKirOfW4HFJQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785083103, "uuid": "27f54101-6183-40ba-91ef-e6701e1b7b1c", "value": 1249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785083103, "uuid": "57615211-0c3b-4a1a-85b4-bb12a97c96cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083103, "uuid": "e2a0ca53-6be6-444f-9327-5b461c875d31", "value": "busycurl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baefa166-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066857, "uuid": "20591297-a8e0-4c88-a7cc-84b93aadda4c", "comment": "Malware payload (Mirai)", "value": "95de0c27da24ce350e0d559fa344c1ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066857, "uuid": "5c09b7ff-6a85-426d-8bf9-3e8faccd718a", "comment": "Malware payload (Mirai)", "value": "9efd64b91e0783ebd87bc855b9ec2864f77bb060a413d0d7fb278606a34c16bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066857, "uuid": "0d12bac7-d654-44a5-bb10-8eb3a2742f02", "comment": "Malware payload (Mirai)", "value": "ba6e269a3c1047de1ce19e05f68b716fd92cc159", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066857, "uuid": "69de0686-5abe-4710-aa2d-ab9fa06f0fbc", "comment": "Malware payload (Mirai)", "value": "80996c08b899612c912ab31648249746051bb13ee312bf357b44d013cee8584c253b6d884a316b333321bde08a868af8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066857, "uuid": "9eecd845-8759-4773-bca7-2319f61761e7", "value": "T11343F190D49FCE85FFE689300E536CCA7FF20B8503A44E615615F3C5EA6AD392708B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066857, "uuid": "1352d548-4be6-444d-a056-53cd14c9d1ec", "value": "1536:AICBahBECNqv1SBY1BbVRGxtTnw4u+qgw09bv:AICONuIYPpOVw4u+qgwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066857, "uuid": "99cd9964-022b-4c35-9372-5a62eb60892e", "value": 56916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066857, "uuid": "b2a872bf-f26f-4d16-86a9-d8747b0d05c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066857, "uuid": "4de13545-627b-484e-8fc6-ab05fa70cde5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5965cb-88c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785052931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052931, "uuid": "981c7b67-4a46-4125-ad8e-f2cffc5df559", "comment": "Malware payload (Mirai)", "value": "7de221c7ea9b8066d04a8ab6f1a33ac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052931, "uuid": "13f9a64b-d119-4bf5-8c5b-ea2c837be267", "comment": "Malware payload (Mirai)", "value": "9fc7c1415d9a5c5343aa39ce761a8b381e7248c4e5fc38e014c652dd68222cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052931, "uuid": "2f56817f-92ee-4e25-9f9f-2a647c3ee098", "comment": "Malware payload (Mirai)", "value": "a5ede533d41d8cafe36189a4ae85d56a0b408c09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052931, "uuid": "72fc6b07-8a8f-479e-98f2-c3e862657825", "comment": "Malware payload (Mirai)", "value": "6e9a16e34026f0da1345826f2a6a54624d70d16250829d7df25a05d9b9ceb53a0b51fc90809ce5c4232b57389b1cfeb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052931, "uuid": "73db0732-3d95-4780-888e-4b82ee2c308e", "value": "T159A42951F8419F96C6D12ABFFF6D828C731317B8E2DE71129D1A4B3063DB85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052931, "uuid": "dc319ce9-4940-44ed-9c3f-2545d9e32efc", "value": "12288:mCMHJj+whyPwsAHkvsZeDUkwcZKczpQfqh48Pjs064XGOh0Cje:hMHJQwDdkzLjhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785052931, "uuid": "bd66c649-580a-4ef7-b2e3-552cd1a823a8", "value": 492320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785052931, "uuid": "72859627-ee0a-4711-9437-f3dbe7b0b48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052931, "uuid": "6609baca-245d-4441-9bf3-89cd59a6eb65", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3359a302-88e6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785065771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065771, "uuid": "7ff9a63e-7aaa-4423-93d2-6b676cba4ae2", "comment": "Malware payload", "value": "44208c037d62fa9a0528450b6fbed316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065771, "uuid": "2d806814-dd5d-4822-8cd2-7af2833f7894", "comment": "Malware payload", "value": "a0427a2cdd11cbbc5a5e79d5fe3c79a5922540bd75350edee8423facea489783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065771, "uuid": "034c5165-2630-48fb-b0e2-41dbf1842163", "comment": "Malware payload", "value": "f06168fe8808567e1c3a2986bcf355160268024d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065771, "uuid": "85fa36bf-d386-4dc9-89cb-fc07343a0985", "comment": "Malware payload", "value": "a6aa021734368a1d2c9cdab40b3edfe54d3f76ba10f08e1718e383b01c0d7fa3952226550c144195cbc47db17457282b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065771, "uuid": "ac5e687a-addb-4be6-825d-3916e8c60e16", "value": "T166183321855206BECE55AF3490F1A33641BFBF76AF30A13F09A6B58DAD33A4B5470C16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065771, "uuid": "dcf09439-2fe1-4be4-8e86-6d4378be6054", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065771, "uuid": "49d26f15-4b93-432e-86dd-4fee59616fa2", "value": "1572864:vge4hdV6xfMCginFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzS:vge4DoxfMCFnF7z3V7vl385ySor0TzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065771, "uuid": "4ccec32a-d963-4021-8800-741c9b976ce3", "value": 90262056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065771, "uuid": "7afcd1f2-b304-465b-a7a1-84d8e8706335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065771, "uuid": "9b5eb188-6253-40e0-9ec7-02e3c0d82fec", "value": "Windows_Update_Assistant (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01883cc-888a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785026520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026520, "uuid": "67b12760-a9f8-459a-a956-6df220c3cda2", "comment": "Malware payload", "value": "ffffd8a2d7379f4c9dd76a242e2ab5dd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026520, "uuid": "76f01af4-86a4-4a84-964a-35f16f240076", "comment": "Malware payload", "value": "a0e0ed3de12c74a73c79f5ec6beb9b73d663d7795ff90d2159a183c9af153975", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026520, "uuid": "06b0d1fb-ef29-4ee4-bfc8-917d58b6b884", "comment": "Malware payload", "value": "d375cc63e7a5db89997eff43a4c01192021cd334", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785026520, "uuid": "d8d1f485-dd5b-44eb-89f4-34412e48e6fa", "comment": "Malware payload", "value": "0fdd0addc44b48e7415532f1b843527fab68065bfb7c47b159d597484193b932499ef02a61fa80fc94e461bffec50166", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026520, "uuid": "20e2f20b-82e1-4972-9488-1f16dca2e000", "value": "T146235C651A857C14AA98C4361D7F2F0CB9AD43E6320452EE7FCF3CF28C5A6ADA10572D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026520, "uuid": "42cb4967-d7f4-40f7-8afe-f14dd8e69556", "value": "768:yt6Utd8/k9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785026520, "uuid": "eec2b70a-9da0-4284-9ab8-740801910b1d", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785026520, "uuid": "1b96141f-b071-4a4f-bad6-60c0722fb262", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785026520, "uuid": "61dfa0ee-8afb-42c8-a70d-2361f1e940c5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec0cc70-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785077977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077977, "uuid": "111b8937-2a11-4c24-b005-e3f2eec491e8", "comment": "Malware payload (Mirai)", "value": "2764731ee2301a4d79ffbef5a6fdaea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077977, "uuid": "a5600435-c956-4c9f-b137-33902b2d9432", "comment": "Malware payload (Mirai)", "value": "a0e4003948b35be1f7f5634d4209c4aadb3b0928d308121666a1a7893e0b57c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077977, "uuid": "cb7a2533-0df2-43ad-9d1a-05755ac4c232", "comment": "Malware payload (Mirai)", "value": "403f78ec4c263491f1e2365029514716dbf9427b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077977, "uuid": "605a2139-6f38-4bed-a3ef-69dcc9ea19a0", "comment": "Malware payload (Mirai)", "value": "79b6b97a56882b094240b237185a8aed5ce90eccacef97c7c49f04305b18da8ed38f680daebb8c9e87ab1dd053c20991", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077977, "uuid": "3b4adfdd-5c54-4e4f-95ce-c277c881d020", "value": "T100A3B81F2E319F6CF2A9C23487B74A349A5C63D123E1C684D5ACD5012E3834E995F7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077977, "uuid": "b8f4dd16-ea5c-4720-959b-588fe3bbbebf", "value": "1536:NCub5ZXBcph271Pi86YENxF1lHEdLv8S7NB0TFHLMwaX0KNe1yBCp:gWr71Pi86YQr1idLvoTFHY5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077977, "uuid": "4f1475af-c3e7-4e86-b7d5-739aa3823b13", "value": 101212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077977, "uuid": "f8f39e78-3659-43d8-8e5f-a12d800913cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077977, "uuid": "7bb472da-9c25-4c01-b5e2-752ade320c21", "value": "xCzb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8897a24-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084892, "uuid": "b3c44007-5e38-4bf1-806d-32bcaaab2147", "comment": "Malware payload (Mirai)", "value": "eae2ef80a91a523e0fd838599786e139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084892, "uuid": "7eea8017-3286-4fca-ab25-0e80c73a6b86", "comment": "Malware payload (Mirai)", "value": "a10a821803d7d45d4bc717cb2ef1732a667b4946b6d08574d85d93f9995c005f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084892, "uuid": "e79ced80-8a0f-4fcd-aea9-7fdfb3a158c1", "comment": "Malware payload (Mirai)", "value": "7fc67e4ac93af344613a7895423aa115da325c78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084892, "uuid": "4a61144d-7339-4e87-87bd-f5e1d2d52ee4", "comment": "Malware payload (Mirai)", "value": "1aabcf3b41e63ee56f11c26a5432910b191d2bf58ea997e4231d23d64a9083b4af90d38e4fa6a5d25a16e4e9194b4553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084892, "uuid": "6ea07807-ea16-4e04-8fe6-e44b1281bfa8", "value": "T1BC93E71A7E219FBCF7A9863087B78F11975833D62BE1C681E19CD7015E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084892, "uuid": "1cd635b1-3018-4204-bc7a-aca1b99e76b4", "value": "1536:1rmMsokpLvr/91q6VebvH2xelfNVBL1JyoaWTZTQaet+rJa10Z98:HD+LD/91BV4vHPLJyoaWTZTQCr4E98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084892, "uuid": "45dfe00f-4b57-405d-bc8c-b69b4ae3feab", "value": 97660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084892, "uuid": "156e716d-03ab-4928-a1ad-c67786ce5b3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084892, "uuid": "15915be1-3ce5-453c-8b19-072aff51da1f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b8283d-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785104726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104726, "uuid": "c2081a31-3e15-4f35-b57f-7e373315e929", "comment": "Malware payload (LummaStealer)", "value": "3464135169dd3733163a502f959014ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104726, "uuid": "07b5b51d-9ee4-4f7b-8503-d1774f0bb9dc", "comment": "Malware payload (LummaStealer)", "value": "a1101793f851eb22dcffb2533be05bfd016e73b35e1ad2e35fc0d71d5099b52b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104726, "uuid": "74b36c6d-1df3-4a80-bb12-87050cc35893", "comment": "Malware payload (LummaStealer)", "value": "d560a3f7c5cc9ae8073e9e326fa8f85fbb60555e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104726, "uuid": "dc787edc-f2fd-4bcb-a161-5ad7a863a726", "comment": "Malware payload (LummaStealer)", "value": "e43ecfb2e0584f94a46d326d75e85a989a407b4c9dd4f3cab9f6cf1e02a4b77e57a44baf04e36010b432240816dbc752", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104726, "uuid": "4aa3ade7-e3ac-4cca-84d3-794f8b4e8b64", "value": "T15CD55A41FEC744F6E502163154A762AF2339AD065F35AB97FB443A7DEA372D6083320A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104726, "uuid": "82326655-f4e7-4d11-bfd2-f7201ff0c46d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104726, "uuid": "26bb3ca7-a78c-4cb1-8b38-ee30fc7afb0c", "value": "49152:7sPlpnJ3IdsH/cIE+7XiR/ljQS735AbQh6:4NpnpgsfTa/eS7Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104726, "uuid": "72d3ea93-5702-4b5e-924d-43f9681a22e1", "value": 2825064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104726, "uuid": "c1b3cd58-c3dc-407d-8b82-0300784281e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104726, "uuid": "bc7d43e4-790d-4c8f-8e70-17e97118e901", "value": "xqAAE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142133f7-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785066148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066148, "uuid": "ee382fa6-c463-471c-957d-cefa1b1cc324", "comment": "Malware payload (JackSkid)", "value": "a816acd165af4d2fab9f7456a89d5cd8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066148, "uuid": "834f69ea-9ff2-4dc5-9079-449ac23263a0", "comment": "Malware payload (JackSkid)", "value": "a15e50a753028ff9db51885705d6348113dac5b653cd2bd00dcfd8b97da7566a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066148, "uuid": "0163f58d-05db-4e33-bf3d-81511b7819d7", "comment": "Malware payload (JackSkid)", "value": "e52d09385ed4289d5219e16a4d7edb03413a3072", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066148, "uuid": "8a601df8-f8dc-4dc3-842d-de0cddeef2f2", "comment": "Malware payload (JackSkid)", "value": "5afb1b814b8eff086e0ce25988ddb55f95fd55529922b51e20a0039c1670424e583677dfc33c06058801b3f141c0b9e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066148, "uuid": "2259656a-bd3c-4da5-8516-ebe817b00c69", "value": "T1D74412B1EB358908E99B1D731ABF6330822426208469D14F4D09F3F1673235DA782F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066148, "uuid": "c3fe8f86-8979-42dc-85ef-ebc5f4715716", "value": "3072:ycvY6Hy8bGPSsBf0gUC4NPee6amkXA8phswr6naSu+8X4tslDS0RqY3z+xBCNut+:OMySGreee6aPdhvrz+2zVqEz+rCNuZlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066148, "uuid": "82c876e7-a247-4296-a5c1-3c052220b677", "value": 261735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066148, "uuid": "df753367-4200-451b-a1bd-ad6b63577743", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066148, "uuid": "36358bbb-58ee-4612-8b33-1105c7a73e1e", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfac673-8928-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785094135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094135, "uuid": "ea077732-9b3f-4af8-ac41-509f52885d27", "comment": "Malware payload (Mirai)", "value": "8b4921807b9cff4d7c6ff7ac6f338d90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094135, "uuid": "acf84a08-94bb-4b9b-9dd6-de810d53cb29", "comment": "Malware payload (Mirai)", "value": "a1603956bbcef1b38c55082a22754f04203fae16b24b7ad868413184ba68a08b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094135, "uuid": "4e6ca244-92bf-48d5-bff7-99b69efb514d", "comment": "Malware payload (Mirai)", "value": "83cf27b425d8b826968f7ce51eda4c9096b082ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785094135, "uuid": "d47c9494-b9d6-4210-a51e-055e03b1743d", "comment": "Malware payload (Mirai)", "value": "2f07d3d36dc34a742dddeba9a7df9502af8dd389c03a7f290446a18bc7be64ffc567f3661723af542e44e0e7d63f0875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094135, "uuid": "fe1ed0c4-d7bd-4720-a906-f9f3e1b70299", "value": "T1A2144AC3F900DDBDF80AE33744134916B130B7A214925B37B297797BE93A19A0577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094135, "uuid": "54783ab2-be8d-4ec7-b1f0-ecb38148f4c9", "value": "3072:IYvBkWzBnJcKu7Lpn90LyQQraqpWlIgOeLD3dVpjbidL0EfrPy9fkhKTD:dBkWdJcKJDQraMW82D3AL0oy9hTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785094135, "uuid": "b28bc501-743c-4993-8a34-d107e1fc2a64", "value": 191040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785094135, "uuid": "0d2cecc0-0adb-4c46-ba23-56540ecbc2ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785094135, "uuid": "b58a6d3e-3c5a-4903-9451-4bb9c52f9a07", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca01d8dc-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785051420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051420, "uuid": "d8013dbd-994e-4930-9dba-c60fac916b30", "comment": "Malware payload (Mirai)", "value": "487010d653611feb9f49f42b40ce205d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051420, "uuid": "75dd41fa-a5ab-4a13-a9c7-301696c4d8e2", "comment": "Malware payload (Mirai)", "value": "a1cdc3cadcb555302659c170e7a91e4d6e855640c1ad07c2a8239524694f6410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051420, "uuid": "149ab799-3345-4152-bd2a-027057e151eb", "comment": "Malware payload (Mirai)", "value": "fa1cbbffe72871d0c31575509cfdad60376857a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051420, "uuid": "ee4c85c5-9178-427a-a36f-2f398f1a6fa8", "comment": "Malware payload (Mirai)", "value": "b88763375c8fb0008124319708ab2c2661579dc89e7968b731967df1877c1d0642b7fd5d7b1fc4e05b2706f99d2a9204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051420, "uuid": "aee71430-f82a-4af2-b702-d918ccff3273", "value": "T186A42A56EC40AB95D6D12ABEFF1E824973131B78F3EE7211AD055B3063CB85A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051420, "uuid": "e235b97a-1c71-4009-a050-36b09a49389d", "value": "12288:N1sbxlkY0BkzARM2nOJy8r1fkmu5rLeJgC16a/BeAToI0dUx:rp562ZvP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051420, "uuid": "50411034-518d-4c65-ba71-f61dd823fc74", "value": 477276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051420, "uuid": "2f3ee329-a4e0-4904-b2b3-19a8d49319b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051420, "uuid": "b15e36f2-84c5-42b7-b665-248e0c05ee01", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8766e8-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069173, "uuid": "fae213f3-c07b-4314-9845-52deb30e4127", "comment": "Malware payload (ConnectWise)", "value": "cacad1f7b2592c3aee7f573e2dcd018c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069173, "uuid": "500d0bf6-285b-40bc-b415-99df15582b8d", "comment": "Malware payload (ConnectWise)", "value": "a2efd4271470e80e09967366d99b96d47ffd2dc127efc8f276f7230619ecda6f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069173, "uuid": "7475af7f-a7a0-403f-90c7-d2ba4d638a37", "comment": "Malware payload (ConnectWise)", "value": "680898473b34cc17545260a87652402b1041cc6c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069173, "uuid": "ada90630-0df7-4fe6-b829-9e9ee63811b3", "comment": "Malware payload (ConnectWise)", "value": "ec4aa26b12c5d4888030a7523f097dc6ffcc34489e796015bdb9072a85eb389db1e26343c06a96663f731af9afb58480", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069173, "uuid": "cfb21cef-59ed-4159-94d6-e8fa0af0b2d9", "value": "T10B647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069173, "uuid": "451697e0-e17f-43e9-ae32-bf3f036db7a6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069173, "uuid": "6f781810-6482-489d-80ab-81f02f97d349", "value": "6144:qmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9l2:Z1iw7gryNkSV1hy1Z1u2JLu9l2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069173, "uuid": "22cd3979-b9a7-4e2f-83ce-b838afb17432", "value": 312520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069173, "uuid": "02616d94-c019-4452-b0e6-6b59457d5b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069173, "uuid": "9ca4e816-c787-4a23-9973-9190b820915b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6820faf-893e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785103786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103786, "uuid": "1642c69f-c19d-456b-8716-2570025fb59c", "comment": "Malware payload (RemusStealer)", "value": "42264ef4d8637bc58d406e5e96622c8f", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103786, "uuid": "ab82eb27-7a0b-4455-9fbd-316098e78262", "comment": "Malware payload (RemusStealer)", "value": "a3e15e1e942f76b3d30cddd9f6cef8c91206b1a179871ce751613bf6efa2be5c", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103786, "uuid": "975fe9a8-23b3-407c-94df-3464a36f88f8", "comment": "Malware payload (RemusStealer)", "value": "6c3b7823087376206785d4d0a00465831b6d2894", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103786, "uuid": "908fc881-16f0-48cc-b179-2159101c4505", "comment": "Malware payload (RemusStealer)", "value": "a705c13938586a4dc1b2fe4234c73e611ddb067eef46321b2ecebd89ca283281781a0549e818822584cfd58f31857a3f", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103786, "uuid": "3c83def2-f43c-4493-9f22-44a7e1f5c93e", "value": "T1BDC55907BDA108E6C0AAA33189B352527B71BC085B3633E72E90B7782F727D16D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103786, "uuid": "5a873461-dca2-4a79-b209-2d244705f601", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103786, "uuid": "57a107b8-c61c-484a-88b6-05c0f89b087b", "value": "24576:ejHS+SZdr6H54MSdVnW+Von5gNqwXiQrG4eHphobjFnc/GfTM6PZoBele5I9DUA1:ejHLOrHMYVnWZn6kwbSIjpc/gTFC9+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103786, "uuid": "9dc82593-9556-496e-9fe1-852bcba15bbe", "value": 2611056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103786, "uuid": "09db110a-6ec2-4404-8dbe-5e0cb822c3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103786, "uuid": "7dbf85e9-0dd3-401a-a6f5-2eb8e9dc1598", "value": "arFtU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ed81f6-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069862, "uuid": "c28b0b5f-eaef-422e-b9c4-cce07edfa3d6", "comment": "Malware payload (Mirai)", "value": "d5509e75a4ab4484e85045a73e1c9c7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069862, "uuid": "f461ad9f-29a6-4513-8a11-b6122ac67eda", "comment": "Malware payload (Mirai)", "value": "a437229c5c316622d0de2ed567ac72a8f00dd987dedfe235dd879a68d0e5c575", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069862, "uuid": "39e6a8ad-a204-4777-b89b-493317c3b7b4", "comment": "Malware payload (Mirai)", "value": "a147ed6b60a1cc25769f63bc3cc99e48d6ac1181", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069862, "uuid": "de2bfca6-33ff-48a6-8cf8-56cdd3f3b1d7", "comment": "Malware payload (Mirai)", "value": "d13911941cd893737dfff99eaa607c3968451719d8097faa538543b1013579169fd1bb7054361e16d7d8f89976db094a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069862, "uuid": "c78bff26-971d-4ae8-b671-cb551680af44", "value": "T1B4F2F18739E40C07D6620B75536C88BD086708C998BC97EB8EF83E933A5E171E47D22C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069862, "uuid": "9e9922fc-b70c-4b4e-b395-6f3eb5bf674c", "value": "768:BjbIhtIMgia8nVAagbKPSxLIbXVPK6oHFCjmIBsUf2kf9Cs:BjkhtjgiXnVAaiaMoVi6WBqsN6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069862, "uuid": "7d452f79-16fc-4f6d-9d9f-87a2d62d073d", "value": 37396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069862, "uuid": "d9c65216-2792-406a-88bb-14d9d046f000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069862, "uuid": "9b91fc36-2027-474f-b3ed-82b38bf72c53", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9623331-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785068546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068546, "uuid": "4f71b695-4f50-4eca-a123-9c71ae1a07c6", "comment": "Malware payload", "value": "5e6e168fd858a984355f2ff9e5bdc7af", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068546, "uuid": "ad6031fe-a70a-4695-a13c-08f482e87e50", "comment": "Malware payload", "value": "a46498efd8fa09c46fe450dd1f0dd71d678e393141d8753659d13951a6400b0f", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068546, "uuid": "651d1ff0-8aff-407a-96b7-20106bb586b8", "comment": "Malware payload", "value": "b6e18b8849aa687e5908fdcd201363343ecbe5f2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068546, "uuid": "ee2dc65e-54fa-4dae-a71e-fe0718327cc8", "comment": "Malware payload", "value": "be3bf7e417d86fe2c1de8712cc735da659df75bde7caa38d1e5e500fb6d27a262d361797397110c25efc4af2e47dd836", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068546, "uuid": "b6137f41-4951-4991-93eb-ed7a6925bd37", "value": "T1DC647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068546, "uuid": "9b0f6df6-6771-4200-a8cc-1ea5882c988a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068546, "uuid": "4913ad83-9104-430e-b7b0-26052c84de83", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji98:R1iw7gryNkSV1hy1Z1u2JLu98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068546, "uuid": "1607ce30-0ae9-4e7c-b484-c1b191c68fc0", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068546, "uuid": "45763423-0698-4686-9fc3-58830ab6f2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068546, "uuid": "64523438-dcfa-44ea-8bb1-a0077bcb1ffe", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55295a13-88b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785045641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045641, "uuid": "c1921450-e6c9-4c8e-a090-79a7b12d90b2", "comment": "Malware payload (Mirai)", "value": "bd50c85d78ea50d3ac93820dc4c70267", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045641, "uuid": "afc2f1e3-732a-479d-b144-827bbf80a990", "comment": "Malware payload (Mirai)", "value": "a64aadbc9c68fad12433ca75b2ded3c70db9a73ada83c7abf4882b04cd91f500", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045641, "uuid": "2838ce85-3466-4c97-96bb-2d40ecf997a9", "comment": "Malware payload (Mirai)", "value": "03f8e5d533a2889978489c683a42a3f1611cd12a", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045641, "uuid": "0335f5d1-b804-4b92-bb24-607cabac2f45", "comment": "Malware payload (Mirai)", "value": "0cfab3f17a5d70e29eeaba16f8fbba8811814bb2ae66be636017c233d3c8867e4cd1f971af6db3a115c58d594425c98a", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045641, "uuid": "3a24d303-6546-4ed9-9124-7081ff0cee4e", "value": "T1EC03F795BCD29A67CAE4237AFA6E428D336173A4D2DF3213C9211F00778A51F0D7BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045641, "uuid": "b839fe48-fef5-444f-97cd-8ea0636e35ab", "value": "768:19lVet+VX8flFcXTmHfwK/hAbw9Wk2AxCE1Ba0rGPr747zoVGLPN:JQ+VKODOmk2rjPr7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785045641, "uuid": "cf74e535-c8bd-41a8-bde0-22bf9af3afc7", "value": 41324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785045641, "uuid": "33925725-82b5-4820-a143-4e6bbfff2b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045641, "uuid": "a3549b8e-e120-4f19-91e1-3bdf51f676cd", "value": "a64aadbc9c68fad12433ca75b2ded3c70db9a73ada83c7abf4882b04cd91f500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c85f4cb-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088254, "uuid": "1cf4997a-c9ae-4628-9692-dc18cf0630c7", "comment": "Malware payload (Mirai)", "value": "c1139b92a229e3e0518ca68d2fda8b56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088254, "uuid": "1b4d5ce6-8366-4866-8968-6a7d04e937da", "comment": "Malware payload (Mirai)", "value": "a6692a10fb6447fd6dfb13957b279628187b87ccda15ee5c2dc6bf1ad7d39b99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088254, "uuid": "b7f795a8-fce1-484e-a20c-336297b2aedb", "comment": "Malware payload (Mirai)", "value": "b7f1acaac28b68d9420d5a72717d13234137c694", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088254, "uuid": "ec944fd1-878a-41ee-a1af-f08d610054e7", "comment": "Malware payload (Mirai)", "value": "d8d22a3cf4487c07e6c26d2b609ac6b516f3e0ddf4deb7ed7ab2c49e6ef16255bd11c2f1a6294ffd9fa6ef1786b57676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088254, "uuid": "5b684588-38b6-4f01-85f0-9d65a3f744e0", "value": "T149E3BEA7F74B20A1C96302F407CB7BCD6E6762825F5B95E36C6B743B593A0DA0402BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088254, "uuid": "fc6c7fff-1bff-4850-90a5-4608f762108a", "value": "1536:Yjhi4JtjKxkpJSny7QhYlOZjQ9caeEeSycZACV/hToteTMvL9O9xZJzD3gR7x/Lw:YjhiAnwG689cNE9UCZhT2L9OHDgR7xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088254, "uuid": "b44dc6e7-eb39-428f-a8e7-841bf0fb3fc2", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088254, "uuid": "00037fba-1e83-4032-be4e-c82e0f7ebc2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088254, "uuid": "94711c68-7e85-4296-b437-bd182ae822e5", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d80c9ea-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "01d230f1-e786-479b-8c63-62579c75e913", "comment": "Malware payload (Mirai)", "value": "eca73722cac02810ddef7a82d688a0f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "fda98d93-e812-4d45-9dca-9d9449e8743b", "comment": "Malware payload (Mirai)", "value": "a87d3711932639bfb8019cde78dbf2bcfd14ec3b33d7a3322c2f0426e8d321c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "70da81ea-684a-4c02-90d1-eb66d2a026af", "comment": "Malware payload (Mirai)", "value": "bf30f23f04b70d7cbda9fe3c45769ea343931ef6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066137, "uuid": "c01bcb0e-9150-4ffa-8ae0-6d2dc47b538f", "comment": "Malware payload (Mirai)", "value": "d72d1bb080ac7673cfc396fe7d94f9308a2ca31f522107cbd8a780f596924a3109f174d01ff5d13aeecc5509b603bd03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066137, "uuid": "0c0d216b-4a3f-4154-96c5-f5026c7dde9d", "value": "T1AB931A81F8C745F6C807493450A7F33FCE32E47A813196ADEF99AF36DA77601911229A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066137, "uuid": "ca55e577-7cef-4b70-aafa-908c7f9e45e6", "value": "1536:8qut0gR4/HEI2E1pMphR66rAm1XJmdfptWxix9FMWYMwrbHZYV9QYgeDIn:8quugR4H2E1pMrR66rAmJQ0UxwBNe9QP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066137, "uuid": "57efbbc5-c0fa-4bcf-aa61-7b30f3c0d7d9", "value": 90896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066137, "uuid": "413af2ba-91c8-411f-b0b2-1abd527ac414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066137, "uuid": "97d1002d-0aa0-49b7-b0f7-4568122d2ced", "value": "MMaaRRiiOisecTanee.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baac5cd-88bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047343, "uuid": "aecd2d1c-f23a-4a9e-bfd1-dfaa2cb4b421", "comment": "Malware payload (WannaCry)", "value": "f5ded90ef3ab418b2c9fd74e03d1751c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047343, "uuid": "5a166aa9-d173-41ae-9a34-0aa013d76bcc", "comment": "Malware payload (WannaCry)", "value": "a8831b07fcc8a073c3bdd1b7004609b6773130162eeba167257a3d6be8da67c4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047343, "uuid": "81488a9d-73dd-4922-be57-b90b386be688", "comment": "Malware payload (WannaCry)", "value": "c63acad39c00a0cfcb189e2f927bf17539ceabbb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047343, "uuid": "be8a8c42-42ab-42bf-aa6c-013b0191d5d3", "comment": "Malware payload (WannaCry)", "value": "967a29ff6fc8e9b5f2c520c706cd94860f85806d1244fae12fc9a110c23d6246a4b49253e77064f5ca57a15e807e1388", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047343, "uuid": "c9a2d946-d4bd-444a-8cff-bc64b77c9eb1", "value": "T11336234931B881FCD1460A7894F7CE56F3B3BC5D22FA9B0F6B40863A1D53B85AB64712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047343, "uuid": "27a137b8-3c07-4e5a-91b6-f67b07097f9d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047343, "uuid": "118754fb-49c5-40a5-bc54-4cd845c4dba1", "value": "49152:jnXnsEMSPbcBVQej/1INRx+TSqTQAARdhnvoAH:DXfPoBhz1aRxcSUQAEdhvpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047343, "uuid": "7c49c71e-c0b1-44ab-b4f5-c5677076e089", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047343, "uuid": "235609a9-f9b1-4ed6-9c5d-cc456797ebd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047343, "uuid": "5d9674d0-4e62-42fc-bb16-6d7deb2cd058", "value": "a8831b07fcc8a073c3bdd1b7004609b6773130162eeba167257a3d6be8da67c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275283bf-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063603, "uuid": "2bf070eb-8712-440e-9614-79647fa8698a", "comment": "Malware payload", "value": "0be4613e90558ea5b605b078cba988ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063603, "uuid": "1abd9306-3b89-4ee2-9b33-26cd5a6d6a25", "comment": "Malware payload", "value": "a90bd21b3cb02229809ed87094330a89a316dd41c92e88b8b61e1605e2ba9b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063603, "uuid": "b4158aad-3659-41f4-9a30-c1bfd12e7c05", "comment": "Malware payload", "value": "968372b352a67432626f42a47f5a5e89f4ab8e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063603, "uuid": "c134daff-d996-4a27-898c-4339779a88af", "comment": "Malware payload", "value": "f9da644062eb57f5a486911c29c414d45c2bb439e856a2c8e7b5a6f24e37ddb3652f117cb7bca2ad2e8b52b23c48fdb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063603, "uuid": "1bc9896a-f5ea-4825-914e-7340ffb3968c", "value": "T14266E809AD843BFAC42C4B7454EACA5622B06D144AF1463626A4FFEDFC762747F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063603, "uuid": "4a5adc9d-5898-4498-9e12-f4cda46afe97", "value": "49152:UVaYhY1efVQdcvbEkE00xwK72LPjFnHG374qtSkHzkGg5Eu:6vbE500Lk6Y7Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063603, "uuid": "15d07dab-9a55-4e32-90d1-d3be34e7973d", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063603, "uuid": "bd8c2bc8-6778-4ddb-9cc4-d1f3a2e72559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063603, "uuid": "696d4dc3-dea9-4132-9d50-485205947778", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce26f2d-893c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785102750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102750, "uuid": "48756dfc-78ef-4ef1-b4ec-5e52e3aa8edb", "comment": "Malware payload", "value": "b990a1f4505ebf24ca3161556ee81f8f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102750, "uuid": "b0387dfe-bea1-465a-bfb2-991c3cff48cd", "comment": "Malware payload", "value": "aa8e03cadb21e3939196e2658707563e7d6f1259b9d69f973b22ba494d1e49b4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102750, "uuid": "84faf8c7-31e6-499f-8398-a1d70952a3d3", "comment": "Malware payload", "value": "b899a4973c99eac9189e5cd7e209ea789183ba24", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785102750, "uuid": "d24cf72e-7fef-4e8d-97fa-f5f5996256db", "comment": "Malware payload", "value": "ee03b8c0ac9f275b12b640723e50e95f41afdaa143c4c9b7b23905b673c9ccdbebf50d69d991c269ddc6821bdb30162e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102750, "uuid": "be27636d-0910-4f68-a2d4-954cfefacd51", "value": "T142E6334862D056FEE9B3A23DEEC351D4F16874722771C4DB1BA44BF1BE17290893EA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102750, "uuid": "ca20ecde-ebfb-4432-bab5-c27061da60dc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102750, "uuid": "96237cf3-5f51-4deb-b9eb-54dbc7045979", "value": "393216:e8DaFXMgsSJ2GTn1XMCHWUjXucuI3/PGTAI:e8eFXmGb1XMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785102750, "uuid": "a56854d8-5b3a-481a-86fe-633ee0c296de", "value": 14270150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785102750, "uuid": "e4c6037c-f869-4ab4-8883-a80340a95107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785102750, "uuid": "494c2a72-4629-4996-8531-3864a8b16164", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0f8014-88ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785041517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041517, "uuid": "625ae6e6-7763-4e2f-ae0f-8e49932aebcd", "comment": "Malware payload (Mirai)", "value": "13d7755b351941063e9cc0c9f40ff8b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041517, "uuid": "b7b7ba6d-e165-4a0d-8aa1-e457bd751ab3", "comment": "Malware payload (Mirai)", "value": "aafd12aeaa84605735be12b0fd162674e7715011d7fe1db3f1ceb492b31c6d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041517, "uuid": "db1c81f1-d41c-45c0-95fa-d4f55d44ddf9", "comment": "Malware payload (Mirai)", "value": "958b5a4a713d1f160b72dba809d95f8fabe0fa25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041517, "uuid": "64020aed-6c53-408e-a7fa-a2ec4a9ef7ab", "comment": "Malware payload (Mirai)", "value": "995498a6ffadd2bc0c09b72ce5a15c4b174833616534d011f057cc3d544c252b5930a6d2512ae09e891941c89ba565d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041517, "uuid": "1c964488-8d32-461b-9fff-ee2ebc4fa2a3", "value": "T14073C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7534D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041517, "uuid": "3371fe8c-ffb0-45ad-8099-e9a8b338f4ff", "value": "768:K3sJmkq/lhWHgJvd8p6EC5Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnoS:KcJmkC1J5B4RcBvC8W2ZpMe7+pcI3no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785041517, "uuid": "7e6e49b8-7137-4beb-9a84-984e4188baf5", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785041517, "uuid": "946a5115-3705-4130-a5a8-470009e29fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041517, "uuid": "30c45f40-8c5a-4c25-924a-871ccfab4fcf", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b48e150-88e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067126, "uuid": "e6fd189e-3fec-4858-9273-af7824d00655", "comment": "Malware payload", "value": "d2888865ed1fafe72a4f251f9ce632a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067126, "uuid": "aad0c4fa-9657-4ada-bb83-6dab64530372", "comment": "Malware payload", "value": "ac435b3ee3365a2333fe84841525b5be5633181937e1125395a7b2459c3a40a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067126, "uuid": "9ee95d27-207f-4271-8234-9bc12b2da799", "comment": "Malware payload", "value": "736672e06fa3ac33aba5ef52abe077b8b0c6db7b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067126, "uuid": "92f95840-dd2b-4d83-88db-0feac0052c70", "comment": "Malware payload", "value": "8c8aaf9f4bd5400558315cde36f5b831bd3832fcb3b906135327fa8708bc04e90a325dee4a49b88e4522a5cfb23fbf66", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067126, "uuid": "5fdd25f1-6f4b-48f3-a588-7644cdf74091", "value": "T1F1E012E4B5A212B24F84CDCBC85385F5B463A1E12A225FE4395971E492752C1FC7052D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067126, "uuid": "8bc608e0-6320-46a6-b0b3-78ea18c903de", "value": "6:XXRJSXA+sL0yMiFSAKxyM8wA+LKie0yMflAI5yMeAuF:XhJSIL0fiFCxflLKV0ffJ5fqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067126, "uuid": "24076f2b-9f54-4742-917b-b81a14682229", "value": 429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067126, "uuid": "1bd373f4-d306-4fd0-88f6-9c7484e9e333", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067126, "uuid": "d7a7636d-2505-4794-b5f4-8a8eb463c9e9", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f2f9bc-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070016, "uuid": "632eb5fd-0d31-464a-8af3-4dc7b213edae", "comment": "Malware payload (Mirai)", "value": "e6c71b939c8e2f46964702ca60f94f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070016, "uuid": "8c2a1fd6-751d-4bbd-8d4c-8e95b03b820b", "comment": "Malware payload (Mirai)", "value": "adb61b25f31fd03dbd3ed7b2124da3c94d68d96b8d96d7fa5aecdc3cf676a09b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070016, "uuid": "e24b3b3b-fb64-4556-a67c-a26b1c55e203", "comment": "Malware payload (Mirai)", "value": "cbd13f64db34bd9e9366fccbc07a31abbd99e889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070016, "uuid": "25c56712-310a-4f84-97da-ec6d5a04aee1", "comment": "Malware payload (Mirai)", "value": "515a6bbf8954f5360b3e57809742bac4854a20d500946e61baaf74e12eb4ca43e7da23152d2eb25e0e04a3aa77bcc1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070016, "uuid": "54a1eeb4-92cf-404d-895d-7f2156fb5001", "value": "T1A1F32B56EA418A13C0D217BAFBDF825533239764D3EB33069918BFB43F8669E0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070016, "uuid": "b0d0f627-88fc-4895-b93a-e3e96689f3aa", "value": "3072:SXoU39odCaAfstCfgs7iR8NL1PMC6uxX0j2w2UqJM/9vhtvuBsM8LEwmRwaWQx+s:I39o8aSqCfgs7iRg1UC6uxX06w2UoM/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070016, "uuid": "b1259434-663f-43a0-880d-3870ab99c070", "value": 166080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070016, "uuid": "820731a4-d9b8-42df-8bb7-c522b70cbcd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070016, "uuid": "2f2fd5f3-a48f-462e-9c4e-b3ccf6df5d10", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db60306a-88ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047155, "uuid": "420224e4-3f00-45a2-9f5c-621d6dec34bc", "comment": "Malware payload (WannaCry)", "value": "4369226435b74ef91427cb5bbb31e259", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047155, "uuid": "653a7577-655b-49c0-8b1f-a166c83901c2", "comment": "Malware payload (WannaCry)", "value": "adbc4fa90c932a60fbfff9565c16b5554084dbf718d471fe6ebd9a0564026e88", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047155, "uuid": "6f806f80-7c9a-4ab3-8b08-59d8ab03bfe9", "comment": "Malware payload (WannaCry)", "value": "9c3eba3be4c18bff5e1df32eb7feb60b1926ec45", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047155, "uuid": "4331ccd4-ad4c-43bd-86db-95e8e3c8f2d7", "comment": "Malware payload (WannaCry)", "value": "c2ef5ae8366f192745b76854c60c28a4b8cb8dc06b35532edaf1373807003e7586c6facb295789a424baac1c70cd314f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047155, "uuid": "9d7920e8-adf3-4b59-ab8d-2dfa48fb7eab", "value": "T1B236239931FC91FCD1062574C4FB8E22E2B27CAE22FA5B0F9B80497A1E13755B750B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047155, "uuid": "7f5984df-81b0-4ed3-b1db-f3d4beac9e37", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047155, "uuid": "ab822861-3ae1-4e6c-94f7-1af6ff30068b", "value": "49152:jnsnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SA:DMnPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047155, "uuid": "30906f1a-91b4-4354-acfb-0483ed51b6b5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047155, "uuid": "cb27ce54-8bbe-4f5a-933a-5bbf4c02545a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047155, "uuid": "d9e41556-d3e1-4a96-97ea-10a4f61d769c", "value": "adbc4fa90c932a60fbfff9565c16b5554084dbf718d471fe6ebd9a0564026e88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b282e88-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "ae835cae-d956-4154-8650-b5dae5030874", "comment": "Malware payload (Mirai)", "value": "347be969802dbdd8db485d121ef6ee43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "c6147801-af7a-406d-938b-537dadc08814", "comment": "Malware payload (Mirai)", "value": "ae74fa8dbd9b8b203a6cfeb4e5cb4903548a740b72d1f7356bad572cc9e170d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "ae926240-cb1b-47c1-a682-53e6524863d5", "comment": "Malware payload (Mirai)", "value": "2a0f40180719023e443d4fc22e00a5cd902b77f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "14bffeef-9376-47e3-b17f-b9ff86873770", "comment": "Malware payload (Mirai)", "value": "d3b8c169ba957c60bf70db2a7ea02d7f3b230c488214fbd5e21380f7bda5ad36c4e09daa5540a13a9e24cb77054141cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "93769662-dc13-443a-a137-6f6c015f5d9f", "value": "T120934A25687A2E17C8D4A23E11F78752F2F6370E24B0C65E7D760F8EFF15680A5462B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "478c6a4c-2bde-488e-8843-dbf9f9e47379", "value": "1536:L4BLKt7+jr+0a1NbXwSZNIHfZ5HU3sD7zJVBjf1oaGV5uZ:oLy7fXfZXqZ50c/zJVBjfqVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066133, "uuid": "e7b61b06-f82a-43ce-b809-b3550fa5558e", "value": 92664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066133, "uuid": "3d585a38-6d30-41c5-b4b1-375c6d16d5aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "606d1e0d-4346-4364-afa7-a4da5c51716b", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81cb4b2-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "6a2da7bb-cd5f-4ca6-821c-cee50b0fef55", "comment": "Malware payload (Mirai)", "value": "fbe4c0de0baa9171ee821fab9c22b8f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "5b9a548b-60c5-43a7-9a01-a8d6f3b0d9e8", "comment": "Malware payload (Mirai)", "value": "aee5fd285185c30cd4d6d85d9207aeaac7589da4dafc504c6b0d326b3a7c2cab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "99b11674-7bdd-4516-8d9a-147cfadd08e3", "comment": "Malware payload (Mirai)", "value": "74ce58828fd11ad08abdf3a02d2d3e27dae02763", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066852, "uuid": "055e8be9-e19c-4d73-84e4-f0fc6ffc02b7", "comment": "Malware payload (Mirai)", "value": "ad56e700455b8360a97e464c48d1868ca6bec5ceec45a9eb1b05b2cd8ecf73ed6ec65687ac4424438ef4ea4c95d9368b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066852, "uuid": "960f4fe6-5e1f-4581-9b36-f0cb1b0aeee1", "value": "T15BA2D01358926C7DCAB0D831FDBCC24B32D21FBAF198727A38149276E6C6C07157D6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066852, "uuid": "ef415355-a653-4656-8058-aa472c7e1fb2", "value": "384:gorW4V1gXq/F/JHQ6eD4AUZkJZ/2vr8az1Jid5z0l0dKgWhymdGUop5hKwM:gK7gXqt/JHQ6k4ASk/+rZz1kd5z0lWXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066852, "uuid": "e9532577-afa4-4bf8-b408-a0d05a2e5055", "value": 23036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066852, "uuid": "a8ea2077-b468-4cdd-9b63-8cb02ac43954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066852, "uuid": "45871545-d579-433c-a25c-6862ab6a9e5f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eae50b1-891e-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785089922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785089922, "uuid": "56a909e3-9426-4cc0-9aea-ebe3de2349fe", "comment": "Malware payload (XWorm)", "value": "93dfe7280fc32b16336d6c981421049a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785089922, "uuid": "a00ef702-daf1-4082-a486-aedcb3cb0752", "comment": "Malware payload (XWorm)", "value": "aeee9e8262aea170816e1af225dbab94ff607cd32e78ab76d41b8ec2c5a6e6d6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785089922, "uuid": "b9b0e235-b18d-4a86-99e3-71ae33b8202f", "comment": "Malware payload (XWorm)", "value": "d70250eaf001392087652da5419220049921ca8f", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785089922, "uuid": "5ad628a1-3898-4fda-a7c5-d9d6a99ac0f4", "comment": "Malware payload (XWorm)", "value": "a07bfbde0c654b77eb447833acd9858cc37c7d8f93a3acff8e52179f95602752d48338e76b84157d3f643aebf7935b13", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785089922, "uuid": "368c8501-05ab-4747-97ed-a82b8aaf8a30", "value": "T163346A16B65550F9D1A7C4B4C943C972AA323C4A4B60AAEF07D05FBB7E326E49F38701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785089922, "uuid": "7fbc6311-65b5-4945-9cf8-787a0a795ffc", "value": "183388b096f04db8679b00d085f87f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785089922, "uuid": "2294b8b5-a35e-412a-b090-65fe499100ca", "value": "3072:4kY8yckIfPJWifvyA3yP+ITv57bbOb6Wt1dNYVO9YHhi331erhvabEs9Hb:qcVp/3yrTNbbObbfme31erkbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785089922, "uuid": "e0e499d2-72e5-4035-8938-51951888ca0a", "value": 243239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785089922, "uuid": "95b17a39-6d5d-46a5-b4ef-9fb0704058fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785089922, "uuid": "9b5d3ed7-f10f-4f60-b17f-bf3ca7e7c976", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e368495-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067936, "uuid": "834e5e84-84cd-4c44-9e8c-5bbf80d40fe5", "comment": "Malware payload (Mirai)", "value": "56adac64d10e77b324f96370a85a101e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067936, "uuid": "8f6f1e01-f802-47dd-a09a-3c486ae5f30e", "comment": "Malware payload (Mirai)", "value": "aef0db4f3fc5187d5d3c4e3504e698be2448f3f4320c62034af7b536a1c37daa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067936, "uuid": "d4ca5b57-b638-4b97-bc1f-627e0e450c64", "comment": "Malware payload (Mirai)", "value": "f1f034f931fb62a51b87dcf54b834c3e6512b4d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067936, "uuid": "35e29b9c-17df-42cf-8b85-b20a1c1c6999", "comment": "Malware payload (Mirai)", "value": "3761b08f240ecb11447136853e6d08802c7fdafa94c89938aecd74f5db0cf702364cd5de2a3ac9fa188b5394b27119dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067936, "uuid": "17ec666f-91f9-42ad-8476-96c2308d3177", "value": "T19693184AF881AB11D5D522BAFE5E118E33635BBCD3EE72129D205F2537CA92B0E37501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067936, "uuid": "f9820f38-d450-4034-a74d-4708043050d4", "value": "1536:hxn4JiCLEtwwJn9iGUvqOsDWiPEuJ1Jhdzx4az0g3Z23ZNlmUAi1cMM+bTBYkJr:wtUws9itvenEuJ1Jzzx4az0g3ZOncrsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067936, "uuid": "2031a972-a181-4a12-9e54-73ee5deaa662", "value": 94052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067936, "uuid": "6d24412d-9fa1-4021-8679-7a191a293bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067936, "uuid": "579b57b0-fadb-4660-84d3-946dcf8ebe67", "value": "nvmsUpdate", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c88a739-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067933, "uuid": "d2575365-8911-476e-a596-94140da6e2ba", "comment": "Malware payload", "value": "530f6f90af26664099b0d162ea29fb2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067933, "uuid": "7de490ec-b800-42ee-99f9-a9d1046b0a36", "comment": "Malware payload", "value": "af006fdd21ea8f3562ba0f573b989c7c3fa7128e7ae1454c0b44ae23f22b194e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067933, "uuid": "0e54dfec-2ec0-49d3-9ab3-b35dbc70c887", "comment": "Malware payload", "value": "20f2463ebbd3f25cac9fa6578019c6d99343e32b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067933, "uuid": "409775c1-2911-4e7e-8a27-e02b969c48bb", "comment": "Malware payload", "value": "1e85a417a219bfea3320f4b47306885e8dd1c1b505ecf5593ce689ac384626f4d898d1b2418601ce2b69a6c19d493529", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067933, "uuid": "83c5488c-a003-475c-8e2c-2d895d607cd6", "value": "T1C5A32859BC829B15D5D522BEFE0E518933635BBCE3EE7112DE105B2123CAA1B0F7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067933, "uuid": "dee0627d-fa04-4930-9421-1b4337dfcb87", "value": "3072:E3pU2TRUxfkrMbv8/rt0jtI8pWeaXhpAjzWMP9OF/3iQ:+pTux2Mbv8/pmqFeaXhpAjCMIF/iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067933, "uuid": "cf9e7207-da48-42e2-b1b9-2bd8176ca7bd", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067933, "uuid": "fec6e2a5-4b40-4c7c-9d3a-876a0ce8c7d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067933, "uuid": "d3e43b1a-2269-433e-ace0-31945d13d06a", "value": "lul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6730bd9-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066849, "uuid": "e9004e8e-d530-48b8-b99f-0a4ceb9d8854", "comment": "Malware payload (Mirai)", "value": "12613aff98c89c5167fb4239aad4d155", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066849, "uuid": "161c2fad-85ab-478d-93e2-5d31a24f68f4", "comment": "Malware payload (Mirai)", "value": "af8811cc88df087e06a5036cd2661add41669a36c7ef68c6ad375d33cf99a679", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066849, "uuid": "286561e4-794a-43ad-baad-ed7b33955ced", "comment": "Malware payload (Mirai)", "value": "5c1e122cfc48cfe64460d42d9b7800f750c61474", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066849, "uuid": "260bdbaf-e94c-4761-ae34-eb094b876a2a", "comment": "Malware payload (Mirai)", "value": "c7f1d4dc8b94cb5fe9c2d49320c5e8835782aa95abc3e0fc2b47260cd421f5fed10c003c1320a48f3133a084b0860b06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066849, "uuid": "69e47c93-0024-4000-b01d-abecf1dfb61a", "value": "T17CF39EA3F30B1090C82306F41BCB6B9D6E2315431F6BC6E7BC6A31396A765DE5905BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066849, "uuid": "27b844ae-e069-4aac-8a6c-c90084bb00c7", "value": "3072:uot+gknCZ5Nu+97umSJ9u85iOOC7+aQkoUAcVk+o/Vyu7geCmagM2Cub01elq:uot+gknCZ5Nu+97umSyrOZ+adlA0OQuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066849, "uuid": "c8b7b568-b7d4-48f8-8cd4-9aa2bf52dac0", "value": 165352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066849, "uuid": "23fdf16a-5db0-4d1b-99c5-c369e858e3bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066849, "uuid": "16a8f1e1-d476-49c6-abdb-d23020383ae1", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53971dc-8917-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785087061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087061, "uuid": "4cfe556d-6b35-4805-a2e3-2be6a5e7ad78", "comment": "Malware payload (RemusStealer)", "value": "fc6c9efa6020fb0a0ba51ea3adcdd92b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087061, "uuid": "02cf3ae7-8554-47aa-93f9-6c5eef35bc0c", "comment": "Malware payload (RemusStealer)", "value": "afad6e5091979eeb1163bac16ea4d1973821f0011f168a0a4e5656b9f93438d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087061, "uuid": "c9b8619a-dacc-4db7-829d-4a2c8d90585c", "comment": "Malware payload (RemusStealer)", "value": "bdb4a03b05e98db3ecdf51bde92a489fd30e4d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087061, "uuid": "03566338-cb0b-4f02-b9cf-abcfc286f94d", "comment": "Malware payload (RemusStealer)", "value": "158ab49da7055c4dca72427b1ea7ffe704d494fc025a61388513d585a59db02035e0658a6c5b4ad7dd2a08b31582010c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087061, "uuid": "db1ff2d0-9b6a-4c68-ae9b-d16dfc858c75", "value": "T18AC55A07BCA148E6C49A673188B352627B71BC085B3633EB2E90B7782F727D06D79745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087061, "uuid": "8b2d0bc2-c46e-4206-9d27-ab622ae48c1e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087061, "uuid": "5dde6a55-b6e0-47c5-99d5-fdd06157d56d", "value": "49152:T9YvPQ6bnaXtNvnhA5rMfAw72LNyKiPDvNJ:T9qMtngNt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785087061, "uuid": "d0885e7c-cca1-42f3-a8e4-198c3e12a644", "value": 2713448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785087061, "uuid": "eb1bcd04-d8a2-45e3-8a87-72d0c6951bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087061, "uuid": "cc4d75f2-a093-47d3-8d00-3364ab94948f", "value": "FLStudio2025_v179_Win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a160a3d3-8936-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100315, "uuid": "c42cffe3-b87e-4508-945b-f561c598081f", "comment": "Malware payload", "value": "10c1d25dfd571af943ee6193731c56fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100315, "uuid": "8b17bf9f-9914-4bdb-bb6e-b6a532942715", "comment": "Malware payload", "value": "afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100315, "uuid": "3122bb17-90d9-4a3c-89b2-c8d402793cba", "comment": "Malware payload", "value": "eaea1966505cca62e2f950acb02abe79aba35cf2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100315, "uuid": "ce472e2d-40d8-4408-af09-71517e29589f", "comment": "Malware payload", "value": "a44fbef00aaa562d94fb7c9be84559e4dee60c400635e43fd07b8f13d8f98d138302e52e72c74f9d42b7ce6623ebc5a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100315, "uuid": "e8c31d94-b40d-4fa6-9308-75ec554630fb", "value": "T15A11B2DA4118A3461B488D14FC5B8C3D796B96E67136E514B286F8F48DCC2052D39FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100315, "uuid": "3052c2fa-fd59-4768-8352-f95dd239d901", "value": "24:3J30C9GHjsFJNIxKVXKn0ydfh6zTks20hp3AtZEsGyhOfThlHA:fQDCXJeqTkxiAZTjhGhlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100315, "uuid": "7eb503c8-43d4-4975-81de-7d0e1b12c0d2", "value": 912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100315, "uuid": "c56a6676-ebe3-457d-a5a6-e0f8057d285e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100315, "uuid": "54a998c4-5c1c-4409-bc87-20555e10e32b", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bf0c03-8916-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785086580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086580, "uuid": "5be951e1-b0ab-4d29-92bd-a1ba0090cdf4", "comment": "Malware payload (Vidar)", "value": "e67407bf4d8e83fd5af8a9834d257d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086580, "uuid": "26eeeb83-5d85-492a-9d37-e9de25f73b44", "comment": "Malware payload (Vidar)", "value": "b1178665362b3c93abc16b5b4fd66ca39505c323adaa354e5a862e05e33a115b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086580, "uuid": "d0020115-acc4-457f-9188-2ae265c1de3f", "comment": "Malware payload (Vidar)", "value": "4f722a0b47ac5a15017452fac82e5092c2d24fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086580, "uuid": "28effcb9-08db-4b6b-aede-7e56a3d1d3f4", "comment": "Malware payload (Vidar)", "value": "9760a05df5c00defb468edfd78711e6b88b773ac0ebf31b0783af2655caa66af2ed6829ebbe1708cdce55dbc91e79988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086580, "uuid": "0b218dd6-1fc0-4ed6-b268-de6b7550932c", "value": "T170F58C07BCE119F6C099A33188B316567B75BC092B3627E72E80BA782F727C19D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086580, "uuid": "6c021a95-da1e-4174-a29e-0d6304604a9d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086580, "uuid": "5bb317b7-7e1a-464d-90f6-3669a461535a", "value": "49152:MH5P/8nUR9gIzULe6BpE38I5yUH89Om9BpQBhVYnutiej5+SEisrZ8+2wMXKG6Vk:MHZ/n6BkBc9D9HQmnuJ7q2wMXF6Vcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785086580, "uuid": "15fccd8c-ba30-485e-8369-4989b83b1282", "value": 3449696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785086580, "uuid": "d1561cb8-a782-45bd-8ec6-de2e0a484896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086580, "uuid": "270ccf75-6edd-4d44-8db5-d7c61356ed23", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5299dd1-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084886, "uuid": "131aba01-bf62-4e16-a86a-1d6a18ab1c86", "comment": "Malware payload (Mirai)", "value": "2f655693ed74b105f7b768312b9d3ed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084886, "uuid": "170e237c-8502-4b42-8e32-a9749b2d6938", "comment": "Malware payload (Mirai)", "value": "b183647242aa0b7023575b556e4721ba092e6de2316a457a28adce0eb1200756", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084886, "uuid": "bb4b0426-181f-4691-a4b6-306758df1074", "comment": "Malware payload (Mirai)", "value": "20790c35100e7c8c3df08885e7606f9a5d0a4227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084886, "uuid": "62d6d448-00ba-4703-b7dc-bf0f19cb7e6f", "comment": "Malware payload (Mirai)", "value": "3a1829adb42d19cf356bba0d99498811bf2deb2e0b8443bb0c1319389e49a391051be844712154f62e459f836adceec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084886, "uuid": "d506463f-7146-4bcf-9de4-9fbc9e106355", "value": "T132F35D56FA418B13C0D21779B6EF42453322A7A4D3DB730699286FF43F8679E0E27A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084886, "uuid": "306689e0-87e4-4c10-89e7-d4ec91c5ebf1", "value": "3072:Zb5ihUI2nQymu8LahA4M123HG4mR3JXRAgyW7xwM/96jmCweQUC:XihUI2QNLahA4M12XGXPhhyW7aM/9Ymb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084886, "uuid": "6825da8a-89ff-46dd-9fb5-f53050582e0a", "value": 164306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084886, "uuid": "26dba261-b6cc-4296-b928-739fa834016a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084886, "uuid": "fbfc5390-3b43-433a-a7d1-1956bf79d541", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e989d75-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106296, "uuid": "553c563c-b725-45e5-a7dd-b3f953d5668c", "comment": "Malware payload (RemusStealer)", "value": "23a9a402c5192b3c687cc59c40049929", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106296, "uuid": "8c9d9068-4b31-4fae-9c16-7e6c7a45285f", "comment": "Malware payload (RemusStealer)", "value": "b29391ba505af508f2110f54f73b203e2710b8b6c8a8717005e5c7a4050630e1", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106296, "uuid": "f90a90b6-63ca-4e90-98f1-9aa08fbc6dd7", "comment": "Malware payload (RemusStealer)", "value": "fe81c9d838854fa3ec23f010b4c1c74c808fd199", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106296, "uuid": "9571d124-c4fc-4f91-83b4-a06e0e81d612", "comment": "Malware payload (RemusStealer)", "value": "5ea1d4d579c4e051d7a6189f2c1db2fa49aeb96bc86108fe8e0b0d0fc003af7f04ece960f5054d1012a0edec621abef0", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106296, "uuid": "1e775384-2b8a-4a5d-bd65-ae112d8a6452", "value": "T1BC24086BD25370FCD652C07852666232B732BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106296, "uuid": "0913e09c-c95c-430f-be15-d4547c0667fd", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106296, "uuid": "12b40a9b-667a-4d91-8be3-83c274eca06c", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFC1XCGiics:Qj5WUEBx+Q7PEfFnQU+tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106296, "uuid": "5fd3586e-9d9d-437b-b8a9-14d2e5fde05a", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106296, "uuid": "44bf202a-a314-41b3-aa07-97e219cf5a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106296, "uuid": "e7614d8e-b5f7-4a63-af34-faf1c11552c2", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5c3f1a-8927-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785093653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093653, "uuid": "1061ce6b-be3c-4985-9d64-c5ed3573f348", "comment": "Malware payload", "value": "ac0e671bc3520c6dfb2597ed3a8c67b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093653, "uuid": "46c6414c-c3e5-42ed-bd66-c0c2ca5015b1", "comment": "Malware payload", "value": "b29b34738355449cfc0609602966074d6dbeac2c6335a3c16f31124b72c34eb1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093653, "uuid": "1cdd3646-d05f-4def-aebb-75f3d661bb0f", "comment": "Malware payload", "value": "bbcc5ca472940d57ef0438c553dfeddd0035d771", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093653, "uuid": "12036bfe-f350-4d0e-acd5-bd5533c99e16", "comment": "Malware payload", "value": "aadeb6e05e92b6a9b65d6a4465689dd9902272b175647c21150753fbc0b0a517977841f6c39ed9f454c75a49a306748c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093653, "uuid": "f8ad8b03-9a77-49ef-964b-e63712528df0", "value": "T1A77273F0F92C983637CD6538F25D990899C35C3E1AAB3630502BEE54051DB5A732DB7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093653, "uuid": "03750565-5bc3-4f6f-bbc1-42494f8aa5f8", "value": "192:i+1gso1gjix8Sj1VAEBUADGP/6B0i1gh4BuWKTT5GqkgA:BTiWqA4UADAZdhQuW5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785093653, "uuid": "cd8e41f2-8caa-4835-8a6b-8734c1b9faeb", "value": 17011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785093653, "uuid": "c38b99cd-7612-48a0-917e-24303eaa93fe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093653, "uuid": "a2168023-2e08-4929-b1ae-c929e18b41a7", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b156d328-88f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785072854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072854, "uuid": "7f10743d-dfcb-4e7b-b347-842bf04f9825", "comment": "Malware payload (ConnectWise)", "value": "49cdb303970dcb06f8eca22bc83a57fd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072854, "uuid": "3f11a60c-7900-4db7-b728-b3262f42b771", "comment": "Malware payload (ConnectWise)", "value": "b2e80db74923096f844d53ec0bbecbd7e7ef01617ade1c723e2db8e0bd4e3856", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072854, "uuid": "d5c56fe1-4537-4637-b1f7-f4fc7ef3da02", "comment": "Malware payload (ConnectWise)", "value": "0e71a6a89a403c8156fde63c341546711e5b0976", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072854, "uuid": "43a0eaed-c248-4ecb-8ddc-a234fd6b6e3c", "comment": "Malware payload (ConnectWise)", "value": "44cb041f52702ed7b44d327c3f608aaf73976a631eed8689a3cee980f5f45d7986cbcd76ae11d78a7044e44738e95a53", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072854, "uuid": "3ba61a51-434f-4720-aa74-427a799d3b2e", "value": "T1AC46E101B3D695B6D1BF0638D87A52656734BC049316CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072854, "uuid": "d6f69cea-c626-482f-99d8-3c8774df90e4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072854, "uuid": "117a7601-c26c-454e-8fdd-12554055828e", "value": "98304:rzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:rhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785072854, "uuid": "09dc4c9d-a682-4959-850e-25c5461bb7e4", "value": 5662224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785072854, "uuid": "221e9be3-5119-42ac-a5b0-1a885f6c14f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072854, "uuid": "021da16c-4b03-447d-8ded-65f2dd19ae38", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58de09b-88c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785052352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052352, "uuid": "34e1fd68-7bfd-4ec0-8796-1bbeba5e8f4a", "comment": "Malware payload (Efimer)", "value": "56538acb9f85a795cbb7a53afe5f254e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052352, "uuid": "6463cb52-9952-49bd-accf-1c0797cfc66b", "comment": "Malware payload (Efimer)", "value": "b319d03f4eb9120cb7a4584b6c75be04dab781e541ffc74e252945e8522d7504", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052352, "uuid": "4fa86b9c-1e19-4b51-9812-e09b8ce83002", "comment": "Malware payload (Efimer)", "value": "cf36ff2b720de669f384d3c1bb03beb0d71a205d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052352, "uuid": "e3c46f1b-ed21-42fe-833e-47c58afec942", "comment": "Malware payload (Efimer)", "value": "bc700b2b14e5d2105df5e9e5b8f1f552f2806ff7c8f4891859f924b31a27d502ac9550c1e61ff7f70adba76763f62056", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052352, "uuid": "cd50b18f-f46a-486d-9095-fec015156022", "value": "T13EE6330C0AF009EBD673817DCEE255AAE0A674310772CAE31AB4D7B16DB70E54D39A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052352, "uuid": "4269d48c-276f-45ab-9c35-ef9056ceae79", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052352, "uuid": "9e66edc8-d98e-437a-b6b4-1cdc0c85fb21", "value": "393216:UUlanf69Y16IlozmA9P+7nLWrW2XMCHWUjXEcuI3/PGTAI:UnnfDHlozmAd+7nLEW2XMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785052352, "uuid": "1ede4d49-a1c8-40dd-8555-8e67c312d265", "value": 14317124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785052352, "uuid": "c557ce99-9e94-46b7-8728-42b187dbf6ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052352, "uuid": "bfdb9f71-7634-4b2f-bb25-f4f44621ecf2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705ff447-88c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785052988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052988, "uuid": "c9f54efc-e167-4634-b8af-17be0acb8c30", "comment": "Malware payload (WannaCry)", "value": "c62e2825d255db75b2a677396755736a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052988, "uuid": "ee99b004-bc5d-484e-92ec-e440aaa622ba", "comment": "Malware payload (WannaCry)", "value": "b34d20f3d3689bcdd0258b56c9384ac9f9c66ac7d41b456591e6580b29bf59c4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052988, "uuid": "9fd84405-48d9-489e-bb42-58ba6cf509c8", "comment": "Malware payload (WannaCry)", "value": "e079f292ee9edb8b0f1be4a576f1a1012479bb22", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052988, "uuid": "f070911f-7c65-43f3-aa66-9de16edd8880", "comment": "Malware payload (WannaCry)", "value": "f797e5fb1f431dc69f3f457af9ed8e36cdaf68c08a3df9cf90e347ba913e0c11f1bd9a909fec1c87a55691c8ae03f08a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052988, "uuid": "72510be9-f4c3-4aa8-a33b-161195435da8", "value": "T10B36239932EC90FCD1073635D4B78E22E2B37C6D22B99B0F9B8046761E03795BB54B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052988, "uuid": "bb6efac1-cb07-4ab6-aa02-e0dd675ba3ec", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052988, "uuid": "bc1cd4f3-d2a2-4b34-9927-2377040a4e6b", "value": "24576:jbLgBbLgurihdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz66:jnsnnMSPbcBVQej/1INR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785052988, "uuid": "901210de-3e56-4b03-b90d-2dca5ca627ab", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785052988, "uuid": "50f30380-8058-453f-8fbd-dc62e3fbf508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052988, "uuid": "a9831acf-69a1-42a1-823d-0f4f612c50de", "value": "b34d20f3d3689bcdd0258b56c9384ac9f9c66ac7d41b456591e6580b29bf59c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bc126e-891b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088672, "uuid": "1beddb4d-125d-4b7a-8802-a5715caf4b7e", "comment": "Malware payload (Mirai)", "value": "a3f0c5e4719674db80465908e290c99d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088672, "uuid": "93211ecd-6d52-4c84-a4ee-967bff63f449", "comment": "Malware payload (Mirai)", "value": "b408884dac1e131b65dbab17f67ce62de878c1955a25ecc37776b46fa4768f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088672, "uuid": "d9c0c1c8-e99f-45df-8aea-19ac3485d554", "comment": "Malware payload (Mirai)", "value": "2a979a7f14984aa8f8406d2a2a8f5047714c27a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088672, "uuid": "f218aec7-1575-4f46-aa69-0f83b51a0437", "comment": "Malware payload (Mirai)", "value": "c118dbf3e850c16803f73845451f0c7162e4132edabc9df970902d2b71b36b15942fba33439e4485f12131bad1ff37d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088672, "uuid": "c261eb01-7853-4df3-997a-d429a50643a9", "value": "T145345903798188FFC886D1F44BEF9A3A98B1F85A1535714E23A07F962E1DFA0276D750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088672, "uuid": "15d24493-8b28-49d7-aae1-fea50704792a", "value": "3072:m6pl8wHjDf4rJcPyuZoVLHLCVhyY6/9pPN8hsYfa1d1ql63I55Mf0VEvzmasoReB:fplzDDf4rJE9o9d8Tsn8ncvb0P2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088672, "uuid": "c352fab3-f59b-4481-b77f-0fa9d29cc9ed", "value": 236720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088672, "uuid": "0fd5dcc0-1ea4-412a-9b47-65d70b19e185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088672, "uuid": "673e7056-ddd5-4dab-b1a1-c86e9ab82c6c", "value": "b408884dac1e131b65dbab17f67ce62de878c1955a25ecc37776b46fa4768f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e273c3a-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081224, "uuid": "2b9b44f5-5bbb-4bcb-8d2d-7ae89c70914d", "comment": "Malware payload (Mirai)", "value": "ffde28892691794d8b27642ef71b1cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081224, "uuid": "15a45bb9-e978-4466-a110-9f9550ab3642", "comment": "Malware payload (Mirai)", "value": "b5ba7ee0cdde7b61f3b5f58b12fdab4f7aeca951beb9ec7650c5fb2918614d34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081224, "uuid": "c6d8463d-879b-4ee7-8801-d22568fa8c8e", "comment": "Malware payload (Mirai)", "value": "cadd35ca36594b1c79d4f304a1aab3c79dce1be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081224, "uuid": "b31967b4-15ea-4128-981e-97172249ca2c", "comment": "Malware payload (Mirai)", "value": "a9f1605c5dfc4d66596fc958f9289fab363a2c0e5a75859da6c7e8caa4a26894e4b21fd73fcd0e3b52d9a1c0977371cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081224, "uuid": "0b526266-d65c-4aa5-9b60-2d5e2a7e9aa6", "value": "T1B0044A03B5D294FEC19AC87087AFD536E931349802357A2F6B98AF312E35E71272E751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081224, "uuid": "18f35341-374c-404c-b37b-d423781068b1", "value": "3072:a7Jbrls/UcmHj3t6LZvXi/DaTpnxy7aey/k+frX9R9ivvp/j+:0bry/H2j3wLImlx64k+rX9R9aj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081224, "uuid": "128e0a59-3290-4773-b950-d4de8155e39b", "value": 181568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081224, "uuid": "bc850481-f62c-44b5-9510-83a93a9c9d03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081224, "uuid": "ee92f9ea-a81f-4535-bb73-b95a256ed4e8", "value": "flutter.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc52d6e2-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067718, "uuid": "2ba6641a-c7c4-4f48-a765-24ba2c0957c4", "comment": "Malware payload (Mirai)", "value": "ae7354a33faee16a0c25293d9d20a77e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067718, "uuid": "ae1a2f85-2be2-4b1e-ac53-78c2e53a2215", "comment": "Malware payload (Mirai)", "value": "b5e7b48611aa3a7a793bc6b746452bc4b3e8ddc94631145cf435536035ada2d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067718, "uuid": "6cbc5386-32d6-4e3a-a528-743f52877b35", "comment": "Malware payload (Mirai)", "value": "50dc124deaf84e2f6971c63dde56476efeb0e66d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067718, "uuid": "74876099-a497-44b9-acfe-3ebb50a88485", "comment": "Malware payload (Mirai)", "value": "6d7a2ff7e07e6c676e80dab779577d5114d410f5be1d0360a76a6098dd7ef288323d2086545c20f21cbec5bc8fbfb152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067718, "uuid": "312945dd-3383-471f-b883-e8eba2d27cf4", "value": "T19C042B86B8C59B22C2E14277FE4F014D331597E8E2D9731ADD284B93378B41B4E6BE25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067718, "uuid": "73038966-851b-4dc2-9271-5fce5ef66452", "value": "3072:XI0j52w9nLeIg008qN5QMSB7h55GfcNFdMAvLQSZ5LJYVnQ1:XI0j5peKPqN5QMSB7hKUlMsLQ2p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067718, "uuid": "5b3c8cc5-3434-478d-abbb-da0541c65bfb", "value": 181440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067718, "uuid": "4655f2c5-040b-461b-a7a4-0215de74cfe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067718, "uuid": "67269ea4-f5c1-45a5-b908-974e5879652c", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858ffd3a-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088242, "uuid": "f07ab193-69b5-4862-9a44-e28761ed3cab", "comment": "Malware payload (Mirai)", "value": "b3514e5909f7d1ddcdeece4c595fc237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088242, "uuid": "3350dc17-4ee7-43ac-8389-7461ea5763d2", "comment": "Malware payload (Mirai)", "value": "b69cd4d631af1acb5c2098ca4f0e5820bbb0de2d399d0d333f3d639a92aea6e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088242, "uuid": "86c197c7-7c85-4beb-946c-6b4c03223f5a", "comment": "Malware payload (Mirai)", "value": "595842c639d05359d1d0a4a54bb9c1ce8a4c812b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088242, "uuid": "a796d4ef-b6a8-47ca-9404-27654aea90d6", "comment": "Malware payload (Mirai)", "value": "17e746b7b6e6b0ddfb9ead554b927aed0d06fba92a3479953e71e1bf377f880a2466616da57c466a354d29701afd0017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088242, "uuid": "287b4bc0-a935-435e-9400-8ace1a64c8b4", "value": "T17EB3AD32D4299C98C5994174A4A8BE761B23F18153331EF71BEAC6F65083EE5F809BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088242, "uuid": "1735a53f-884d-45e9-8f38-e6af16076404", "value": "1536:y/6xJE17db2YFIhtLM3+9qAK/r2n57ZaqKrCG5LTFlUH3Lp:yCxJ2V20Aa+9qH/q0qKr7vvUHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088242, "uuid": "4e99e1c5-b051-4b59-a228-614ce23818e9", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088242, "uuid": "c05fee59-d601-4254-bb7a-710029b3644f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088242, "uuid": "90aa56f9-d07a-4724-a80b-f540c0719ea5", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd54fd2e-88ba-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785047158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047158, "uuid": "b9906de2-7f9b-499e-97d6-0c65191ed41e", "comment": "Malware payload", "value": "166d0ab1ba9f4392738d27352cd7e321", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047158, "uuid": "a4b0e489-d30b-41a6-9e18-a325c4a2b21d", "comment": "Malware payload", "value": "b7a6156c01bd86f37bbfad899747b05c9c85ec770a0354d026e7920e456588a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047158, "uuid": "2efba001-9313-40df-8426-234f8e29f981", "comment": "Malware payload", "value": "ddad703f3dd2bcd0a17e0b2b97e87949b03235d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047158, "uuid": "6b944b2c-18eb-4d01-a2f4-132e2135b86c", "comment": "Malware payload", "value": "92a40400c0e2fe395cc7672edad833ec495f1e5860fdf77721402e75d26c7c08a503959c14f5af0dc7ae774ec7d36ef2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047158, "uuid": "67f63d8e-0b9e-4a9a-b664-298aa3c99d29", "value": "T13BC27D956A867C44BEC98A3E4CBE2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047158, "uuid": "3c070305-04b0-4f50-ae55-40a22dd9d93c", "value": "768:B8vCB+25j6es8RBgC9FYpMSUpi+20qUpi+20YQX:B8l25JBfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047158, "uuid": "ea5a3868-d8fc-42fc-8148-12a993a41266", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047158, "uuid": "57ed9585-ea5f-4d3e-9b1e-9fdf553a5de5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047158, "uuid": "ef0f6a44-ade7-4b9f-a366-6540f07cde27", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c923d881-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785081484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081484, "uuid": "253129ae-b2e0-4e4c-82d4-e6896748e607", "comment": "Malware payload", "value": "e973b260c4613c14d285536e398f82cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081484, "uuid": "57294862-b3b4-42ef-a88b-321b4f528a9f", "comment": "Malware payload", "value": "b8236efcfcdeb61c932b19488d58ba10c2033ca0b9a4bcf95d0dadc8620af196", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081484, "uuid": "1c8240b4-6592-4ea6-909a-ba16a74d2a4e", "comment": "Malware payload", "value": "4ba10e9acc18d2dd1d5acc72a681278c10145898", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081484, "uuid": "e48e7035-d61c-4b99-aacf-961739a01895", "comment": "Malware payload", "value": "01a977c5d8be431a2f6cc1527487e5adb0b482df966b50c4bad405f29245d6fc61a284ba6f9e4f21795919f52e9b3fb5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081484, "uuid": "738bd8e5-447a-4133-9c47-682ef334baff", "value": "T1F2B64A43FDA454E8C0AEC174CA7296227B72BC895B3123D76B50B3292F76BD09E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081484, "uuid": "0a0367d2-24d4-47a8-97a5-55083849b213", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081484, "uuid": "f0b704dd-c2c4-4e57-9af4-25e9d05582bb", "value": "98304:YpdPeWti7fApX4Pjsoe2xJaew7nkpoExqREt:MkWi7YFoLxJ1+dE8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081484, "uuid": "e62f58fa-0c7a-4d34-b09c-63ea02a8fece", "value": 11124736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081484, "uuid": "0cf9d675-9e07-415b-959c-6718d6ffecca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081484, "uuid": "1e98fbf8-7f40-46c9-bfc8-b1f9d93ad584", "value": "dashboard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95ad7ed-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "4fced246-9a67-41a1-abf1-b6146e0bb264", "comment": "Malware payload (Mirai)", "value": "78e81a0d3816712fb3e2e6ef62cab871", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "7398feda-25dd-4a30-80c5-18b9ec9c6999", "comment": "Malware payload (Mirai)", "value": "bb765d06f492746125dd64380237806ccb2e6f365976527cbc513d9dbdf26087", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "cac0a196-4e03-4568-b23f-e70433c31317", "comment": "Malware payload (Mirai)", "value": "227930d47362956038d29d2a9892be16a4dd4942", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "a80d1596-4352-403c-9146-e663d627952e", "comment": "Malware payload (Mirai)", "value": "aec9fa44d1562196f16d3962d62f3bd90f9c50bd18850e041a2538d70b5d902262ea8c7a7d208b17e634bc0eb512c0d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "0d198f31-b713-4195-b953-4cb587269f09", "value": "T1495302781A261EFACF6AB379968411617B420FD2645368477D1DFA83EC8A215BF60AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "5b056914-6580-4416-a99b-29bf380407fb", "value": "1536:Gezd6KHRqBUy4dN4WCXSKG8Sio1zm7dsoWad+7zvVJuo:GezUKHRqBUfdkXSKG8SioidzovvVQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066854, "uuid": "ad069654-1834-4b17-b85c-a23933bdd971", "value": 62420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066854, "uuid": "c81053a7-495f-4c0e-84ad-4b4748e35fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "df6136be-a5aa-4371-bcff-4a486c406c9c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245ec68d-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081207, "uuid": "94955a5a-ea0f-48d2-8ca5-b9e2d50cebbd", "comment": "Malware payload (Mirai)", "value": "210defbf4751b8c0b736632272acef09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081207, "uuid": "a7490b0f-7817-4b16-b590-17eea5f0e510", "comment": "Malware payload (Mirai)", "value": "bb8f18fd8cb6873e31d6a3533d5ce915c147fc6726d8433a17a6c7ff609c8969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081207, "uuid": "cb95fdfe-1404-4f91-9515-8f2b85ebd3e2", "comment": "Malware payload (Mirai)", "value": "69e6841530865c5383a7d07e7d6266c645ca9201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081207, "uuid": "88b965c7-866f-49a3-bd73-6d3cff3d24d7", "comment": "Malware payload (Mirai)", "value": "17a718203ef40bd914c50d2a6a25e9486a380329239312be86cce59a8864a56ad32d9fbd2cf0128ca35d1ef5669e23ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081207, "uuid": "b605bcc4-b489-46ae-bd5c-b469c8246fdb", "value": "T11FF31955F8809F66D6D5277AFA9D028C33130778C3DA7102DE20AF2537EF95E0A3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081207, "uuid": "fed346bb-088a-4717-927f-4421de89c02b", "value": "3072:XOodL/xBtfduC2+7xbfcQbehO5LoatCNaHFvm/OYXUZPOEyUwG1XE2b83hgGcr+N:XOmlNfcQbeo5MatwaHFvCAOEyUwG1XEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081207, "uuid": "92bc0e11-cf2d-47eb-9ccc-aadf71ecd7fc", "value": 169296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081207, "uuid": "dd087b63-2275-44d1-b380-7c398bb5cc5b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081207, "uuid": "676f876f-0906-4d9c-8984-bb64fcf65686", "value": "flutter.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f8fc53-88f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785072853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072853, "uuid": "46f653df-168a-45dc-aabf-fae63e06e8e7", "comment": "Malware payload (ConnectWise)", "value": "7414b115ca797102f21b7bd79dc9fe3a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072853, "uuid": "be678e22-83c8-44b7-b9ec-24feb2936f45", "comment": "Malware payload (ConnectWise)", "value": "bc48d484b7700ac1a31af7c2195b605faf5a69883bd7d711f08fc081aa54682b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072853, "uuid": "aab8493e-8c71-4e2e-86a5-75cb19f2e97d", "comment": "Malware payload (ConnectWise)", "value": "44c48d7549908a520c3d744f1da29994b6bea51e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072853, "uuid": "248a58e1-fa17-4275-9d3d-c39edb7f1c66", "comment": "Malware payload (ConnectWise)", "value": "4089f0b2663c30eec1bcf3fc1ac9640bda39f817fb38f37c21a79db00d221d1a221626f630010b2eb942bfcd39f78445", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072853, "uuid": "a38a3a7d-8cff-46f6-b4ec-4e57267b2f49", "value": "T14D647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072853, "uuid": "e574474a-0c5f-4d5b-a67a-e8a527be6938", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072853, "uuid": "9dfaf904-d496-43e4-bb58-2b1cf876b521", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9P:J1iw7gryNkSV1hy1Z1u2JLu9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785072853, "uuid": "18edabe7-d726-4d80-a628-4f8354b6414c", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785072853, "uuid": "ed5fc6f7-ff46-48c4-8808-53141776674c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072853, "uuid": "f156f6c0-32f4-44c8-a7dc-a816bfa0143d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e09a327-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069359, "uuid": "5116d219-9da5-42f7-91fe-5aeb34d417ac", "comment": "Malware payload (ConnectWise)", "value": "5a6ac24377dcd13e577a0b94eb5eeaf1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069359, "uuid": "85d97554-3e1b-4312-b3bb-02196b900f7e", "comment": "Malware payload (ConnectWise)", "value": "bce0062c6202400904e69bfd969b8ce75a3e7d0c9dc868a7bed72c7e4a001c55", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069359, "uuid": "aca3a297-963e-478b-ac24-6ad6006388fe", "comment": "Malware payload (ConnectWise)", "value": "b00e9e6545c96cd89c42e8d66f006e12460dcf81", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069359, "uuid": "59099e9f-0960-4066-bc88-4531cde5e3fc", "comment": "Malware payload (ConnectWise)", "value": "589ace73f55f8e63fc4d83c68145bcbef21670d8b4d31106b25792efc0c15a4e13af6ebeb7bb49be9cd3439eab4c8d3d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069359, "uuid": "958f66c5-d6a5-486f-a6c2-f936f167a808", "value": "T170646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069359, "uuid": "09002918-42c3-47c0-a95a-ffe2785087df", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069359, "uuid": "8975126c-87b2-4226-8887-f84f683f67d7", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9J:h1iw7gryNkSV1hy1Z1u2JLu9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069359, "uuid": "ba9863f4-b0ae-4eb1-83df-6d4f99d004d5", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069359, "uuid": "b1310309-c9cc-4dfa-962c-16ea030458d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069359, "uuid": "a9363cce-cd2b-44c0-a576-df82605e02ca", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8d4cfe-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088335, "uuid": "e79b3e9f-c49f-4d6f-a964-2394311b3b53", "comment": "Malware payload (Mirai)", "value": "485e0974f4150b80995d0cc31239c06d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088335, "uuid": "877e0773-cacc-4d8b-aed7-92b8ffe2f67d", "comment": "Malware payload (Mirai)", "value": "bdb316ce5f068497f970e243d2f5cfe6bce32359b89e1518c8085a758ddda241", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088335, "uuid": "9f5b2202-b70b-429c-baa6-cf549b0dbf0d", "comment": "Malware payload (Mirai)", "value": "762ab8b810fa3926e39b69b07c6591ef5cde4e42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088335, "uuid": "174db192-7156-4155-904d-a5ab623d5bf0", "comment": "Malware payload (Mirai)", "value": "fe670e598b95afea211ed637f3279b198f3ae7878a11554c46851b298d359d5060db530a90e268928d407e8e9d03be73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088335, "uuid": "4ea1b658-5dbf-4d4a-a98e-9a801c0432fb", "value": "T189C30802B9C18DFDC089C034577FB93AD825F0DE0239B2AB6BD4AF27694DE901A1DE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088335, "uuid": "1dc1e3ca-658c-4051-a948-f9abbe5718ce", "value": "3072:9QUXFHNzBNaH/41XvHWChrluCCqRTdJrTqytsX98L:6UXFtzBNaf41/HWCxFrTWX98L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088335, "uuid": "035a0123-c0e2-4742-a1fb-90fa8b9a8074", "value": 119248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088335, "uuid": "b457723f-012a-4adb-a140-40aed56641b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088335, "uuid": "fe548576-0fd9-4d3b-8c4b-d667f841957d", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4640b5-8916-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785086561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086561, "uuid": "8ee0ec5b-d165-415e-860e-c7eda994ee26", "comment": "Malware payload (SalatStealer)", "value": "dbcca7cb0f526cde8053addf844015ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086561, "uuid": "5f6c568f-1fed-40b2-b020-d3bb98f4276c", "comment": "Malware payload (SalatStealer)", "value": "bdd8750f6e9fe4ec6528071f52c2fac5c25e622407225450633626e0bcf39b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086561, "uuid": "7d639288-7a46-4d4b-9fd2-de577c5395d4", "comment": "Malware payload (SalatStealer)", "value": "5ec38cad7129e843efc29e5bf4aebc04c8c9bd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785086561, "uuid": "2a9b4d39-062f-4c62-aeb4-053314d1bcc6", "comment": "Malware payload (SalatStealer)", "value": "5f0098b63f18f6144a8ec80df49d62509998ec6faa112c3fb5869503ac8fb3eb6f2d2238d239d487cb4e649494412287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086561, "uuid": "6fe65577-e72b-4ec6-941b-920cdf397636", "value": "T1B3C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF8776911C6A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086561, "uuid": "4eb62fe3-29ee-41ea-9218-f3f37f158f24", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086561, "uuid": "4757b3b8-500f-43a4-95e4-d3646f657f69", "value": "98304:FvoBYLD7pdCjkFAgEMZnP4p3HX+HEvO/:CYNAkSrYP0BvO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785086561, "uuid": "8806f00f-b648-4ba7-8a48-87a5f0c4686a", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785086561, "uuid": "3b79614d-f077-4b84-ac0c-b48fd30ce478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785086561, "uuid": "688fa292-5807-4f15-afab-c6b74f44a9bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc66f11-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069865, "uuid": "356d9331-f43b-42fc-890c-0fa4eae470f6", "comment": "Malware payload (Mirai)", "value": "ddd3174904bc75da93fbf8be952c4c59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069865, "uuid": "56334c65-967d-49d1-a8ca-8590cba9184a", "comment": "Malware payload (Mirai)", "value": "bea5d44e287e6a2e0d3170248e90cd0ebe998ed4bf5cd71739fb0f9742590bed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069865, "uuid": "2b4a33e8-31e1-4c8d-bdd9-7930196f15cd", "comment": "Malware payload (Mirai)", "value": "8b6a1d687da0eb7519cbb5e2d4dcf0019d404b17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069865, "uuid": "948dd06d-4bbd-4d92-b511-13bed20a1d13", "comment": "Malware payload (Mirai)", "value": "f5fd3b6d01682035f5c4b71881b0dbfe567f3a14935a9854861ab85e56c6f5715ff757cc00dc47a61d3652200a525141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069865, "uuid": "87b66bc7-35f4-4d83-90cb-fbb0bbe7682b", "value": "T11503E1FDAA84E412C76C5A7A38DC03BA8D4ED0D033FE271C5714CDC95669119992E0FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069865, "uuid": "15dbd009-0e6c-4504-9b60-0c29e19d439d", "value": "768:62QXxh+oAYqmiGec8wpL73uOSP8a3heqbQ1a/GEWWGVMH1XEdtefTWt:VQXxh+oAYqTc8+LTuOSEahjs1R+AMH12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069865, "uuid": "fc7e0f53-5410-45b7-affd-62c3a29679a7", "value": 37936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069865, "uuid": "c7e61d47-25f6-4272-8df7-8cbaa59cd817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069865, "uuid": "344e9545-57f7-4fb8-b3bb-0d750b8d65f8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf18c4a2-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066891, "uuid": "eab6ddca-c088-49a9-9c2f-825d1e373838", "comment": "Malware payload (Mirai)", "value": "3f54b9eb771f9c142b28d45e746d3a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066891, "uuid": "596bacb9-f696-4a76-86ba-8e37cb065cac", "comment": "Malware payload (Mirai)", "value": "beafcf1f4c7d6c71244da0dc0f091ce60cf6df7925a5c27376a19456d169e418", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066891, "uuid": "7baf369f-f48b-4eee-8ba9-5d336340ca34", "comment": "Malware payload (Mirai)", "value": "30aee5dec33ca2abcfccba0e1c5438bc4b9b1c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066891, "uuid": "2913dfd0-1446-4a50-aaa5-739eada1457c", "comment": "Malware payload (Mirai)", "value": "cfddf403bf7a448bf6bbca98fe7d7bf6270b99be8c9a57f466580c08cde399c28a97f57ac87bda1445514c27c6420746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066891, "uuid": "76e27ab7-19e0-4fb8-a83c-e89f4d0672ef", "value": "T1B0531992BC82462BC2D402B6B5AE5A8C376213F9D1CB7227DD514B407BC591F0DBAFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066891, "uuid": "54da4c7a-ae60-4d7c-be20-02dcbc77879f", "value": "1536:ebbYHKTccQqJ5GeVkPU+FH5mOLrI04S2IymQY2AUm6hh1P:eXYHKgNqJQ6hh1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066891, "uuid": "d548b3e3-70ac-4deb-9288-0b07e14a9423", "value": 64060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066891, "uuid": "40c87ac1-fbb9-4e80-b895-697584211f9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066891, "uuid": "324a00f0-78b7-4b2b-a6a5-1690e5d5d5de", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e3f9ac-88b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785045152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045152, "uuid": "7a3a65db-7c46-4efe-84cf-12696259a5e2", "comment": "Malware payload (Efimer)", "value": "7832d59fea96fe229dda6dc7e9fb5aa4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045152, "uuid": "a71d6764-7b66-42b3-9b5f-d00b2cc550f2", "comment": "Malware payload (Efimer)", "value": "bed759e549a932e839a6fc57ae831105cc17bdd8ec86b5ba54d018f92f5d9795", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045152, "uuid": "c5c35bb5-e590-47b0-ba0e-f8d6da553db7", "comment": "Malware payload (Efimer)", "value": "cea91d98fb1484954501a8b38d951686ed49eda8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045152, "uuid": "4e270b0d-f64e-4424-aa4b-b590f1764815", "comment": "Malware payload (Efimer)", "value": "5fddfe3b33beb6389e21ccb2318f125f30130263f2cec725e80867ded2ce2d11e28618c884e496cafdbd4f0e95283330", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045152, "uuid": "9389a041-14af-4881-9226-5332065ca998", "value": "T1C6E6335866D012FEF9B3803DAED2D695E4A4B8234BB0C5EB0784D7A29D671E08D3C717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045152, "uuid": "6f0ab3fc-f7cd-4ca2-9234-6c74a1b97550", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045152, "uuid": "9a730f9a-cee2-48a4-8ad9-51a1bd1d9d02", "value": "393216:pErh12opkMGNgu6jWsXMCHWUjXWcuI3/PGTAI:piOV6isXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785045152, "uuid": "7306805c-bf32-41ba-8994-ea8abb1a4aef", "value": 14322602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785045152, "uuid": "cfe5de0c-2ca3-4970-9f11-8f057cc54754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045152, "uuid": "2c53a992-ca94-4d48-aa51-f1d431cbcf61", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df03a581-88e6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785066059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066059, "uuid": "3c90e6eb-b076-451f-a5b8-aefd07f24868", "comment": "Malware payload", "value": "bf2f860ef202712f0e683758ef9bc059", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066059, "uuid": "d6fe6ccf-8db9-48aa-b903-7e4d053427c9", "comment": "Malware payload", "value": "bfe16c8f2ecca2f95d59c123f007d93f6b01828e5f6691cb148b9fb4e96cb16d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066059, "uuid": "4038eaf7-3b1e-4747-bdb4-2b70d2f7c9cc", "comment": "Malware payload", "value": "cd20f4bb7f882e8b3f6db6e07535ff165699f3bd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066059, "uuid": "6870d521-f042-4882-80ef-ff91e632dd13", "comment": "Malware payload", "value": "f612d81ac145be5f0fb931561720e6eb429daa907d4d2eae9dd12d48e977c72e920688ac7c8ae625c377e3e34819c906", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066059, "uuid": "e5886d00-6b0c-49bd-9958-d31b11aab4a2", "value": "T1CA183301DA96087FD22DF97CD9E3F22582D6C98BC661B56C056BC7DDED26F0A98C400B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066059, "uuid": "598b3c8d-edfa-4288-a90c-972beb73ae55", "value": "1572864:le4hdV6xfMCginFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzP:le4DoxfMCFnF7z3V7vl385ySor0TzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066059, "uuid": "d7d55fbc-f647-41c4-b795-8af317108bc3", "value": 89248453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066059, "uuid": "50cb4772-607c-4959-9fd8-0292ee850cb9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066059, "uuid": "7a246efd-4430-4c3b-82c4-3f7de704f39a", "value": "app-64 (2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341eba85-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785104427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104427, "uuid": "ba2bb2e4-ee71-49f3-94a5-146a2b5049d0", "comment": "Malware payload (LummaStealer)", "value": "cb3416ca351652997b09bc64c62e5531", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104427, "uuid": "67c9cc5d-da5c-46f3-8ca4-7f93c6193211", "comment": "Malware payload (LummaStealer)", "value": "bfe2c25627eec3369b94ec60c1592e9cb38868f83f812a4ec506947d59ac8891", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104427, "uuid": "1a87c8a5-5307-40a3-accf-626ff022f1c1", "comment": "Malware payload (LummaStealer)", "value": "fec23a611159c06ff8ad5df619497ab71a756cf6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104427, "uuid": "8a6708a9-9363-4aa1-82a2-49ff7b049085", "comment": "Malware payload (LummaStealer)", "value": "fcb95f0066446c3a8fee12e24ef057b0d086d5d23480d6b7a402237db08fdc81289ce6a2a481fd06c3d06aadd972b101", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104427, "uuid": "dec12db7-34db-4b04-81bb-de00cde8569e", "value": "T1C9D56B01FEC744F6E602163654A722AF2335AD065F35DB97EB543A79FA332D6083720A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104427, "uuid": "6d29f26b-be41-414d-ab82-dbbc36c56825", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104427, "uuid": "e25e7a6a-1f03-4741-b0e3-c69b1c034c91", "value": "24576:c/PK76HjLg/L/uoe0dHMTFUH6YBoLCb5yA2RJXEMRpcWzf8QVO9gco7XpqrUDNPD:cXKR1dHi1b3i0XorKu49AgbQh+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104427, "uuid": "b178c3bf-de06-479f-b7ff-ffb9b5544a84", "value": 2846576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104427, "uuid": "c5966de1-0649-477d-9a51-8204f6f99fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104427, "uuid": "180371f4-03ae-40ba-ab08-b2280324d377", "value": "KLHdfs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ba91a7-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084884, "uuid": "c25a10e7-3c31-49d4-bdc8-4e2fb659ebc2", "comment": "Malware payload (Mirai)", "value": "f2174da2ed661162a2b47955e10f6dd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084884, "uuid": "4f8d1cb3-50c6-4d14-9bb8-8ca170e9b494", "comment": "Malware payload (Mirai)", "value": "c0009a5e1c33f18aa868c24ef4d95d3afd73b699045b6e6ec5c07cbbb6525c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084884, "uuid": "bc9ff612-1a8a-4515-9130-5f2e91ec5d1b", "comment": "Malware payload (Mirai)", "value": "d18099c82d4f0b50a0029f5c8ad39a99a5858836", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084884, "uuid": "749e5424-731a-476a-b9bf-00831189ae2c", "comment": "Malware payload (Mirai)", "value": "7eaed161faa00dccdaf55292433c2cbbd66ac8873cec83081a39374259a9b10c43f0718142a63476719415d07593a929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084884, "uuid": "1d45b932-abeb-4b9a-901c-1f8fc6033840", "value": "T117636CC1F283E4B5EC1705741136EB379B32F2FE1119DE47D3A89A27AC936129917A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084884, "uuid": "652ff6cf-1e73-48a2-9367-c56e7de89128", "value": "1536:pMGSGNzPoo3omMIE/UMnfPyzXIUFuOTsMkiXOSf7L+M:2K9wo3omzE/HfPy7IrOYpSPP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084884, "uuid": "be6bb7ef-3bed-4fd6-9f53-eea4e68fc51a", "value": 67956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084884, "uuid": "a314cea3-d20d-44c5-85f3-26554d7a3261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084884, "uuid": "c6e8bf98-5769-49bc-8957-9169923db1b2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93b6eed-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084893, "uuid": "c019d28e-ecf0-44ef-bda1-8cf25645b66f", "comment": "Malware payload (Mirai)", "value": "ee6f31cc154b5e3adfe7d2c7735af89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084893, "uuid": "9263d36e-328f-43c9-b471-1736dba2f94e", "comment": "Malware payload (Mirai)", "value": "c16ffde58d90984177d50fff53a48a242c97e760c68e66dd419f85968f39fdd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084893, "uuid": "3ec9a2d7-3021-4344-ac06-f21182bd8ef0", "comment": "Malware payload (Mirai)", "value": "3576eff61fdc49ea3917911d1e6ab26d8d904f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084893, "uuid": "82a34211-3820-4974-8725-1ca4edd8dac6", "comment": "Malware payload (Mirai)", "value": "fde49e60750497117084e4f6bcd985566333c2a47e6dacc94e8f5d624390b81754417072fb5a2ab6f6fd8b74fc961501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084893, "uuid": "4ce56ecb-d6af-4693-b559-d5403809508c", "value": "T1A2430891B8829657C2D013BAE6AE568D3320A7E8D2CF7223DD601B5177C982F0D77F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084893, "uuid": "3eee3483-8597-4af0-b488-aa52bd0a3127", "value": "1536:DSJ4H/puZVHF6Q1+WHvQHdU8BHOSa10Nx:DSJ4HOb1rUdbEnwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084893, "uuid": "4b96862e-a406-4aa0-9468-b7b36c569413", "value": 55820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084893, "uuid": "f1cf1e7b-2488-48ce-baaa-7f71f30a3caa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084893, "uuid": "e17715c5-76f1-4b8d-a606-4e9e5f993471", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5aff6c-88ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785069334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069334, "uuid": "a9e091ad-8d87-4162-9030-0eb87866372c", "comment": "Malware payload", "value": "13900c77b20a74d71b14e0424c4f944f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069334, "uuid": "8256cecd-8e9c-457f-8fe9-4a690ed4b594", "comment": "Malware payload", "value": "c1cc2ddea6a0684b608ddd0e2cb451c16d592259c911dccb8780b1f9239db99f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069334, "uuid": "1f007b3d-aadc-4bc3-a909-d2061c65f2de", "comment": "Malware payload", "value": "cc8387b7b56a11baa29dfb0382ff042853084c61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069334, "uuid": "893dcea6-ce79-4c81-96c6-ca611a7e6278", "comment": "Malware payload", "value": "aeac30c6b43b622d9c49f417ce4358b19d7ce4058b202ca7bfdc7f8ac223ca548786ecfb9c644edbfed2480181f4e959", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069334, "uuid": "94df79cb-e29d-46a4-94be-33632104c3ba", "value": "T1A4235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069334, "uuid": "f1354338-9996-43af-9f48-083f26c33335", "value": "768:L+g9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:L+dcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069334, "uuid": "b2197368-b819-491a-9d8e-50213151d607", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069334, "uuid": "4912de14-4c61-4cd5-adbe-d1fafe123215", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069334, "uuid": "f8021519-af1d-473d-b4ad-7e87f0d07611", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a5b2b6-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785069101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069101, "uuid": "47e53579-5971-443a-bf68-2ce9e3f18403", "comment": "Malware payload (ConnectWise)", "value": "425c8cbdbef71cda535586c769b28583", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069101, "uuid": "511e5ed8-3fdb-4fb7-a187-c499108d851c", "comment": "Malware payload (ConnectWise)", "value": "c3a697e3850d45362dc7438fcd93d4b801e9ea3c7e4aca60b318ea7ee4a0b7b0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069101, "uuid": "4562405d-37f4-41bf-93eb-1d6f907b63ef", "comment": "Malware payload (ConnectWise)", "value": "610874af104ca2f80d2b4ef1e64ef1c6e84e9248", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069101, "uuid": "31f4d287-5037-488e-a8ad-56367055fffb", "comment": "Malware payload (ConnectWise)", "value": "8fac133f1535e70f014b6748ee315222bbe304cf5b0898aa50e1cd8159b6d69a6789c355829e9b93b4f4af27e2c5d9cf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069101, "uuid": "8f946603-7a86-4ae3-ba70-db278680abe9", "value": "T10746E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069101, "uuid": "66bc88c0-a202-43df-8c67-d2f09971a604", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069101, "uuid": "9bbae955-4e8f-4be0-829a-ecaeac8b3238", "value": "98304:QzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:QhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069101, "uuid": "417dcbff-ed2b-42d3-a28b-4d705cbe84a4", "value": 5643240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069101, "uuid": "64ffbbf3-bbbd-47e3-af08-080c4ae133bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069101, "uuid": "84370a11-278e-4488-82f5-d8764f38027d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b864e8-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063355, "uuid": "99b7cf02-8b50-45f2-a582-48cd917389c0", "comment": "Malware payload", "value": "7e00ecb5f2cf6fc41eaf5d427854b7fa", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063355, "uuid": "381819b6-a003-4844-a9fb-c58d223eb0e8", "comment": "Malware payload", "value": "c44bf556dbaf52b79bed0e19e962a05d48c8bdcb26112a8c7288d0cdbf84460f", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063355, "uuid": "fba5fc41-7dd0-4b0b-88cc-01c22e3bccb8", "comment": "Malware payload", "value": "d15a12199acda3b8cecaed8e3f082eabe5df3481", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063355, "uuid": "0c6db9ce-5eb1-4516-b14a-b508697a04e3", "comment": "Malware payload", "value": "f5971efd438fdeba2dc15c9191b673f65a20d9fdc37c6309fb70614bc60f88ca7522e317d1f94b502f10e483bfb904f7", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063355, "uuid": "95cf8441-82bb-499b-89ad-ec4200d0377c", "value": "T10A853334C541835BAEC48EFDEC593A9381762881C6204BD405F0FA64596FFAD70FBAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063355, "uuid": "61fe97bf-6426-4df8-9934-d6b1f8c112ca", "value": "49152:TmW5sUPRMzfXkVrp2YExhcKsROzGxEdJuaHl:lsXphzdMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063355, "uuid": "aa258fb2-f761-4a8b-bae1-ff7d4ea25a44", "value": 1731832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063355, "uuid": "3ce51e18-b511-4c78-9a93-98f26fbfa449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063355, "uuid": "900de2e4-0991-4da2-862c-6387073173e0", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2538526c-894d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785109985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785109985, "uuid": "72bca82b-4489-4669-a58e-e0250358e7b5", "comment": "Malware payload", "value": "a26e56e773729e2927dab324996948cf", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785109985, "uuid": "d23db935-856f-40ab-a8cb-976544ff8f1c", "comment": "Malware payload", "value": "c51cdb75acfe918b90165cbeb4b1acc466b3514b9adaac055556987c61939821", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785109985, "uuid": "0e92b9ce-aa71-464c-9a93-8f94c32d5682", "comment": "Malware payload", "value": "d25c56f391d1a390ea7b3b33d569676252c59852", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785109985, "uuid": "666df598-32ed-4c38-a93d-aa9f16790415", "comment": "Malware payload", "value": "38d2ba3428196fd9250ac1f4cb61612e6211152803765425fba43de02e6dffaef3acb502e5e2f1a15290418aeb6d8f21", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785109985, "uuid": "ad2eebbc-12a5-49b1-8171-bd8f36fc2d58", "value": "T178E63345EAD02AFEE537403CEAE21186F159BC665B31CAAF075883652E772D04D3DB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785109985, "uuid": "14cf17e0-4c0f-4a1d-a3e7-9018fdc1dc4a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785109985, "uuid": "0f71695f-4229-4506-b529-c44c73158f75", "value": "393216:yB6hkkHXET0RscOjRH5fTXMCHWUjXscuI3/PGTAI:y0hkk3RBOVZbXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785109985, "uuid": "fd13f252-0237-454a-b0af-eadb7629517e", "value": 14299910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785109985, "uuid": "d8b0a675-6ab2-439c-a2eb-fac555006ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785109985, "uuid": "a5c31705-0299-42ff-9fee-cc28b9188958", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9094de2-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "e02dcece-0541-449c-a362-a2c2379fc4a6", "comment": "Malware payload (Mirai)", "value": "4fc5a1e2c8a0d5b0ba401813547b6d0a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "e50b0a95-726e-4722-95b4-8b9ff4cc8e7a", "comment": "Malware payload (Mirai)", "value": "c5d6ae3a4039bbdec322bcdbc95797ffa4c703a97b7532237a433dcde19a8504", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "37d75227-b062-4f3f-8e2f-501a98b7ea45", "comment": "Malware payload (Mirai)", "value": "85bd8952eaa841f6a64966154967c9bb73338be6", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066854, "uuid": "046991f5-aca9-45cf-8ace-0e5af3448845", "comment": "Malware payload (Mirai)", "value": "075515cb8a806b04ff5552929faf8bc2b1efa64d634f317bd70500a3bd5ad895bff926f07f7a0f4323cd3c7ca0ce1dfa", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "4da120eb-5906-4e70-83f1-73ec49baa079", "value": "T1FB43F111E2929C30C6304AF4699CD64932BE01F9D6E3702BE4535620EEFA767A1CDC5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "0f98c276-bce6-4ee6-9f9e-f7b9c9c6fa83", "value": "768:nId1dRYNdmU2XF2fc3Y0Gc6in/gMhP4DaFeWhMugL8mRUhsWErhx7Nf23z26JCQL:nIdC+nv3Y/2CAB88mRU8hxmgcXTHTgzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066854, "uuid": "cfdce203-51e4-4992-b7e0-face0c2bb56c", "value": 57864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066854, "uuid": "73e97122-008d-4a16-b0d4-0444fc179dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066854, "uuid": "c455ad1f-c53c-478f-aade-f628c7cbbf21", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf35440-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "a81e8586-c047-45f3-ad77-5dfd32fe6f1a", "comment": "Malware payload (Mirai)", "value": "402b8801ba10b2b5ed6302e543dfb2af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "9b93f7e4-559c-4c28-ac51-30a10fe2cfea", "comment": "Malware payload (Mirai)", "value": "c71446116d835b7e8d6a840b6b91e15fbce830f1ab4d0b47db9502043b64306b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "0f6e3467-2a92-4ac6-aaf1-62f33eec4437", "comment": "Malware payload (Mirai)", "value": "b417fda606c72cfa2af966bc8bd30cde53547345", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "888d21ed-75a7-46d7-bfaf-33a464674180", "comment": "Malware payload (Mirai)", "value": "294b43a9df2ea7561bfb47cf6aaee216ac3cdb85bca41efac1ba36ef28e8845afc17837a64d0696dbe93d21ff8a57d37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "74815b54-55f5-43af-8087-e104327e2463", "value": "T1D9734955B8829617C6C1527BFB0E428D372663E8E3EE3203DE155F22378B91B0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "da0e294c-23d5-4f05-9b92-0e81c24c29da", "value": "1536:WySPQlL+oRJhXxGH8ZD1eE97ZlKbBjZs7gfj1rCAdRotsjcMZYQ+tH2iL:WnPQlCohXxLZD1eE5ZlKbBjqMdCAfotZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "c7f6ca52-0361-4f3e-b77d-036b4a7432c5", "value": 79024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "e48f380c-781f-46c5-b23a-b2a2405b90a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "89cfdd6b-013f-466e-8d7a-d00a59a28d76", "value": "lul.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1138cf1e-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066143, "uuid": "30590ef4-9c39-435d-b635-3650121e07aa", "comment": "Malware payload (Mirai)", "value": "4ab60d382401f67021047215233b67b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066143, "uuid": "8e3cef8f-b581-40cb-b160-b36c8cdfe3df", "comment": "Malware payload (Mirai)", "value": "c76ba46f9595a8ad8a16736340fa5f8ca20ed65d9ecf185e249c897549b99865", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066143, "uuid": "e209effe-9b60-4535-a85c-c6257e7d8407", "comment": "Malware payload (Mirai)", "value": "1e8ab76d9c9d9e9eabcf39e950c3f7cf07e2823a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066143, "uuid": "46f4d059-a734-4108-8e72-c8783d79cc42", "comment": "Malware payload (Mirai)", "value": "ddf100544db934755f985867b78be215c2b20edb5e3dd5a7712ad45d18c551e395719c7b776eea47e17cfd7908ea1527", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066143, "uuid": "68d49ad7-fd1c-41ac-83ad-b8f47249dda3", "value": "T174733AC9B5C3F8F4EC040A392176EF319E77E13BA129DDCBE7D96623A941342941229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066143, "uuid": "e20e5642-c55f-411c-ae53-14cdc393363d", "value": "1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WWkZbqeqVr5T:9Qu3umbutmUl9lIlkeJoT2hJymeMlit4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066143, "uuid": "ad4ce5cd-5499-4184-810b-eb283557b23d", "value": 79600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066143, "uuid": "b1657909-58c1-4bff-be4e-52388237dba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066143, "uuid": "c2de4924-c0ed-4334-944d-8c37d6b5af78", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a45ac7e-8909-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785080976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785080976, "uuid": "71f230ce-80bf-420d-ae55-4b0411b1e270", "comment": "Malware payload (ValleyRAT)", "value": "6707cb6007f3617188309cfc7f43d45b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785080976, "uuid": "1fddf3e2-ef69-44c9-a490-131be3293667", "comment": "Malware payload (ValleyRAT)", "value": "c7a60fdc383336366508d5f33ace9bb8872c7769fe1673e1485f48eb71c3e2a3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785080976, "uuid": "bd2acb8a-1fa4-44bf-859c-4145dfb4af5a", "comment": "Malware payload (ValleyRAT)", "value": "b579d60b009e914bfb00d26f3a6d799a1b21600c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785080976, "uuid": "47c8090d-681b-432c-980a-2ac601f25dc5", "comment": "Malware payload (ValleyRAT)", "value": "a05c530a1940ebebd9dc9edd79013276c63b03e97614d9cce3e917c4ca5ec806a11e2ec5cdf0a8e98d36fac7f2590a05", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785080976, "uuid": "c7aef1e0-d264-476a-8078-656fef71c368", "value": "T10E4633D1BCC66372D087C7B11296313D7229BFDEBD6B8C127AE936081D72A2CA975701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785080976, "uuid": "e6ef4400-2c68-4bd2-aaa2-4d0c93515799", "value": "98304:wb3pbzeLYd+DnzSBC5xUpFIh9ZgRz9W+FGbX0PYClNGnIaT6Rk8E0MFKh50pRkJi:wJeE6zKCjEqMnW+FGoPYwH+2rE0MFKkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785080976, "uuid": "6a7570ab-e531-47bc-b184-ea744f43ccd6", "value": 5668864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785080976, "uuid": "629db76f-9862-40a9-95aa-ab53ef78b134", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785080976, "uuid": "0be00632-304a-4f94-9cb4-e6f44453c825", "value": "intll.1.zs010.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d591435-88a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785037118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037118, "uuid": "5c4e75b5-b63f-4017-a926-981b63f010d1", "comment": "Malware payload (Phorpiex)", "value": "7790768e8fe6d3bbe1b36e5457895b22", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037118, "uuid": "d3cb67d1-17a3-40a9-b396-1f39c79a60b3", "comment": "Malware payload (Phorpiex)", "value": "c7dc544ed14e75219a4eb0b02690d47e412f615f2f1329f99a00337a72b17256", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037118, "uuid": "20ab48a4-c9bf-4a3a-b41b-be0801a4c413", "comment": "Malware payload (Phorpiex)", "value": "170e68634eb1f8e2523da558f7de4c15d55568f8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785037118, "uuid": "f21b388b-44e2-46ce-9509-00b098214c92", "comment": "Malware payload (Phorpiex)", "value": "6535e895940bbc6d7bb37d294e0847ece268b3a328686947b87c5e864a5e76059d752e6295726cd0848f04a22a5aec76", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037118, "uuid": "e323f416-088b-4625-abd4-5993c312aed9", "value": "T151624B0BA4808035EBF14474827F526649FEACB623C5F9DBF7E0648A5AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037118, "uuid": "b2fe67bf-04f7-4ea0-8a35-7f88d2daebd4", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037118, "uuid": "97eb74f9-7b4f-4a51-97b3-984c4d534678", "value": "192:AWTsGnjXgjk8LcRI+gRdjMlIfeF5oIV1BKUSfEzQLd1gJxTmv8U9cth29ik:A6ScS9feroFE+yav8U9coX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785037118, "uuid": "2c0487c5-af5a-4f73-9898-ec9d1171377a", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785037118, "uuid": "15f2e4ea-c80d-441e-8075-e1b06776c5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785037118, "uuid": "1ff87eb1-d922-41a3-9e21-f6d0d9ba8f87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa0d321-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067939, "uuid": "5ea1f638-dc69-46c3-bc2b-9beba6138c4e", "comment": "Malware payload", "value": "dc1a5c0baef9d7647a9bbab151f6f9ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067939, "uuid": "84c08577-1329-459f-9b52-d66b7f7d1baa", "comment": "Malware payload", "value": "c8282933d5efd27d249ae4e879225ea13a53716c90e1df7a596cc5d6934d90b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067939, "uuid": "6c82e4ca-dbb8-4137-87f1-ac768d2aeb3f", "comment": "Malware payload", "value": "99eb36ce4a453e2f86ef39fbce17a7f824142585", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067939, "uuid": "b693c369-f14a-42b3-a9a4-5ebbb8bb2abf", "comment": "Malware payload", "value": "d826d3b04b16785c388025ca68a1d62bccb9151507fd7872ebbd83cbb1ebd4c2567c6f28519dde676cebb35412892cbe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067939, "uuid": "fd299b2a-daf5-4424-a892-b10a00425117", "value": "T1E8F086DC929154719EC0E4B3BE1388B52857D0D01F660EA834CC1CF181ACEDEA971A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067939, "uuid": "7b12a115-98d7-4612-8144-7a1c1466607c", "value": "12:my+KWK4Gq5h90A1+90Ar90Au90ArJ90A3w90n:mjbHHh9nM9nr9nu9nrJ9nA90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067939, "uuid": "ee0e80db-1560-4236-bfbf-10789a2f41b3", "value": 635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067939, "uuid": "ff699374-6b43-4866-be3e-31e9d4aed483", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067939, "uuid": "d95988b2-c5b3-45c2-81cc-9f7624786cb9", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0e27b2-88fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785076200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076200, "uuid": "6ac03fa0-1744-45d1-a731-08d2ad17e7c7", "comment": "Malware payload", "value": "c45ae18003daf3fbb4eb706976346e25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076200, "uuid": "1627f70f-202b-46c9-8e45-e864c433126a", "comment": "Malware payload", "value": "c9261d7bbdb969d26836a98e3f7b60d7d0de41b125bdbb5196c1ce2ab7d137f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076200, "uuid": "e0479d02-8c3f-4312-a399-088814971f5d", "comment": "Malware payload", "value": "55227f643868ddfdda614e469c326c0088237748", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076200, "uuid": "a745bf07-d521-45d0-bf0f-ad53348a6dc7", "comment": "Malware payload", "value": "8d004e4f0f575da229a507f41bdf3aa59086778a12182e7251465277398bbadc2930391a8fbb7d1face1c2d3129a7a21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076200, "uuid": "1742efba-c8c8-4fdc-bf8d-da1c73a4d37e", "value": "T1EF3712136690903EE56A02719C6FAE64D1A97C738A214257F3E0FF1D2DF06D27623B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076200, "uuid": "3f31aa6b-6604-4d33-b35e-575e5086e93e", "value": "2ac0df3cb49d714c81e70b5b92c304f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076200, "uuid": "19093eb9-187e-45fc-a64e-8de1d6672be3", "value": "393216:uEIKVMI4B+c6BeqUlI3eXQV3DIKde8/HNl+xnDXPD:u5QMojuI3eXWD5de8/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785076200, "uuid": "b61da4a8-cf9d-42e3-92a0-6c23db483341", "value": 24117193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785076200, "uuid": "ece087dc-e8b7-48b4-a110-335d979df8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076200, "uuid": "819409f7-34ac-42ba-ae35-cab7ba344ca3", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0725d6-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068553, "uuid": "25df2f5d-44c1-474a-a75d-5c2d3f4bb0ab", "comment": "Malware payload (ConnectWise)", "value": "71f6a618291214aeed17597086b49dbe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068553, "uuid": "9de3cdd9-99f2-4dc8-829a-fe3a53298cab", "comment": "Malware payload (ConnectWise)", "value": "c9941130661cc934a31179fb0da98d160dbd8d874e53a852da0eeab84a0a01c1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068553, "uuid": "8e39ecd2-251c-4050-9833-1c04f82b6aa9", "comment": "Malware payload (ConnectWise)", "value": "357c90a05a1e18c73886da8cdc24395dc7e9f5b8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068553, "uuid": "f50fa6fc-a883-4731-a95e-90e05a5637d4", "comment": "Malware payload (ConnectWise)", "value": "0d558f9b6917540cd64802db1f2d2609c24bc4191a12d038c194d9320080c4b1d02bcddcbcecb9b2b026b9d00cd7697c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068553, "uuid": "b972883b-a2b7-43f1-a096-88c0bf66ea37", "value": "T12B46E111B3D695B6D1BF0638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068553, "uuid": "1aa60cb5-0681-4f18-ac27-eb545ce29b87", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068553, "uuid": "1458b092-8d6b-4529-b51a-ebe58b1283f5", "value": "98304:VzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:VhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068553, "uuid": "34386de2-8b0e-407b-a3e3-95bb9a86f9b1", "value": 5612488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068553, "uuid": "4b3ccb8e-c700-4e3f-babe-9619235c0093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068553, "uuid": "5bf616dc-49ed-4b8f-b6e4-56314966a4b9", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e70ab5-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081210, "uuid": "25cfc625-bb72-42f5-94fa-706e52a06d8d", "comment": "Malware payload (Mirai)", "value": "9e8fb21cfd6aba1447c4e6599f28efba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081210, "uuid": "ebf60228-5632-4046-a079-f02cf537653f", "comment": "Malware payload (Mirai)", "value": "c9afa8c2ed6cc5e9da765cce45bc647e792ef5a2617924df0a2cd68b8ee80117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081210, "uuid": "015da480-2c52-4f21-b591-21e5873dbb5d", "comment": "Malware payload (Mirai)", "value": "61b0519c9078aa200f132d173d671adbf2aef240", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081210, "uuid": "2e6047cf-3438-47c4-abc6-d8dc8821b5ac", "comment": "Malware payload (Mirai)", "value": "9fb202f83b1c968bb1863bd63654cd9e118db4ae913bd2aa81d3aab280c2ea082b1fe6a5a28d5082e8788253754e2dd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081210, "uuid": "3a4d9252-11a3-4f01-9928-79d80b896332", "value": "T1A6F32A46F880DE66C6D1267AFA9D019C331317B8D3DA7002DD20AF2937EB55E0B7E546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081210, "uuid": "6daff080-e47a-489e-8fba-b4651703cd86", "value": "3072:AzNP9VRsduC2HXCOY5EmXeUjjUfI5t9zg8uY4/4HIQMIwPg5Tfdwerjzr+vvN:AzSEmXljofI5n0YxIQMIwPg5TfyoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081210, "uuid": "f88b087c-05be-4f26-9d14-ff19c26e2b4a", "value": 165204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081210, "uuid": "86b55ca2-8561-4340-a2ef-7664047a130f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081210, "uuid": "dcb72196-a144-4e21-a0ed-99ce3e9b37b8", "value": "flutter.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7923e2-88bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047423, "uuid": "686b2a71-f06c-4fe5-ba82-59ab54bed7a1", "comment": "Malware payload (WannaCry)", "value": "6e643e3d40a09151088693ae173f3f06", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047423, "uuid": "547377b4-4854-4d91-aafb-95af8219dff2", "comment": "Malware payload (WannaCry)", "value": "cbc3fb2de79561393eeca4d7b16fd3c86f959bae9c902b5d46887649a230cf7f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047423, "uuid": "0293ee9f-71ae-4eac-9250-49f418e18791", "comment": "Malware payload (WannaCry)", "value": "5e0d7bd9e356924f4578b147142331c88fef32ee", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047423, "uuid": "fe2d924d-61bb-496e-ac6a-622d7287da2e", "comment": "Malware payload (WannaCry)", "value": "69db5d820524aa36981f781efb56e901ebbbe5e31b94814a03acc4cc6df3905b465d836e4f9700635c15111cbc41eafb", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047423, "uuid": "058f0bb4-4916-4f41-bb48-4279e93ec1b6", "value": "T13536239671B880F8D107257484BB8E12F3B3BC2922FA5A0FAB50497A2E53F46F754753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047423, "uuid": "3fde486c-180f-4b0f-9b3a-9350fd7f137b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047423, "uuid": "2964938c-d785-40a5-b1dd-56d5ee9f35da", "value": "49152:jnsnUMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMUPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047423, "uuid": "0d7efa44-c222-4290-846d-cd838fd7a92b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047423, "uuid": "672e1a46-2fc5-414c-832a-928ad4afa04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047423, "uuid": "e99de19b-a2df-4efc-a04c-83ffe65af0cd", "value": "cbc3fb2de79561393eeca4d7b16fd3c86f959bae9c902b5d46887649a230cf7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8527da71-88bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785047439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047439, "uuid": "ac8ccf24-62e5-49c0-8fa3-04b092d6dfae", "comment": "Malware payload (WannaCry)", "value": "ff1de6f4d4f35c0a43d425822d66376a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047439, "uuid": "2705649b-51ea-47ce-8c73-b65939c1d42d", "comment": "Malware payload (WannaCry)", "value": "cc47c62f4d5bcc822047d79b90527bf66e30c294117c2d84337a87b124ae2db9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047439, "uuid": "cb84900f-121c-4830-bd47-93833db7389a", "comment": "Malware payload (WannaCry)", "value": "adaf9a0cb95be1726727732e79fba2b15d386c03", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785047439, "uuid": "29ae8416-c6f8-43c0-8124-95ec5d8e2b49", "comment": "Malware payload (WannaCry)", "value": "09c6bfd1e0484c81b05b95e2988d19da5fdae756ba6dae5439a68f47b1cc8a62487739c56b0f62be0535b255da1b3384", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047439, "uuid": "4cff25d3-abff-436a-9a38-7be1ddb9bf6f", "value": "T16936234972AC50B8D116067CA4B7CA15F2B3BC5951BE870FAB40CA366C63F81EF6C712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047439, "uuid": "85103035-22e0-429a-a3dd-05f4448a62d7", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047439, "uuid": "d4563ced-ec57-4de2-aecc-915e6555d0e1", "value": "49152:jnZnsEMSPbcBVQej/NAARdhnvoAHBT/UzeKZS5:DtfPoBhzNAEdhvpHBTyR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785047439, "uuid": "ec134a9c-b784-4bae-9a28-364fc8920cf1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785047439, "uuid": "9b6563d3-593d-4799-862f-31cf6a2237a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785047439, "uuid": "b3b9a27d-1c3b-40b3-84c7-03f43eadd74e", "value": "cc47c62f4d5bcc822047d79b90527bf66e30c294117c2d84337a87b124ae2db9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b63cad9-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "fb59e48e-cb1c-4933-8da8-d8551fa468b9", "comment": "Malware payload (Mirai)", "value": "1e183e77db8b91ec18c6ecb895e429c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "9ba552d0-5d98-4e52-8457-df33b8f3d48c", "comment": "Malware payload (Mirai)", "value": "ccc7b84f1949c2510e4cbd6d561931f88c92cb7e5e2f81ad903c1f3bc5810740", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "7484b347-5b28-461a-8213-5c0c6cb05dda", "comment": "Malware payload (Mirai)", "value": "dd5d5e9e6ef06427a8ccc766de90e70a91930e4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066133, "uuid": "ec1876c4-dc84-4c9e-918e-ac50632c387d", "comment": "Malware payload (Mirai)", "value": "9d2cbc1d7eefd2287562f20349784d536a9114b2bdc285fdd51ed5ba203ae2af7df40f49f2211aafc273e837e347cd52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "c7fbbf42-505a-45df-859d-ec13b76f15e1", "value": "T110834B0173644F0BE8AA0AF5282F17E483FEED9011F4F5846A0FDB5A4635E37255AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "44a1ebca-5ad4-4642-886e-c79ec53dd224", "value": "1536:HT4V5QNKvnu1rK3k6UHhOEBSe/RXV2eUGXVM2:H0VYk3JeU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066133, "uuid": "b1a0bd57-8996-4eba-93c5-98cc4ea59af0", "value": 83040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066133, "uuid": "01bf25fe-0673-43bb-a6a1-9b620bb11508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066133, "uuid": "8fdcb6f1-fef5-4033-b8cd-72c1a28c57f9", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb2d17b-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785070006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070006, "uuid": "27d2a608-ee07-45c5-8124-89dc2e54a722", "comment": "Malware payload (Mirai)", "value": "2a700fe21d7e3ad2becaf014dd1e5630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070006, "uuid": "5dff11f0-fac7-48c0-ada7-6f2d90ff3265", "comment": "Malware payload (Mirai)", "value": "cde67a4e9d9398de6b9dbe3732d6ac5875d737170a4f029b8b9d47ac1c930ecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070006, "uuid": "14b86ba5-59dd-4946-8b71-1df8612e0434", "comment": "Malware payload (Mirai)", "value": "32204497396c75c1e591d5e6d8d2e67555f1cf6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070006, "uuid": "08b3439f-1cfd-43eb-a8fd-9cb5fc7a533a", "comment": "Malware payload (Mirai)", "value": "63c76289d0e910dd51fc65dd6b04f8a159100b0d66a4de9f5025f80ad39963bfa23ef043a12682b25f64f0711ea15d19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070006, "uuid": "4542317c-f87a-445f-868b-b323de443a7d", "value": "T1CD730895FD428B12C6C155BBFF5E82CC772B03A8D2EE32039F159F20368B95A0E2B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070006, "uuid": "b15ae395-c284-4d8f-9422-20f7e3158e83", "value": "1536:p7X1xYCnD+/KNZFtBQoOQCFOhJkTAoprg9JBQ+8Upv6cqb:hX1xYu+/kztB6QDBoaqUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070006, "uuid": "8d94ea56-74ab-42be-8e43-eccaceb94335", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070006, "uuid": "8cc6368b-124d-44b9-ad21-0d94cd9f54cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070006, "uuid": "4ce48b66-3fb7-4dcb-8f46-c78bfa096c35", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587ad7f1-88b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785045647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045647, "uuid": "e15cd9a3-ab3c-4560-870b-4a0c13126afe", "comment": "Malware payload (Mirai)", "value": "34ea600a73ee49614f94fa9dfabfa8c6", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045647, "uuid": "f616a6df-ae6d-4add-957d-6acc1ba278dc", "comment": "Malware payload (Mirai)", "value": "ce7568afc34c67e286c731c882d03a9b2a8401b04fbd4613f5bcb98f4b09a277", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045647, "uuid": "00eb63a0-2a97-49ae-ac07-12e22a1c4a3a", "comment": "Malware payload (Mirai)", "value": "8d82daf19a076ce55caf2354b54e71afcc184b4d", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045647, "uuid": "b994d6a3-d8b2-4dd6-a212-399c4555031e", "comment": "Malware payload (Mirai)", "value": "8089a78c7f2c6b7ed2b632926b259b2be8469ab0359c0f2dbde09191816ffcefee1fd420fc7a73d0889c44ddced7a91b", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045647, "uuid": "621bff01-1c1e-48cf-861e-70691576fc8a", "value": "T19F332921B9791E1BC0D4A9BA22F74768F2F2174E25E8CB1EBD720E4EFF1464065136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045647, "uuid": "8c8f4db9-165e-4aad-9f09-5bb4035a13ac", "value": "768:mSUQn1QMaBpbq9nYXqzANtgrjIEdLgfX+3quEO+Ig:Zl+MaBpbSnY6zANtgrjIEdLgG3qIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785045647, "uuid": "7d2ad23a-95a4-45ae-aeb2-ea0d87a1aabc", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785045647, "uuid": "09dbbfdf-aa2d-45ed-850a-935cbd63aaba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045647, "uuid": "51beeb4a-601a-4314-9f32-09b6e218eba6", "value": "ce7568afc34c67e286c731c882d03a9b2a8401b04fbd4613f5bcb98f4b09a277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e9e4a0-88c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785051008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051008, "uuid": "4a7e7502-b803-4a78-9366-46e4de6a4019", "comment": "Malware payload (Mirai)", "value": "754d4cdfc72bdc6ba89ba60f7352b945", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051008, "uuid": "fe18c47f-a744-4f29-afed-412414d8ae8a", "comment": "Malware payload (Mirai)", "value": "d079a02683cde96446dae0624843f3a0ce1641a26a75083b9aef4cc8b892343a", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051008, "uuid": "2adcf2ee-dbea-487a-a707-c29392d8d02e", "comment": "Malware payload (Mirai)", "value": "6b786b91a256466431682cca9e1324276f3953a9", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051008, "uuid": "f898e2f4-7538-40ce-ad56-7f1537e23dd6", "comment": "Malware payload (Mirai)", "value": "e616b4627f6252987cd6e8a89a2c63b0fc50475c97daa1c21f94d660f31830e8e561090dea010ff4c3f103426a07141c", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051008, "uuid": "953f7074-3c3b-4c0a-8c10-c11478bea346", "value": "T1A9F03FDC00022962CC02DEEAB2C38E256088EAE436F04B18EECC602204C80C4BD30FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051008, "uuid": "6372b101-cdb9-46b7-b17f-ab908852ebae", "value": "6:SdTaoEUDKjdIfEUDKjdC3vEUDKjdYmEUDKjd4EUDKjd/vEUDL:cEeKWfEeK83vEeK2mEeKWEeKBvEeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051008, "uuid": "e1e993bd-977b-43b0-8bd9-3107ad28fbfa", "value": 461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051008, "uuid": "2040f71c-110b-470e-a31c-bb35a52aabaa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051008, "uuid": "382ed251-91d5-45ea-a3ab-ae5b93c2192d", "value": "d079a02683cde96446dae0624843f3a0ce1641a26a75083b9aef4cc8b892343a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad01368-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "82895cbe-0753-4e50-ac68-37470ebd88bd", "comment": "Malware payload (Mirai)", "value": "44e117ec001881184d8b0e512fe0ac0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "9037cc66-6a31-4445-b737-5bb19d581253", "comment": "Malware payload (Mirai)", "value": "d08416c22c4c82875abd8ca25a492aaf8f37c403ae72b76909f3faab063a3aac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "562abda3-cf27-4279-b969-4431423ae766", "comment": "Malware payload (Mirai)", "value": "e370d4ff8060fe9adf159e871e903122c994fdee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067931, "uuid": "1ef9dfc0-101f-48c2-b58a-6817c5420bad", "comment": "Malware payload (Mirai)", "value": "dabd8dbedeb910e2a1d1f4759d398ea18657ba6967c7ddaba05e199f337005fb77637fa188f8637555ec78889babc90e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067931, "uuid": "f5ae9bf9-046c-4cba-ad12-d2e73a87d447", "value": "T110319A91A7D09D7DC8F492BE9E4B4310B3699F00E0CA7122830CA3596D2AE3D9D2B04A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067931, "uuid": "9474a4a0-28cf-4105-a594-5beeb03e3422", "value": "24:uTcRKGpa7Urz/jlf3LXK1hH9Vev3gRGH9ixBBuLlw9gjSq:uARKGpa7UrLZ3QIzCBuOZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067931, "uuid": "2de16d7a-16ae-4cea-a6d9-704d10ceb55d", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067931, "uuid": "adf689c6-538e-41b0-b50d-ff53d8fa21d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067931, "uuid": "315e8c95-fb19-4792-a6db-24d834a7b492", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0323884f-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785081152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081152, "uuid": "a8f365ae-ffcc-4f6d-be45-b8f96172a261", "comment": "Malware payload (Efimer)", "value": "ecb34124a63ba0f56012e29de2fa60b9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081152, "uuid": "4ad07c76-1092-49d0-b2cd-d810753576d6", "comment": "Malware payload (Efimer)", "value": "d09ecddb706b55f3b2980ee9aec109326ab7bacb33bc7ab46c27ada51ff646c6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081152, "uuid": "1e260829-feb0-428c-963f-5e7fcaea910e", "comment": "Malware payload (Efimer)", "value": "b012b8e6468627028a688cadd652220b39080d6f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081152, "uuid": "f7511c35-e12d-47c3-9c3b-010affdc17b5", "comment": "Malware payload (Efimer)", "value": "822cbb7daa3df4319aba84a21c0ff47ae8886783d097157948d59cba85e57b19f753f63b30d3c86df91d9d6d00f4438f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081152, "uuid": "1ef7b2a0-5779-4603-90a3-ae83caaef357", "value": "T175E6335C6AD001EFDA33403DDAA13696E6FDB4BA5BB1CACF06D843A42E031D1983D657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081152, "uuid": "8c4c599d-89c4-4378-91eb-3f61b5c23932", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081152, "uuid": "bca3c872-98fc-4003-a34d-f81811911dcd", "value": "393216:Rw8Z2MfSL9dd+nKCMoXMCHWUjXacuI3/PGTAI:Rw+2M+ddtroXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081152, "uuid": "3a2c54bb-0ce3-4150-8426-3c63a00ad837", "value": 14307879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081152, "uuid": "c70cd6d1-c331-44c0-8566-2fb78c06d9fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081152, "uuid": "8281d56a-e352-4cfa-be29-4dd3f1923a52", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1d03a2-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084898, "uuid": "68e715f6-27f6-4914-baec-6b972f932b42", "comment": "Malware payload (Mirai)", "value": "100878c76ee00bb02a2847db65c66f90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084898, "uuid": "6eee5f0e-d17c-4d1c-93c8-e837c8253812", "comment": "Malware payload (Mirai)", "value": "d0a66e1252c0d4f9f49f9296031495ec9074f40f7dbed4404db26300d678b6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084898, "uuid": "61ca789d-d59b-4d6a-a788-8a01f47b63e5", "comment": "Malware payload (Mirai)", "value": "532d7cbae1a5e1bc0a7550c907c0c94fad5e8d53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084898, "uuid": "bf69b151-3ca6-45ed-a769-001dcfc0b7eb", "comment": "Malware payload (Mirai)", "value": "a034fcb5a072a649209ca45f7ef605ee43bc53afaf0a6226aa801acc9ab4a45eea8992a5b54cdd2c3c01f2c9f17022bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084898, "uuid": "e4cad129-4121-4c19-8087-8e67cfd242e8", "value": "T16AB39D9BF7471591C85307F40BCB0FDE6E2322C2AF5B89E36D6E257A08790DB1906B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084898, "uuid": "bd55d8c7-174e-4cb9-ae11-24e65aef76b9", "value": "1536:nm0x90d4YcNbPPwlkseLNayrWpsVb9Xm+jrgOma10D/LWT1:m0x90d4Y8AlkhLNJSpsjXm2rgOzqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084898, "uuid": "8b05bdf9-e789-446c-ace2-db53f7da1b89", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084898, "uuid": "b10d3edb-036f-4a2d-b15c-20e118cd6a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084898, "uuid": "346377ce-341e-4216-8e81-3c61e68b150f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864fd0b9-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088244, "uuid": "30935209-90de-4318-ad7a-c086ac5f6c69", "comment": "Malware payload (Mirai)", "value": "b1f251bac3a2a87e63e811c1251c6513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088244, "uuid": "2b604491-b856-4be8-8bd4-5ea3419a2433", "comment": "Malware payload (Mirai)", "value": "d1272c36897a7a76a35c07e47815c05a86b15138854438c104790e94d3e286b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088244, "uuid": "7296b486-ce8e-413d-9333-b88418ce46ff", "comment": "Malware payload (Mirai)", "value": "673333b80d2517a47e95279c2239ec3e51ab848d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088244, "uuid": "bbb55700-65dc-483e-bb9e-3c7dfde6a876", "comment": "Malware payload (Mirai)", "value": "b2df55da37ef6082c94f219994c031af9d810321ab2d66df4a792a1efd966b9ebfc5940874459d837f5871cfd032f88a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088244, "uuid": "030ebdda-0af1-4758-8f43-2c9f10e28ba9", "value": "T1B623010648D2AA05D6BFA4BAD8CAB911107CD12755EFAEEAFE78001B0124F59BD34323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088244, "uuid": "d8ef0876-ba75-4639-94f5-e9272b58ccc7", "value": "768:HmYc+qdFDe8e6yKkljQMVUXIbDiHIcLtddn55qqU5Pkn6y40GOPtQnbcuyD7UHQk:HmYfEU3KkJ5UYDiHIctdFau6KGOP2noG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088244, "uuid": "a9cef412-b9c3-4807-8949-254bd8d53287", "value": 47600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088244, "uuid": "f0832e72-4a32-4b6d-8390-da78ed1f65db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088244, "uuid": "d9c25709-d484-440d-a2dc-b6dd31173d81", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6042e3-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069869, "uuid": "edf30dcc-2535-4d45-a8b3-958fc5c6c699", "comment": "Malware payload (Mirai)", "value": "4bb7857facbc2ccb04911b67708aa762", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069869, "uuid": "940437bd-ec3b-4083-a2c0-892f08e07a67", "comment": "Malware payload (Mirai)", "value": "d1c6cac2af26151b4d2b2e29d5385a0c9e296c14c1ca238a79b19b6fab6eb5e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069869, "uuid": "08e00da4-a4f8-46cb-b8c9-76bc38b45407", "comment": "Malware payload (Mirai)", "value": "762ef0befd75851042d140bfb7243c3aef18c190", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069869, "uuid": "14d7521a-9da6-4d63-a46f-b77e807b56f5", "comment": "Malware payload (Mirai)", "value": "48375f6ec23e36cdb997f23a59275d7bc3f7198189bee5fb5d59c99c85fbf7551c4f4a4b06309466a6f2962ee8a0eb13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069869, "uuid": "6b737ad6-6af6-440c-81ce-3391c9228aa8", "value": "T197F2E1568182EAF8C01B6AF33C9B0B87FAA57CD8511507DF09A875A907C7FC80E34790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069869, "uuid": "5aa2004e-6f59-4f51-b536-228292756181", "value": "768:dqdVgpO4nj1YuUqg9z9HuiKaW4egXzqTG6xnikfDbVsZL4mMyZlkx02y:MgpNAqgVTTW45zAL8QXVsemMyZ2ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069869, "uuid": "e26e36f0-427c-4361-ad2d-f7746a657eb6", "value": 36556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069869, "uuid": "6b2ff5ec-dca0-4f54-be63-2fecfc626227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069869, "uuid": "2d05aa5b-aa52-48e5-bd1a-5c15447ed9ea", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bda029e-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "6db24424-340b-4f91-9886-c0beb91a02b9", "comment": "Malware payload (Mirai)", "value": "d7f9f1054e1d51395fd410c0664e1a95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "38893327-9f77-4f45-910e-b18f2836c912", "comment": "Malware payload (Mirai)", "value": "d1f20702db353c219d6e5492727c9a2cc44788d84e3a7391aa009430583c5fb0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "a3392911-b10e-4c0e-8577-fe2d8d6f70f9", "comment": "Malware payload (Mirai)", "value": "0ffa07dddd2f8b93d217323f8d059d447779e437", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "c98a59b9-70e0-410a-abd0-73d6c8ff37d9", "comment": "Malware payload (Mirai)", "value": "471d7736484a095a3e7d87348d9b56800bcc6752e59f7aa27f8329113fb69925ea5e0eff22e2532e3d59c66b87c619b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "e531c736-7068-4988-858d-9fcf20419d4d", "value": "T16A21CB96A7D3AD17CC540273DC9F5710E362AE41868EF453F36222150C3E21A1F2108A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "157a2c4c-76be-4f48-a90e-35d7d4eb2031", "value": "24:JColMlgP9qD0at6EoNGhrUlFSy40VzLCkIdsx2HuGI9pNfc7:JColMOFqDPtjrkFSy4CzLfGI9pNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "754e097c-cf0a-45f6-8c9f-70c736879a94", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "b2b06ae5-40bf-4bc3-9fbf-8d3a37e88c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "36fa56ef-d182-4044-a6a6-67dc7aa2b517", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ae9060-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088249, "uuid": "da0c0fad-6bba-4d41-9baf-060c9f6cc442", "comment": "Malware payload (Mirai)", "value": "a960b32caee02874aff619f7f9498aa8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088249, "uuid": "42ba64d2-16e2-490e-8616-dbc7adb93365", "comment": "Malware payload (Mirai)", "value": "d22ed365fc28f998ce90d85e4d4c529e4861dde56b0ada2f3865742f199716a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088249, "uuid": "816b34d8-f78a-4ee5-9754-d9dc488c1bf0", "comment": "Malware payload (Mirai)", "value": "7d2a46280f2703d699eaa0a5f70f8f0439d9cd04", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088249, "uuid": "b34f136f-681e-4650-8786-d69de3172d65", "comment": "Malware payload (Mirai)", "value": "ef814904f43ee9e4ac1a40a900afa090db1c767b32e20c73ba96d4523ee7512c7ca5b99d1c72c5076370c8eb9a5b76f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088249, "uuid": "bbe920aa-7888-476d-abc3-952944336108", "value": "T1AD21F6C6100143342FE2DD23FABA4C1930AAA5DA54D7CF5D65D9B8F088CCD0D3955AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088249, "uuid": "420b1f6e-9350-4401-9aa8-e5e13c5d1a1e", "value": "24:ItGPtsGd6dIhOEG1Y3GY/AGKDPsG2sGzTRzTGFC:inDEx3UaWYTdTGFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088249, "uuid": "5b1ff7b3-1794-4255-a4a1-33db12d606e4", "value": 1309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088249, "uuid": "33b15639-461c-4f44-84d0-411126838867", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088249, "uuid": "0ab852aa-3eb1-49d6-89c1-511fb53f38f9", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b473df24-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084885, "uuid": "8c3a84d7-dbe2-4918-a63a-18268f2e989f", "comment": "Malware payload (Mirai)", "value": "d1bb752c0b5c3051a765edc6b5d3c26f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084885, "uuid": "b014fead-acc7-4e1b-8f59-38ef9fd721dc", "comment": "Malware payload (Mirai)", "value": "d2955089f2162b998509f46497cd0b41f4b23a425e09ccda0240e457fc981cde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084885, "uuid": "cc82c315-1835-4183-b037-bbb8c06b2f36", "comment": "Malware payload (Mirai)", "value": "648dc1d55009a1d5c8798c147136f80567ab8f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084885, "uuid": "a22abe4a-2984-4953-b646-f38b82dcfd72", "comment": "Malware payload (Mirai)", "value": "05c062c6dd0c87ab1f50747863b12db6a1e9a3fc3d05d6832f5ef552a7e300a57f46b6bed9d2c220c7d584d8b6cffd5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084885, "uuid": "88541318-ffc8-4f33-a6f3-02974880c49a", "value": "T10D833C96F801DD7DF80FD67654270D09BA70A3D152830F3A27A7FDA3AC721A53816E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084885, "uuid": "648c6b5c-47e1-404c-a723-c9fb69c032fb", "value": "1536:F/404sp3L01WLqFgZ+zOC/72d8YT9PmZH8HwVcw3Dr/ZhryHLYS63:FwZgZ+ag7258qHucaLyrYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084885, "uuid": "a6320718-7922-457f-87c5-ce15a6e04865", "value": 81976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084885, "uuid": "6725ba70-831c-4fb1-b947-784fa724a1c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084885, "uuid": "2267688c-4ec1-49e5-a109-97e6618493ae", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f95668-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063351, "uuid": "e55e0dd1-2126-4de4-9fa1-3af74454df01", "comment": "Malware payload", "value": "61bc7cc4404576947895701ecc78a5a9", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063351, "uuid": "040161e5-3f03-4675-bd4c-82039626a871", "comment": "Malware payload", "value": "d2c2c3153276f7f4e42e58463a6d76146dd256568065634e32ad5a908c190632", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063351, "uuid": "49dfb4e9-afa3-4e41-8865-16dc9aab21f3", "comment": "Malware payload", "value": "fb286ee6e6fcfb6618ac2f8e675100da457e03e9", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063351, "uuid": "217ce47f-2b8e-4b39-a35e-2f3c9ca312d6", "comment": "Malware payload", "value": "e669eecdf34126244a6202a4dfa5cb41b472dcb1e381b41bb2b438983ddba8a5db5169756dc573f0b8e804f2d6b2626b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063351, "uuid": "0312ae11-c754-410f-b67c-881b7d7f854d", "value": "T164753332A158EC39CAC62D59094434DB5CA4D11FBCC3DEAE77F045DFAA57282F9248CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063351, "uuid": "5f61c268-6a62-4e8f-aa3a-ec1dbef26d35", "value": "49152:MS5pBppI2jJRYwXxKdXPwKy0cAp94vE9w450u+9RsQN:MS1b7b4NPpy09pKEpIR3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063351, "uuid": "4eae94a9-00b5-4a22-afd5-2193f7aca466", "value": 1678356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063351, "uuid": "3d72d1f4-31b4-4718-b368-c898e6077754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063351, "uuid": "9d0b4e2f-4c87-4353-8be7-4d2ec7a9ab89", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd02767d-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "f94b092f-ad48-4faa-ac4a-75a7dfebeb40", "comment": "Malware payload (Mirai)", "value": "fc6eabf94e47ea98c240e3ba2ee8f594", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "04b8c8f5-9254-49d5-b0c0-dc8e0c109309", "comment": "Malware payload (Mirai)", "value": "d2fe0180ccafc433827ec7b490efd785bb289273f2ebe7abbadfc73671112e68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "21f5bf7d-7c14-43fa-9dcc-3b00773431fe", "comment": "Malware payload (Mirai)", "value": "4a0d217e80f209c6aabd69e8f0bdea6e38b5ed66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069867, "uuid": "425d5a63-4d27-4087-9bb0-69178b770866", "comment": "Malware payload (Mirai)", "value": "2ad5bcc51c4527a44e66c723d8fcf523d97dca421d1a379b7fda4dd711713448b5931f31dd527bac6f9e63f46efa3263", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069867, "uuid": "b06f4303-c9e7-4368-b74e-c15dee68c3b1", "value": "T139733B62B636192BC5D0E17A61F30335F2F743CA14AC8A1B3D614DCCAF65A4036677E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069867, "uuid": "08734faf-9042-4863-ba2f-c1f06b16271d", "value": "1536:TRtd7YSHBHgy+f4ZNk5prgu3Pjtnh2t2QmO3k0:ntYSHlgy+f4ZNUtxqL00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069867, "uuid": "f2785384-f0a2-484e-bc20-d837e968ea5d", "value": 78644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069867, "uuid": "e6d2c976-d47c-44f7-a838-2490f79175d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069867, "uuid": "12984aa3-e126-45a4-8a7b-ccf44bc373fb", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49261e12-8889-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785025864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025864, "uuid": "d84e5972-3a40-4303-adab-0a845f8ede6f", "comment": "Malware payload", "value": "cb32d0112a42ea06111dc597a73400ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025864, "uuid": "de8b8f50-f858-41bf-a14f-c835b0380ee5", "comment": "Malware payload", "value": "d3eb1b2e2fab88aad1ee2766aa4c0e8dc48f610f8c43bfdd654d0b35d926b0f3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025864, "uuid": "784beda3-0f89-433e-a81f-e0dff394aee1", "comment": "Malware payload", "value": "c2ddd3a1f3e1462802ed5d2a076a81f775a5162e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785025864, "uuid": "e0937663-2671-4ef7-9218-46bb8c3d6cb7", "comment": "Malware payload", "value": "0e0245d0ca8b83b2947fac33530669af2eff4761835ebfec19c0cf49a02404c4bc424b0a807430d850bfef063bcfba83", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025864, "uuid": "0a2278f1-cb46-4643-8444-53b59304725f", "value": "T1B401AFCAD250992050AAA41D32D75166F431C3C715CB5BA6BF6CE47D9B98E04B026F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025864, "uuid": "3ebbdb4c-f272-433c-a8ad-14ba9189bff7", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaaCXCJGFF9x8C7nvCw1QCLBCNX:kXCKysE2hi0ziQvZohanY68avSAUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785025864, "uuid": "be04fa4b-0130-42ac-aebc-24a4d890751f", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785025864, "uuid": "eb4ce72d-0bf2-4b2b-9a77-106d6e18a03e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785025864, "uuid": "b6f92164-707e-4ca0-ad3d-e2d6727f74f8", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e5bbf5-88b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785045644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045644, "uuid": "f5c1fa73-331c-4d94-a96c-f47a63c6fa03", "comment": "Malware payload (Mirai)", "value": "8e6cac531b6f8a9717b44f0975a71d51", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045644, "uuid": "1d4523d0-f811-47f3-822d-3c978a7c67ac", "comment": "Malware payload (Mirai)", "value": "d487a3bbd941c891d83433d955b05d9a569a04a61f8dc6b33b79c8842dc42100", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045644, "uuid": "a609f0d9-091f-4415-b955-6a2bba72dcd0", "comment": "Malware payload (Mirai)", "value": "7ccbaa605e1268afe762ba728cf6923d8a121dbf", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785045644, "uuid": "f9c66d47-eb68-4d0e-a274-cf98678f2d27", "comment": "Malware payload (Mirai)", "value": "4dd77b240c2feca3cc9a29b95d96ffe83e9128210788ea90b29eed55e1384a9da08fbabbd45fa1c7b5d8f7d8a2917404", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045644, "uuid": "01520c98-3d41-4e06-93e7-51e86a83be5d", "value": "T13D133AC0E903E9F4DC1546B5317AF7799BB7F03B112DDC87C3A8E836A846A41D6062AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045644, "uuid": "f82614a0-9676-411f-b176-ed86dbb67718", "value": "768:uz+lspGNniKngQlUDM7rMq4NHyIZKktZJ8LxtQAJ/9M2+Hfgt:uzispgniKngQlUDSrMq4NH7EL0AJ/9M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785045644, "uuid": "9cfbe37c-9123-423c-86e0-a4b00b6494f8", "value": 43324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785045644, "uuid": "d49b6b63-bae1-4d6f-8331-fa560ed74a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785045644, "uuid": "059a0bf3-6696-4317-88ed-87fb1c6761a9", "value": "d487a3bbd941c891d83433d955b05d9a569a04a61f8dc6b33b79c8842dc42100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49c28d7-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785088321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088321, "uuid": "8975f1e8-3859-4a7a-bfa8-094d736b1051", "comment": "Malware payload (Mirai)", "value": "43b71e1aa3140b56cc873a19f49144ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088321, "uuid": "b635fbce-f170-445a-860b-b0484c3600b8", "comment": "Malware payload (Mirai)", "value": "d4c1e99b7564c51f761896b2f2ad77c7706d96e3907cc075a674223b66522463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088321, "uuid": "a609c8f7-0e58-4e52-a3aa-da2085d6405f", "comment": "Malware payload (Mirai)", "value": "83ac9fac8e9768d05bc4a7168645432485b7503b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088321, "uuid": "854f58cc-c8d9-4842-a486-75418112974e", "comment": "Malware payload (Mirai)", "value": "72047b7e49e6708bf4db9e2b46722533b1ef90327c88c769a79cc32265fce16f750e56aedd3b763e75d6b53dfb07a58a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088321, "uuid": "a1f5425c-429e-410b-996b-3b1765407245", "value": "T113B35CC5E243D0F9EC6605742136FB3BDE72E4BA1129DA43D3F89B66BC52681C80679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088321, "uuid": "6957fe51-3687-4039-a855-e97816cedb9a", "value": "3072:nHgHynlsNpZEWPMwVN/h197Z+S2NUsDMHcnona:HgHynmpZEWkK/hYfMHcoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088321, "uuid": "455eca21-a24a-4c59-807d-b2950c4ffd81", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088321, "uuid": "e592f1a6-e6bf-4754-9be2-b01d55eae1b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088321, "uuid": "9ff92747-4159-4513-b463-fe6a8b44b1d1", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd832b30-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066888, "uuid": "053e19c9-7c4d-4eb9-b67c-09d933b29ffa", "comment": "Malware payload (Mirai)", "value": "8f8b9897e79a21998a0910dd5dc47477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066888, "uuid": "3b8dc1e2-fa96-4f48-b432-c61dc3606b3c", "comment": "Malware payload (Mirai)", "value": "d56d9bf3888b6cedebd5cc25cd8d78208bbc89f1ad3639e58c0dcbe2fc282cf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066888, "uuid": "f55a53c6-801a-4ac4-b91c-221af03c06ff", "comment": "Malware payload (Mirai)", "value": "d92aaad673258e1a2984206e4338d7bd733ebffe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066888, "uuid": "c59c87fb-a301-48d5-a409-b2194f3a4960", "comment": "Malware payload (Mirai)", "value": "803136e77e81ae1f41c45e58f48f349d4c094816639fc292b4a571d8738b9dc1313c235ecf9d28fa43a5326b0035d289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066888, "uuid": "e8eddb6e-faff-4df1-85aa-da3097bc41af", "value": "T1DC342B46EA414F13C0D727BAF6AF4245333397A5D3E773069924AFB43B8679E0E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066888, "uuid": "a8adbf94-ab39-4b2c-b930-126b50e7aa1d", "value": "6144:iSIs6bRUQLy7CPC9axohzWXW8gzw2zn2Qoikg2MTHwM/R1vMFmK2BBg3Wn:DIs6bRU8PC9axEWXW8gBznRojgTl/EFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066888, "uuid": "edc1bb50-c661-45ec-9a22-a59af0bd7898", "value": 236344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066888, "uuid": "c2baa395-81ad-4d21-8b75-97aa23da7cd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066888, "uuid": "3aaa6041-4552-4c6e-ae91-adf58d8c89f1", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0979fac0-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "c1cde430-01de-443d-8f1b-15d5e443f3dd", "comment": "Malware payload (Mirai)", "value": "2f498f629ce576961792c3049a54934f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "7b1b16ef-2987-43e7-9d49-8d5445446ca8", "comment": "Malware payload (Mirai)", "value": "d5f6faee9fc67b829ed1bcd8f118bba5de698a8bd156500c3133a89c3a2e3211", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "db7db895-72ae-4f1a-a243-1ce5f116af7e", "comment": "Malware payload (Mirai)", "value": "e552f6962ce8e8028e7f79c63c17b16f53ab8fa4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066130, "uuid": "fca15003-09f4-4f61-ab11-207979512515", "comment": "Malware payload (Mirai)", "value": "75a42b2a21192003c334b720a14da58e7e9adf51d9204016d95f6eb651e6fa3300dc016ae566f7ccb7be8d3207d414f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066130, "uuid": "55de9ba7-8365-4ab8-b3de-fee1023391b2", "value": "T1DBB3950E6E319F7DFFAC823857B78B219209379626E1D584D09CED025E7038A741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066130, "uuid": "46ff9962-303f-43ee-bcfa-2d98c46ed830", "value": "3072:er3x+xpNAsh+JySL/BjtcD1E/Bl8eNElkV:ex+xpCshOyS8D1E/Bl8vkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066130, "uuid": "b0954e4f-ef89-49c7-9959-2ffbcdde62cc", "value": 112980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066130, "uuid": "6d02330d-68b4-47cc-8f71-56153395be8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066130, "uuid": "3a036a9d-3179-4d31-81d7-94e7cda9b513", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870113f7-88e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785065911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065911, "uuid": "2a772935-13f7-403e-a9ac-e0c6164a6c26", "comment": "Malware payload (Mirai)", "value": "f7eba755feb7748b0c1caf7f69126730", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065911, "uuid": "130bdf10-ff99-41fa-bdbc-a308461dfab9", "comment": "Malware payload (Mirai)", "value": "d5f9a6f9e8ca1730a1bbe40ead470b2f6ec88786841dea97a589a0df47d4105b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065911, "uuid": "6b4673ac-4062-4768-a74c-2266ae2766eb", "comment": "Malware payload (Mirai)", "value": "45cd518aa6af553b2cb52aebcbbb6b371611f19c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065911, "uuid": "3e644be9-faf5-4e92-b7a7-f8ce6036e05b", "comment": "Malware payload (Mirai)", "value": "2adfc35be3cec7ad1c13dda9a0297cb347a6afa2839e7e2cbd46eacbff41df40aa168e8f3a86b1fb609dd5cbaf336d38", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065911, "uuid": "37de011c-9374-4d09-aefd-d139d2b75050", "value": "T1FD01CECAE260491041A9D95D32AB5464F870C3C7168B4FA5BF6CE83FAF88D04F026FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065911, "uuid": "e73a9d2f-2e40-439d-843f-e269f0691b08", "value": "24:kXCKysE2hi0ziQvZohaS/XcyBddV4JZYX:e9Qp+MsS/X33L4J+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065911, "uuid": "c97efa86-359f-42af-ac97-719ebf702e8a", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065911, "uuid": "642dc9ae-4dd0-4bc6-b72b-f61e1d9b5822", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065911, "uuid": "977fefa2-c2e2-4b89-aaf9-014f41e82b65", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab20cf5-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084895, "uuid": "74a5d02f-3883-42e6-bf17-bf7bc4b5d82d", "comment": "Malware payload (Mirai)", "value": "d4e014c1bbf53fe417fd6d5a5e1fab5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084895, "uuid": "79875697-f5b4-409d-bc9e-b6b864c0f213", "comment": "Malware payload (Mirai)", "value": "d651b3fc7cdd3aba3039cd94b50ddb385139a85bff6c3c55b3e27ed0cf8f96f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084895, "uuid": "3f0ba8af-676d-4c34-8c02-dd1f7314fc08", "comment": "Malware payload (Mirai)", "value": "106dff5f4db608464d34bfd8d083dd0971f8e20e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084895, "uuid": "46ac6785-69e6-474e-abf1-a6331ce4e84c", "comment": "Malware payload (Mirai)", "value": "25b6aa8d6729a933e464486cf910130b3686c51edb62ff10eb84bf05109ec0162a38a1236681d7eb96345f6ec3e83a5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084895, "uuid": "d74464f6-f91a-4767-81b4-7737830ed285", "value": "T104A32915BF240FB7D86BCC370AB91B0128CCA55B22E57B3A7534D81CB64B64B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084895, "uuid": "646d573f-7336-4689-88f8-5af90ae9bab9", "value": "1536:JgVJGmR18mTEH8HlTQHNjOzZ6hVwZIfUQ8cpJa10FM:JgVJGmL8GEHolT6nwVQ4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084895, "uuid": "ac464d10-845a-4f8d-8678-7942b6dd4ff1", "value": 100140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084895, "uuid": "e64981fb-a2e7-4203-b74b-e9e44b39a9f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084895, "uuid": "af1dd630-7b78-444c-a812-fe1236ff07f8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48581338-888c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785027151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027151, "uuid": "d4e23e4b-6957-4153-8a8d-dd982c9fa0d6", "comment": "Malware payload (Efimer)", "value": "d2ba2c17a668eb9c2cea61159e061e60", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027151, "uuid": "1abae928-d010-4ae9-81a5-568bc2c1d699", "comment": "Malware payload (Efimer)", "value": "d7be04c19b1d908e4d33edfdcf3fbcb15812763edb905ce1fa46233368181086", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027151, "uuid": "a0f7f3dd-e5de-4971-9d97-59014a94e83c", "comment": "Malware payload (Efimer)", "value": "cc8121380454762068053a195ef20e5798a6a859", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785027151, "uuid": "daac4525-4d79-4bec-916c-75a6e1690c14", "comment": "Malware payload (Efimer)", "value": "3979a68fcbe3f7889b40fa922efe550022deb46696f1d5e07f199877ae3060eec0fe615691c6dfdd098c02045cfdb610", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027151, "uuid": "9bb47454-2ca5-4284-a608-0a5a9ef446a4", "value": "T161E63358A9E011FDE933803CDDF0A588F226B4A60BB1C6DF5F98D3E16E531D0897DA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027151, "uuid": "c7ff02e3-c377-4ec1-907e-9f3c71cdc076", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027151, "uuid": "6ec3b46e-ef6d-475b-a537-44c24c8dc6c4", "value": "393216:9Y1/oYRdlIdFqw+XMCHWUjXacuI3/PGTAI:9qhL2R+XMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785027151, "uuid": "c0061921-5646-44a7-b8df-502e093de741", "value": 14301850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785027151, "uuid": "585c96ae-8277-496b-a0a2-a94706672305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785027151, "uuid": "8d8361a7-ef1a-40fc-ba73-93f9968f4d92", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9096eb-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "cfe4a50e-fdbe-4219-acf3-07a30c669178", "comment": "Malware payload (Mirai)", "value": "27ed0912055390923ac10806ce5801fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "db1d6beb-ce6c-4fca-8d1a-4f90953bfc6e", "comment": "Malware payload (Mirai)", "value": "d7d5612cb9584258bb10398507b5aef9f449d9943181f6757e31ae63130f7277", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "073811a8-eb3a-4ae1-be81-3b3cbdef5caa", "comment": "Malware payload (Mirai)", "value": "6725dfc528c32d080e12d04e8f3e542eda39e645", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "d7ae196a-20ca-4642-82f2-4270f9e26651", "comment": "Malware payload (Mirai)", "value": "f15a42ec132e2d6b77097b01abeca99aa65fb61b1c1fe128d349fa73e4cea3e052d1684b513740ef2bf66afc70eccdff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "d892c7f9-2e3f-4b30-9a3b-337a2db14943", "value": "T11841F01E6FC01F33DDA6CD36154B27553ACC842BB06A63916374E960BD3E605E7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "81464c33-7aca-4543-9675-158f881ad89c", "value": "48:kff2ipnuDW3B6df9aOScTLmPkOTvFSXZ:kffPnuqYf9fS4LmrTMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "354e2c00-49f8-4acb-ac5c-f25c3986dd9b", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "3e593dcc-be88-4328-82ed-5a2f536fa7de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "0f33bcd2-e6e4-485c-98bf-a9d6070ecb71", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a142ae-8940-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785104461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104461, "uuid": "c7e794b9-09d3-473b-b1ae-09e9c53846e2", "comment": "Malware payload (RemusStealer)", "value": "2ef7a8539ffd93b31ac86add92a3df0e", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104461, "uuid": "4c4086df-471c-4b48-992a-3479c77f9d63", "comment": "Malware payload (RemusStealer)", "value": "d84d9eb1e140f0f320976cc8219a6fc31136a2a1d5b89a55f8fe6217b170ae74", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104461, "uuid": "a889f2be-be63-4dbd-87c4-a4af24ca4719", "comment": "Malware payload (RemusStealer)", "value": "575188273fc0030ebb146b7ac8e1c9d40e4656c8", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785104461, "uuid": "cd1ca2b3-b42a-4f0c-b5df-8795bf0cae0e", "comment": "Malware payload (RemusStealer)", "value": "4113f7d73712959be22070b56bf9703a8c5f87865dc2905712be621c4ff32ea6952535fb7c455b3e56cc4aa60beaf9f4", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104461, "uuid": "f9f9ae8c-cd18-433e-acbb-a86c07898d2f", "value": "T164C55907BCE149F6C0A9A33189B256527B71BC085B3223DB2E90B7382F727D19D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104461, "uuid": "bc4532db-2374-415b-9bb5-5624770f0552", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104461, "uuid": "d6b5fc44-fe53-4323-bde9-5a901624a647", "value": "49152:I5HaEYwqHtBFgEp7Ewk1zWwG7jfJbCxRn:I56NrEs7DtGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785104461, "uuid": "90b47c8b-f231-4750-8ea0-94352120740b", "value": 2613088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785104461, "uuid": "d6596121-c85e-4d3f-b1fa-58b8c15bb8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785104461, "uuid": "6899c8e5-eb0e-4048-a71a-d06180eddf90", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca2f14a-88f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785071047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071047, "uuid": "eeb3e57e-e35d-419d-aeaa-6f3f8b54c829", "comment": "Malware payload", "value": "597a5092a1c506db538526df16760a71", "object_relation": "md5", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071047, "uuid": "e7f3d551-e637-4ca4-a063-d08f0c9b2dc2", "comment": "Malware payload", "value": "d947e4cc8c8c5d7cc6dbb1e38cea7e50133e3032bd943bc1ff4eefd11f5f1a8d", "object_relation": "sha256", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071047, "uuid": "1b92c1dc-b626-43f2-a744-a1cd72b1b16b", "comment": "Malware payload", "value": "58bf80ed34585fb7e0ad90185b151f9255ccad16", "object_relation": "sha1", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071047, "uuid": "fe4312ed-8f36-4ceb-a1c3-b97f98514bbc", "comment": "Malware payload", "value": "c61b26c5b01aac4f4432d7ada330dd60a58b4bfb90993accb0d6efb6c961c1a4aa576889a3077bec27e90eeb379c70c0", "object_relation": "sha3-384", "Tag": [ { "name": "94-249-203-150", "colour": "#19CF4C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071047, "uuid": "2bdd7556-2b84-4f8d-be49-311222df29e4", "value": "T1CC51E97068103BEDC282A877EDE353D8BF266B2A5159393169EDD30158613B4273BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071047, "uuid": "215e08b6-f4bf-4563-bb33-0f894a4c49fd", "value": "48:KezGigGImaG/goZ3ulYtSmQKTtSJRUOw1xfbekdMETVanCWHRMmYtcofmHSCnn:CiZ+Nh74NjdPTVHWyTfevn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785071047, "uuid": "3d379201-d01f-46d8-abe6-63023e251beb", "value": 2536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785071047, "uuid": "05f0c7f9-3539-4a07-8a0f-866a8e1d0528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071047, "uuid": "5f50d734-dff7-4f49-866f-7c9748d152d0", "value": "client.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417658d4-8921-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785091135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091135, "uuid": "870115b0-d600-4301-ac0a-419ee9c6ebb6", "comment": "Malware payload", "value": "5848d2b4ca605d57aa948157ce758128", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091135, "uuid": "2d042ad3-54ba-4b37-a880-ebb1260256a9", "comment": "Malware payload", "value": "d9c1400330b5915cf65329f1ea001d7669c76662269cfc58271f6e226d48f7d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091135, "uuid": "434febc2-5e12-4078-bec2-35aff93e2b9b", "comment": "Malware payload", "value": "dfc7f2487d066922a85e4b012a1c534642fdc38a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091135, "uuid": "c6fb685e-7260-4d81-bfae-dfdfba43ed08", "comment": "Malware payload", "value": "5904963c50fd8e454438ad544e320be021d3d6aa99635a8707f3a260d32e64963689924b97c55b4a05caf53f732fd4ff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091135, "uuid": "1b895013-e7eb-4ac8-a373-ac73af14169f", "value": "T1EB236C652A817C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C5A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091135, "uuid": "ffa16f9f-8f80-4ecd-81d4-293986656670", "value": "768:GXOGVv39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ILYcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091135, "uuid": "88d30ae5-db44-415c-97a7-3da31f2e2a44", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091135, "uuid": "30eb50cd-af70-446a-bc4c-4a13a8b1f563", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091135, "uuid": "f71e1eca-847b-4dbb-8952-cff0ecbe2d8e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ae4bff-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066899, "uuid": "cd039891-98a9-4287-8b8c-379d16529939", "comment": "Malware payload (Mirai)", "value": "38cc8f6720f8ee549885861e2acab809", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066899, "uuid": "bff110ad-e89c-4f03-a415-54c1c6aa8388", "comment": "Malware payload (Mirai)", "value": "d9c3917d9f6cf4a7c1f5ae87b1c4c76602dc028e220c2cd4b6013d0685187baf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066899, "uuid": "1eaccf79-e620-4b7e-b9c9-2ffb1b21cea4", "comment": "Malware payload (Mirai)", "value": "00bc9e38e7595cea5e93fdaf15cf57e14481323c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066899, "uuid": "77cc440e-5bb4-4ad4-93b7-7330decb9945", "comment": "Malware payload (Mirai)", "value": "37d341f6557b7b400a85b2c51973b1a4b2699c36cb87475b7d78257712c3e00bc7536a4938e7d10822b38b86790bb707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066899, "uuid": "9a63d49f-80d5-4001-bdcf-cf10bcce6ffd", "value": "T19424E80AAF610FBBDCABCD3702EA1B0128CC555722A93B357674D518F54A64F1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066899, "uuid": "ac6edecc-d7f8-4ed5-9d1b-696f02d12293", "value": "6144:L2ZKKkU08ICmEDMCWL4P3NG9k5XFkWsEN1K4DH:6PPMCW56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066899, "uuid": "864f537e-8b33-48cb-86d6-249f9146ca6e", "value": 224360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066899, "uuid": "4f1fb38d-9407-4351-9000-813435334f9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066899, "uuid": "599e73e2-0e25-4151-b5b6-1a7b14fc8243", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb56f0b0-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067717, "uuid": "e5c362ef-736f-4118-a2c1-ebde1743a92c", "comment": "Malware payload (Mirai)", "value": "3316a645b4eb92eaab735714731ade91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067717, "uuid": "2a0f1857-28cd-478a-90e5-1981f4b8b5b9", "comment": "Malware payload (Mirai)", "value": "da12a3b24eca24be9a527a4f1fc8004eea123e73ac1ad416d319282b114cafc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067717, "uuid": "1653470c-07e8-4d22-aad0-9b15895f463a", "comment": "Malware payload (Mirai)", "value": "d90b6e8738b1ce4f3ebac7536917f9d67a5bb44d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067717, "uuid": "c7264a98-b385-4b87-ac11-d0f823ea38d0", "comment": "Malware payload (Mirai)", "value": "3b4e64b6165b5bd72201d89e3ff5229e8ab8f1bbe8dd710038037a28e99e163326f6d678c07e9df94a1f88cca74a3d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067717, "uuid": "12b0095d-e361-4b9f-9b69-d3041cb09d98", "value": "T198241847AF500EFBD83FCC3F08A51756659CD4A632A82B776634D51CB68B34A19E38E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067717, "uuid": "ecd3fc0c-0dc6-4622-bec4-188aa7ae34ee", "value": "3072:336RMW+TM3XJ6HnY0+PAFnFeYVnQip6Q65pZJE:3qRb3XJ64/Aeip6Q65pZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067717, "uuid": "8f30dc26-3bf2-4443-b74d-ff53649bec14", "value": 209512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067717, "uuid": "89d6e160-a131-4fe5-8298-71f5d2a41d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067717, "uuid": "cbd240c4-f3e8-4fae-a841-f5a080029e14", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b3835f-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106261, "uuid": "13056a1e-2813-491b-80a6-2f0dff75bb1f", "comment": "Malware payload (RemusStealer)", "value": "31cf950bc1322291ecb5a3a13c3b96b8", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106261, "uuid": "e7e1e0a7-c965-4831-aec4-c6c9dc90051b", "comment": "Malware payload (RemusStealer)", "value": "da7935affcec91c317acf98b52eca551f2501b29ad502749e4c084492142c6eb", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106261, "uuid": "88543da6-4ab7-4a3e-8b0d-170ce13db692", "comment": "Malware payload (RemusStealer)", "value": "e99c5339ab851962a09acd833bbc5138a04d75f6", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106261, "uuid": "e9752c50-0239-4667-b53a-5cb012d04565", "comment": "Malware payload (RemusStealer)", "value": "858caa89866be7275de8ca2f0dd24815dfdf40a277a6243d2a895b1f64eb7a7b565910396c9f751b670f7ee4a344bcc3", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106261, "uuid": "30976ea9-2436-4821-916c-3e310457a458", "value": "T19F24096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106261, "uuid": "77dbbd35-8b9c-4f2d-aab0-199aa68b018a", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106261, "uuid": "96091b40-a29c-42fa-a512-f0c56232ce36", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFyi1/CGiics:Qj5WUEBx+Q7PEfFnQU+tUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106261, "uuid": "866ea6ac-0d8d-4457-890d-1699e4465a9a", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106261, "uuid": "c029e2d1-720a-447f-8b37-53c0a9c5d823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106261, "uuid": "d4a0bdbb-4d92-405b-be84-ea19d44067de", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e40da5-88fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (GhostPulse)", "timestamp": 1785076195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076195, "uuid": "2c3fd32b-229c-4cee-8c84-939f58bc63e7", "comment": "Malware payload (GhostPulse)", "value": "0a40d85ac5a687cae796ee620e279ac7", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076195, "uuid": "1f374c75-6e4b-4ad9-a4a4-f873e9577956", "comment": "Malware payload (GhostPulse)", "value": "dbf03ba27ac911cecc5e5f4402a0648d5c2e9544daddbf76fb53408a40b7f982", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076195, "uuid": "774c75d8-3a16-47f1-89de-80818c58360c", "comment": "Malware payload (GhostPulse)", "value": "56628e7bc693c5e331a8e9a8b92cda10c8af0bbb", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785076195, "uuid": "fbb1620a-3374-4735-bdbf-7af927a70e35", "comment": "Malware payload (GhostPulse)", "value": "0e8d55c3e3923fc0e3f892ce785b1ae1aec2bd34208ce71be18d80d619df03e9e623aa12f96a052a8205d436516809b6", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076195, "uuid": "8e98c1ed-c6d4-4670-908f-3a807a773f4d", "value": "T1F3D62317F28E673FE46A5A3554B29A00543FBA60691A8C73CAEC7D48CE3D4901D7EE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076195, "uuid": "8d439d25-2c11-4b49-b8b7-c0e4194f2c1c", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076195, "uuid": "984f0296-756c-42a7-94dc-d205a726dd69", "value": "196608:rDbMIpa95XagKNjy601Anb+TXC73JQXKBhacpyXRgof7YBMqhWT2cpKScaA:rDppe5Xf681A2C7iXOaAyhgS8MpCcp9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785076195, "uuid": "70960857-a9d5-423b-86f7-c8403781d65f", "value": 13364514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785076195, "uuid": "793b395e-9db1-4673-bc2d-d5154eadadc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785076195, "uuid": "23b4e3a4-9c55-44b7-b417-a55a87ca4e58", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95850823-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063358, "uuid": "3c0c02cf-0c19-4990-b20e-3ec7b8a3552a", "comment": "Malware payload", "value": "192fc06a50d2030778e9cd5491dd9b5d", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063358, "uuid": "cca338f0-3b27-4218-a762-b1b9e6ac9230", "comment": "Malware payload", "value": "dbf5d3a2c6238810dbb9732681303564f40993aebe3b9bddc7da063ed52224b5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063358, "uuid": "829f23a8-241b-4eb8-9465-da95a5539d01", "comment": "Malware payload", "value": "07c4feeb8b495eeffba7814125ab95c3272816f7", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063358, "uuid": "2d4b3563-f0d9-4724-bf82-a113dee2979e", "comment": "Malware payload", "value": "b0e6026cea541d6c5453c7eb1ea235c6cffbfeba1f404de7a028db78a5c165c4265488faef7035ab50ecc8db0eb0cd99", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063358, "uuid": "c4f05ead-6310-4d70-b06b-c7217cee9182", "value": "T1FE85335AE485802BFC2C541ADA3BD437B23EA3FE68D41C345781CB4C2B5C85DDCA56AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063358, "uuid": "bdaa271e-4f52-45a4-bb72-46120629d00e", "value": "49152:RZQcGyW0n054D8uPCkDPKqVFWu8W19ZKPL:Ru/V6DbPC8SqVktL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063358, "uuid": "5d9cb0b3-5b7b-4e31-8fd2-52bd774525a5", "value": 1740784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063358, "uuid": "9a9ca81c-2fe8-48eb-9a8d-e332949ecf92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063358, "uuid": "0d1e1219-bcee-4cba-897d-fd624697cf87", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb667fe1-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084897, "uuid": "29fadf41-074f-43ec-aaea-4228d0c19d45", "comment": "Malware payload (Mirai)", "value": "ced73d0555de2b32e31164caa720836a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084897, "uuid": "29150623-909a-446a-b70b-711341448d3b", "comment": "Malware payload (Mirai)", "value": "dc8f20ec01bfea40f461f9238e4bc1872a36b918f3e9b121aca0754b9867dec0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084897, "uuid": "ba985f76-9e6e-4054-a533-c5002654815d", "comment": "Malware payload (Mirai)", "value": "3e177fa0b1fffbc3a96c582154fd9ae1d2c661f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084897, "uuid": "ff0e5be7-25a7-452d-85fd-5c7acee67806", "comment": "Malware payload (Mirai)", "value": "3505d3e2d4bd2ee29b2921dd4703b7b04d308ec053fe6aa3a3ae4cb22f740a33f5f606e987875a7e5cb727c11ce5432d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084897, "uuid": "e2018c73-5f3f-46fa-a283-bccc4bda9ba3", "value": "T1AD734A27B54180FDC04AC174576AFA3AF93330FD127CB1AA2BD4FB266D8AD621E19D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084897, "uuid": "7fc04969-30a7-4712-9df3-db77e532c620", "value": "1536:XMJ5vY9yDUaKTyLHKnvypsREaVrwuBOHk0OB3dgFfHLmJZ:XmY9o7KcHKnAcwuAHQ5dgFfrmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084897, "uuid": "a56b28c1-3bc6-455b-9737-6616c6fa8aff", "value": 78192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084897, "uuid": "667fcb4b-ac7a-4f8d-a0b7-a161f531577c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084897, "uuid": "412b267c-dca7-4066-a833-f52f9833e8e5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3ca7d3-8918-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785087391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087391, "uuid": "18048ae2-9712-421a-b2cf-026b69fda300", "comment": "Malware payload", "value": "7cb9862b249003018773e8d91e341290", "object_relation": "md5", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087391, "uuid": "154ace8d-464f-4c3e-a1dc-8afa1a6e8315", "comment": "Malware payload", "value": "dcb381b1d82d602bae96815db9cbf80a6b57b25e22b47a794940803594465aed", "object_relation": "sha256", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087391, "uuid": "9e538108-577b-4093-93bf-78d784e34563", "comment": "Malware payload", "value": "fbcde536b732c436d3bf26f5772f95d188cbfa80", "object_relation": "sha1", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785087391, "uuid": "93c8d60f-1d21-4dc1-8aae-24b378496f12", "comment": "Malware payload", "value": "13374b0532fa7eb15e43d1732fc241ee7be1aaf751145d44ed785a5dec865ef9b621c2d69a034ce49eda095bc8145f62", "object_relation": "sha3-384", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087391, "uuid": "993813e5-2c7d-43d7-b324-6765bcfafc0b", "value": "T197286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087391, "uuid": "ea026a2b-79fb-4ba4-affe-522b4afa8d81", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087391, "uuid": "e8b83730-5682-4364-b880-a932a7f94a7f", "value": "1572864:mZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:mZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785087391, "uuid": "863250cd-3f07-4e3f-9630-794082b3c0df", "value": 97861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785087391, "uuid": "811dc30d-87a5-44c1-9c7a-b58a3c27b2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785087391, "uuid": "dca23bb3-a7f5-466b-8479-5de75155b9ca", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630a03ca-88f4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785071864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071864, "uuid": "29ccce9b-218a-4d0c-884a-6ac4daef8e81", "comment": "Malware payload", "value": "f7938ceff821d1a1a98ecebe26847d09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071864, "uuid": "659d8be4-70e9-46ef-b8c2-0f8d7ebfc5d9", "comment": "Malware payload", "value": "dd423b57129c64ac7754853e14093605235c4ac2e137c38ad90dfb8e329bcb70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071864, "uuid": "12b7bb4b-4d08-49ff-91b3-2ca9d654cab3", "comment": "Malware payload", "value": "1454dfb07f7ac1dbee838db6a17eb8980e84bf07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785071864, "uuid": "aadbd81a-001f-4fcc-a0c3-a141a907c2b1", "comment": "Malware payload", "value": "41194746e4630cb38cd8c4b72c3c37c4e065b03896349e184f10e05110fc98ec74081392e92919a21da089f71019f2cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071864, "uuid": "a91bb0d1-e21a-4431-9de3-906cbbd6b5d8", "value": "T1AC23F2F2CE18111DCF59F4FBA8662A171EE045F0AFB227B609B1757019ABB3E0E30064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071864, "uuid": "43077c18-42c6-4d78-b28e-28bf3b024986", "value": "768:Ev084F+njzCXKUp0HzXvvc3hRJYH52H/W/n4Hn9NeloQDfOPe2UWnL9CHdZmfgez:EvOwjY0Hz/v0hRJnH/W/4Hu0Pe2FL9lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785071864, "uuid": "a450164d-3e29-4893-807c-8342ac5fbabb", "value": 45900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785071864, "uuid": "4f3ce639-2c4a-4a74-8801-66f24392609b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785071864, "uuid": "7919d3c8-4ebc-446b-b247-7f874bb33e09", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1e4bf4-88ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785041551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041551, "uuid": "40f1bf56-deea-478c-b79d-4d9ba8796626", "comment": "Malware payload (Efimer)", "value": "5e88f26c5e45f5febee60618e399f7f0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041551, "uuid": "f3749ea9-c408-47b5-a466-ca555bc5d63a", "comment": "Malware payload (Efimer)", "value": "dde2616ab4c9f2972ce9116f5d03a225520242b96211107f5a68e3f69f0ac7f1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041551, "uuid": "95d90179-fca5-4253-a79b-ac3cf42c3c07", "comment": "Malware payload (Efimer)", "value": "2e8ebf9fe1c7dd0120f9e5eba45ca1ed11ead4f1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041551, "uuid": "e116cc8b-dc98-4db7-b3d6-beebd02bfb7a", "comment": "Malware payload (Efimer)", "value": "5fa05721bb209d9f37cd8556f8e80074ad0b6ac41da2672869f0234b040884f109a581c0f51a708061d70ec914542354", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041551, "uuid": "8772c304-7b76-40f5-9b03-118c556345d2", "value": "T1BAE63324AAD012FAEB73107CFEF91A92D964F9120772C9DB5768C761AD532F05D38223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041551, "uuid": "cd06be4e-9813-47c5-a509-6d94d63105d2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041551, "uuid": "7f9bba11-a53d-48dc-97dd-b6105b74bf9f", "value": "393216:993BY76IMpPMDhngwaXMCHWUjXlcuI3/PGTAI:9Po6IM9MDYXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785041551, "uuid": "55011e77-0b61-40d3-96c0-d6f061938872", "value": 14330159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785041551, "uuid": "ef356264-8176-49e1-9bb8-b7e1f8a8fb43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041551, "uuid": "abed3b8d-8ad0-472f-bb50-9771c769ac9d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba28268-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "dcf33472-cb9d-4dc8-bc23-e3225877dc51", "comment": "Malware payload", "value": "2668a9ad2b9d021f2f5e25366570087e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "107bc7a8-e508-4766-a6c4-88de1d6bfbe1", "comment": "Malware payload", "value": "e06a0d9e80749b4c90172742b904590491e16015e358adc069eff3e6c10fa44b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "138f43e9-dc5c-473e-9e21-dec886cb05a6", "comment": "Malware payload", "value": "d71f138714700a896ef2f1739a0d2478ba8c31f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067932, "uuid": "672a7955-0935-4988-8ea5-d2d43e5f8e8e", "comment": "Malware payload", "value": "60354a4a47072d144eaac13e58189e7133be850b857e9ddcbca986fd00916c29497c039bad9e35357cefc19ea336e3f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "c3cbb967-00d6-41d1-a3da-42c0c45f3ab8", "value": "T1FE0152E86263E530479BE8A37B2BC4788453E0C05E820FC8B8CC9971C549FE6B17165D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "76fb12f7-ab89-4593-9505-94a64400804e", "value": "12:my+KWK4GqECxIBikIBJzIBJzIBJsIBJ6NIxIBJSa+Iy:mjbHq0IBikIBBIBBIB2IBMNIxIBEIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067932, "uuid": "dfdb0f31-4f8b-423e-9b41-12646f62f3ca", "value": 733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067932, "uuid": "b22b8adf-042d-4c6d-8c92-0ad1c7d6b177", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067932, "uuid": "4f315612-913b-4c60-8f7f-97d3baa86ea4", "value": "ftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f299f8-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785106149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106149, "uuid": "bac0dc64-42ed-49c5-9f30-90e16408b207", "comment": "Malware payload", "value": "636a4a206e84c88baeba66425e33ee16", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106149, "uuid": "8bb643e7-272c-48fb-b8fb-81fdde590261", "comment": "Malware payload", "value": "e15d8d51a52da2c39d11d0409764821d2bc94794eea7ae3c8846b8ac078f4a0a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106149, "uuid": "832ba073-b7c6-46b0-af91-223584daa458", "comment": "Malware payload", "value": "e52de16302130b89ea1e51892b9107b875c59169", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106149, "uuid": "4850bf78-2c67-4cad-b754-362bda551f85", "comment": "Malware payload", "value": "bd89de99b92605228fa6ccb1971bb37cc39eb3f72010efd3d6b00dbf1b71dcb04e95be35830c29ce34bede7bf1cbfacb", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106149, "uuid": "e72a40b3-ae4a-488d-9352-3fe5f4e49950", "value": "T149F4AE16DAD2C1F2DE03D5B222EEF32F5A762E278839CEEAD7A05CB56813344250F155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106149, "uuid": "4f5f6c89-313e-4492-b9dc-f5767804046b", "value": "12288:7JpvL9GT6Lx1dVHIFFNdlUHBFfAfL3mYdRTAaZUDjopTMuK3xTl/2Lig1C:7/UTEFH+FNdShFfAfL3mYdRTAaZUDjoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106149, "uuid": "5cb47907-206e-4c7c-9e3c-48c527cac9ce", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106149, "uuid": "71f96c44-3add-4809-9a72-f737e9d04392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106149, "uuid": "d5a06135-5251-4ac7-9b1e-77c4344d6e22", "value": "acr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db07309d-88c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785053167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785053167, "uuid": "d0fd3470-7c19-420a-aca4-0f1eef9659d5", "comment": "Malware payload", "value": "a4204bbe241d9e51928a30af14e24c68", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785053167, "uuid": "42ff85f7-3beb-40a3-a16e-7b4bc8d9b3de", "comment": "Malware payload", "value": "e1f8a6ebea16c16be1f48621307c6d08be81570d60da08863d4233a1b64ac49b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785053167, "uuid": "adabc692-d336-44e7-8f3b-59a374d460d3", "comment": "Malware payload", "value": "e74b86256f59bae2a6607d5179fdcbb7a57f46a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785053167, "uuid": "4d02bbb0-c970-4073-818e-a3c610a0882b", "comment": "Malware payload", "value": "14739a9826d2024c34ab75eb5c509a5861aa6693def7a08d0ac058c63dff21b53905847f24c6b7563b2f4eb3fe751e5b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785053167, "uuid": "fecd9a80-afdf-4d03-8fc5-8feb3cd6959a", "value": "T1F3236C6516857C14AE99C4365C7E2F0CB9AD43E6314492EE7FCA3CF28C4A6ACA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785053167, "uuid": "1cd3778b-9e1e-446a-acba-7877e9e165ed", "value": "768:ir9NyXsZztCup9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:sHusZxicr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785053167, "uuid": "07e1884b-b78e-4424-bd1e-28e87fc0b2f5", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785053167, "uuid": "2faf71db-3350-405f-8b98-3df291dcf3b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785053167, "uuid": "f1c365a7-efde-4077-985a-76ed17e868b0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2fead4-891e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785090057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090057, "uuid": "d21519f3-5857-4b2d-ade0-8c299f3e928f", "comment": "Malware payload (Mirai)", "value": "6dfb04f30db1a0636c4c616698cb77a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090057, "uuid": "3731d0bc-fc26-4e18-8abf-e72b71831cbd", "comment": "Malware payload (Mirai)", "value": "e22e988f62f212ea785c061d1f39ae1ac5e957b00b995f038c68d11a5ce3d5ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090057, "uuid": "59b483be-a530-468b-9483-4bf77ec700c1", "comment": "Malware payload (Mirai)", "value": "89c2b472b96c8825d1498f67ab362c4af118a288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785090057, "uuid": "15a3f5cc-a4d2-4b8b-a017-e539b4d94d4f", "comment": "Malware payload (Mirai)", "value": "63eae27906208bd03465f64549b2c1a38946413dfc9711cb201939b558cff78ec13040c804cf6bbb64516f02e9df11e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090057, "uuid": "e987b79c-dc3d-4ec4-b7b6-5ac1da8fbc8e", "value": "T19934B51E6F228F6EF269CB7447F74D35976C23D626E1D681D2ACC2101E6038E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090057, "uuid": "a3885509-25eb-4909-a585-e581d1da70e9", "value": "3072:U8MG4h60XPS+wo+ZqMut3dPpZ3gRnBEBmtiHT/lJkY:U8MN88SFhotPg8BmwjP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785090057, "uuid": "6423b55a-3207-4670-937d-0c95ecf91abd", "value": 244420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785090057, "uuid": "ea64575c-cfc4-4830-abee-fcf6764b1add", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785090057, "uuid": "6842f1b4-80b2-48c4-9755-dda57609b910", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad46052e-88ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068982, "uuid": "ebcf2b21-a0c2-4542-839f-a90d37d788c1", "comment": "Malware payload (ConnectWise)", "value": "3771f7c5590ebe660781c62b1b0a51eb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068982, "uuid": "fb428c68-8bbb-4041-bf0b-1c050c83d13c", "comment": "Malware payload (ConnectWise)", "value": "e2e99d69d228db3246ac9eac9bd1314b4872b401145801323ad8b15140d1677d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068982, "uuid": "45fc3183-dd2c-4d11-9e71-4551719cec34", "comment": "Malware payload (ConnectWise)", "value": "a3d5790c71f9730aa32d67608bd842bd73cfd52e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068982, "uuid": "5251054d-7963-4624-870e-4f502bea8007", "comment": "Malware payload (ConnectWise)", "value": "f91d8cb6a164f16309ed8aaf68744f81ce85d4a0fb9e71e1d749cfb51519b95ab070c33660d625da6581b38e44f2bd92", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068982, "uuid": "da08822a-ddc3-4f9b-b278-fa1256d48a4e", "value": "T1EA46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068982, "uuid": "3ea61f46-5d2d-4a4c-9168-5c27fc3f383f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068982, "uuid": "7e6b8c04-8e92-4ccd-b218-bc917ce322f4", "value": "49152:uEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:bEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068982, "uuid": "c617fef4-802e-4692-a04b-85f295406884", "value": 5620608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068982, "uuid": "650f437f-685e-4414-bc9b-c278ee7c24c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068982, "uuid": "cc876b2c-810d-4651-88a5-95bb7545f885", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a5e425-8922-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785091724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091724, "uuid": "fccccbf7-d601-499d-b543-8d34b8f8e3a8", "comment": "Malware payload (RemusStealer)", "value": "64579d8e3eef742369f43b5b99988adb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091724, "uuid": "2fbc4f74-e6fe-46ae-8af5-6157c7f3992c", "comment": "Malware payload (RemusStealer)", "value": "e3348b965f32e6573b569e05d03a6614c6320d40a31bf5545ac4dbac0f0732b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091724, "uuid": "ca0d5251-4d24-4597-96c8-9d2a0d185956", "comment": "Malware payload (RemusStealer)", "value": "27533b6aac87634109ef854a5845e06e0457c638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091724, "uuid": "76a3a6b4-c9ae-4991-af59-bfab249f5756", "comment": "Malware payload (RemusStealer)", "value": "5db1640a457c6378b2aa19e43feabbda51085aaa4089d6778edf4929b2dfd1dbff3407485d8636e2e55e94d3dc59cd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091724, "uuid": "d9ff96ee-4705-4880-9c05-069c716d92f0", "value": "T1F9B55A07BCE109E9C4AA933289B656917B75BC080F3267D72E90B3783F72AD09D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091724, "uuid": "072f77d0-3372-4595-bb39-535e65a27b24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091724, "uuid": "311d22cf-3074-402c-8540-def7a487730e", "value": "24576:r7Jqsc+8XMgeK+MBLVUr+2mW1tgL8+qghLqJBele5r926CSZ5m9M:r7EsB81NFLVOTV3+n+JBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091724, "uuid": "f8aae12e-5384-45a8-b27a-6fa8425538d2", "value": 2334072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091724, "uuid": "23efe5a7-a1f9-4ddd-b762-7584d6560428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091724, "uuid": "f2b3cbdc-ba76-49d6-a9d6-be65d475c4f2", "value": "Stellar Data Recovery [by j0nb4].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a9559e-890f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785083674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083674, "uuid": "cd72835a-33ef-4b6e-958a-91d25f6d4be4", "comment": "Malware payload (RemusStealer)", "value": "21d23cc31ae9fe60f4e1c77ebf64acc2", "object_relation": "md5", "Tag": [ { "name": "85-239-149-167", "colour": "#B5AA4E", "exportable": true, "hide_tag": false }, { "name": "carogra-biz", "colour": "#5F8E16", "exportable": true, "hide_tag": false }, { "name": "geminyw-xyz", "colour": "#49F28F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-543ef04278f54506917440f3fbdc8109-r2-dev", "colour": "#3B6764", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "tzpx-.courses", "colour": "#FCE55A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083674, "uuid": "fe811124-767e-4fcf-98b2-5a388f3b8bb7", "comment": "Malware payload (RemusStealer)", "value": "e41b1a7299789dbaddba2d932192a0439a603823eac2e29f1a38e16a247f78b1", "object_relation": "sha256", "Tag": [ { "name": "85-239-149-167", "colour": "#B5AA4E", "exportable": true, "hide_tag": false }, { "name": "carogra-biz", "colour": "#5F8E16", "exportable": true, "hide_tag": false }, { "name": "geminyw-xyz", "colour": "#49F28F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-543ef04278f54506917440f3fbdc8109-r2-dev", "colour": "#3B6764", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "tzpx-.courses", "colour": "#FCE55A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083674, "uuid": "20803f53-6e73-4f2b-9b6f-e75917f937c6", "comment": "Malware payload (RemusStealer)", "value": "a08e5cd13abd85b3587b94bb8140c2daa2ae6992", "object_relation": "sha1", "Tag": [ { "name": "85-239-149-167", "colour": "#B5AA4E", "exportable": true, "hide_tag": false }, { "name": "carogra-biz", "colour": "#5F8E16", "exportable": true, "hide_tag": false }, { "name": "geminyw-xyz", "colour": "#49F28F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-543ef04278f54506917440f3fbdc8109-r2-dev", "colour": "#3B6764", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "tzpx-.courses", "colour": "#FCE55A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785083674, "uuid": "e5ea0f96-e6d8-4005-80b3-56ff5aa54989", "comment": "Malware payload (RemusStealer)", "value": "cae4e16f88184fc8d4d84b1ddc0c209c5d2afa1d2533ab7e5fd1b77f018caec5089d8aa269cde494908267b0f1c7c627", "object_relation": "sha3-384", "Tag": [ { "name": "85-239-149-167", "colour": "#B5AA4E", "exportable": true, "hide_tag": false }, { "name": "carogra-biz", "colour": "#5F8E16", "exportable": true, "hide_tag": false }, { "name": "geminyw-xyz", "colour": "#49F28F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-543ef04278f54506917440f3fbdc8109-r2-dev", "colour": "#3B6764", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "tzpx-.courses", "colour": "#FCE55A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083674, "uuid": "00a5b056-7b53-4410-8ddb-20e19701a33c", "value": "T12EB56B077C9188E9C4AA273288B652917B35BC180F3A67D72F90B7782F727D19D36B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083674, "uuid": "015fbcc4-8ccc-4d3a-a44c-9ca8d6a31499", "value": "24576:1tMcpV2OKP+Eu/cGFyw/PNINoXAstn8IQO++44gPuBsBfYktzzuele5mKZHymPa8:5pMOKP+P/9FyKlIGJZ86PW8AfBO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785083674, "uuid": "7eba763b-6a8c-4773-aa2f-1e67010cc087", "value": 2478080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785083674, "uuid": "1273198d-5da8-4d5e-82b7-44cf0f95cf8d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785083674, "uuid": "b697f6e7-695e-44a7-8c16-d994b6499335", "value": "RMS13JLYD.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f42414-8945-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106518, "uuid": "27d053bd-2444-4f09-a433-c1edf062eae2", "comment": "Malware payload (RemusStealer)", "value": "faa1ec6c4f2ee779a599ab56481a1a47", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106518, "uuid": "f5e454a1-4d3f-487b-bff0-b2340389d5fe", "comment": "Malware payload (RemusStealer)", "value": "e440f3fbbd33d569432ddbc45ee7de8a19b1648de898c01329d5f3a404bde96d", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106518, "uuid": "64d84b2e-2e6b-4be2-92b2-42ef337c82bb", "comment": "Malware payload (RemusStealer)", "value": "c0633997b9f28fbfee5a5d7aa0ebbbe6620d9b0d", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106518, "uuid": "7d3aba8f-b52b-430c-ae8d-9b482ae0a537", "comment": "Malware payload (RemusStealer)", "value": "00802d7a3e3047c0de8b40cb70297af1a8414e6e1c3939098e7c5f5b0ffe7b2aaa596da2be1a55e4b87fb5b3201dc94e", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106518, "uuid": "1149518f-6138-47a1-887d-912209f8df4b", "value": "T15724096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106518, "uuid": "4c298882-9342-4299-821e-f3585b27f3d4", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106518, "uuid": "8d14f8ec-f0e6-446e-a865-45510ec3b029", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFo1kCGiics:Qj5WUEBx+Q7PEfFnQU+tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106518, "uuid": "c15c6ba6-c747-44f9-833e-7cfe0c0d60a4", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106518, "uuid": "03775b49-c9de-4d88-9e28-ffbcbcb9287a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106518, "uuid": "6547c810-96db-4030-916b-b6f1debba4ea", "value": "jhgkuyyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01623cd8-88c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785052372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052372, "uuid": "f7262569-a837-406d-92dd-f5ed4f267e6b", "comment": "Malware payload (WannaCry)", "value": "40c3bb25ce680409353ba703dc11ea8f", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052372, "uuid": "4aae4a7b-fba2-40db-9dfe-687579f09228", "comment": "Malware payload (WannaCry)", "value": "e4ec8ea01e91627c9329c2889249f2e02ca78ba5f22eb84ad24ce63e7cf816a2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052372, "uuid": "859cb8ab-ccca-4451-b970-6314790140cf", "comment": "Malware payload (WannaCry)", "value": "da808f876105cafd99d73a42de4e14ef45cfc203", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785052372, "uuid": "7a1c5f0e-48f9-4089-9167-7cb35e5eaa07", "comment": "Malware payload (WannaCry)", "value": "fc17015a13cdd9ca617cbced84daa338aa0730f8c3a59563b4fde329c1461399871be2441a16f46e45d1f779e8680724", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052372, "uuid": "36f07119-a664-4433-a991-cbb7b02f479a", "value": "T15936239D31BC91FCD10666B484B78E12E7B37C9A23FD9B0F5B844A6A0E03755BB50B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052372, "uuid": "5ec8b127-0e2e-426d-a8bb-17695c19e434", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052372, "uuid": "0993dba5-581e-4573-bf6d-1a0a7d00ad07", "value": "49152:jnsnsQqMSPbcBVQej/1INRx+TSqTdX1HkQo6S:DM/qPoBhz1aRxcSUDk36S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785052372, "uuid": "44a3e2a5-c28b-4c7a-a101-b0bf7a74cb4c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785052372, "uuid": "1da1a730-ae76-47b2-b904-934e4c16ae39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785052372, "uuid": "78e2673a-f74f-4f2a-8446-a240ea35101c", "value": "e4ec8ea01e91627c9329c2889249f2e02ca78ba5f22eb84ad24ce63e7cf816a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5b469e-8902-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785077974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077974, "uuid": "a8398cb1-d7c4-43c9-b9e4-981306a489ab", "comment": "Malware payload (Mirai)", "value": "9a48a750625ec38d1338afdd1b48105c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077974, "uuid": "4092ba33-06cc-4f0a-864b-7d1818391ef0", "comment": "Malware payload (Mirai)", "value": "e5a4319b0ecf3ac2a3a429bc8460a678eed25ac723d4443adf8a706cc4a8c931", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077974, "uuid": "84a14b5e-6a79-48ba-aae4-bdc2be3c65cf", "comment": "Malware payload (Mirai)", "value": "d8ab503f181dbe8933c5fef2274836d4075f9a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785077974, "uuid": "338e917a-6d9d-4a3a-a2d9-3e8c633850f1", "comment": "Malware payload (Mirai)", "value": "1e02c0f34603d11d333c8ef4a22118f1d5b06b62c2a61ba814b00f6d750471418ca49d545a088681809677460a160e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077974, "uuid": "846c4e5e-847a-4c60-8aef-e5aadd4a9ab4", "value": "T19BA3FA4EAF601DB7D81BCD3705AD0A4639CCA60771A83B753934D928FA4A54F8AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077974, "uuid": "a1b77ab9-92e0-4ba9-ac34-03d2231c64ba", "value": "1536:HmCqShgM4IkXlBpmbJJSjiyMnX6SKvDLWv11U+aeFgVBxkAFuZU:JX4IkXHpmbGMngeO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785077974, "uuid": "627bb004-afd7-4314-a09c-bb02c4bf32fd", "value": 101212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785077974, "uuid": "749a817b-e60c-498a-b0e3-7d0be83c8626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785077974, "uuid": "797dd074-fe1f-4fd8-b79f-0f4b71eec9cc", "value": "sAD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f403ff-8937-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100831, "uuid": "72ba9dbf-7ef1-4b29-a847-ad3f31658656", "comment": "Malware payload", "value": "ba47ab37b1b099e3df4d38ecf868e55f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100831, "uuid": "0eebe872-7440-4d68-8aa9-23eb2f210ac6", "comment": "Malware payload", "value": "e6016e68b528ea80caa37afb5a283e88a78659ffea48d8fc297fad7676072324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100831, "uuid": "82c03021-9085-4266-a69b-968902d18a61", "comment": "Malware payload", "value": "32c8fad6904ff4fc95e64b1a82e56f8f13aad770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100831, "uuid": "bfddab65-92c0-4074-a1d9-57ad7eea7736", "comment": "Malware payload", "value": "b696d24e299ac473750632b5fe80b845ca8cad2d5409a143dbb239552c229f0a2368dcc0f3c9eefd05e90355dfb4ccdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100831, "uuid": "754ff1e8-87ae-44f2-a357-9ba4bab8bced", "value": "T1A0E32A57E29370FCC557C17845966772FA30B8324324AE7E7BACDA312F10E60BE29A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100831, "uuid": "4f66a7fc-2b7d-45f8-a2d3-26ca7df6460a", "value": "5b5b24d18f42c274c0880244c9d97c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100831, "uuid": "eb14b0a9-9b26-44bb-8ac9-ceb34461fbcd", "value": "3072:K1B1+D7PsRD419nxwqeqbyq/9GbJ5dUWPPw1h6Z:K1AoD41gQyY7WHvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100831, "uuid": "75d260a0-2c06-49d0-80bd-96e7814c716c", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100831, "uuid": "3173e042-9864-4c6e-a539-ce675b48d2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100831, "uuid": "b8b184b9-87c1-4552-b034-a5b7710afeef", "value": "Up4pc_Compressed_File_Download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2237b0f-88ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067728, "uuid": "e82509e0-718e-44bf-9d73-0202d07faf13", "comment": "Malware payload (Mirai)", "value": "2062772df530257212a7821a90117ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067728, "uuid": "1cef1e95-4063-4ed9-86d3-48a96f17af6e", "comment": "Malware payload (Mirai)", "value": "e63f3e06387f5f549c1e70569a011f3282e72adde2be1700fc493e2659ade132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067728, "uuid": "1280c714-4733-44f0-8779-eda59cc1b0c0", "comment": "Malware payload (Mirai)", "value": "27bc11149f8bbe5254b85ebed02605c1a76f3f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067728, "uuid": "e05a60ab-e39c-485b-b283-256ebbe9e3d7", "comment": "Malware payload (Mirai)", "value": "e65ea6d1e7f6f2a8f66f8e0c2c74526d997c4233a63843b2fb427e5e251760179c849dcf3ce8ae0c269516b78569c975", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067728, "uuid": "2c8c7ee1-446b-4d09-bb6d-862f219fadf0", "value": "T19104F889BC419975C7C0D277EE0F0149331A97E8E2DA7306E92C0BB27B8781B4DAA755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067728, "uuid": "2c20dfc1-7938-40ba-9468-2901b514bf1f", "value": "3072:+l8zfF7ubrLL05R+HXUxFnr2x5CKtbB9fUv3WffM4EYXi7YVnQP:+l8zfULQEHXUxFnr2mcPsv3Ws4PXwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067728, "uuid": "44c819a0-b1c6-4a82-af6f-bc12c332f433", "value": 177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067728, "uuid": "801790c1-b947-48d9-a326-f75b959db004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067728, "uuid": "86212ed3-a7a7-41f6-8ad6-caba55e859bf", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62da74d-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063494, "uuid": "f2d8d99b-817b-40b2-a609-fab589a6fc5d", "comment": "Malware payload", "value": "2c8530dfcd92466d46ce6611bf3f2e9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063494, "uuid": "8da3a31f-be46-4293-a9db-318abea6002d", "comment": "Malware payload", "value": "e7c5c267b91264af2a1b5c68a9b3a03adc48fca730a0cd2bea0740646cbd5b67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063494, "uuid": "32447793-4d3a-495a-9aa0-bbe8cc23a88e", "comment": "Malware payload", "value": "b10583f7e7672d198028c4b446ef2e0a8baf2c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063494, "uuid": "d9873513-ad96-484a-90c5-f99a8fcb372c", "comment": "Malware payload", "value": "fd401160aec7d6efe49b4d4a53a45f624b4142ba1b4d4ab16cdbf9a4dac17817960b39d155a3ce957807dd0daea770af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063494, "uuid": "38a4e68b-bbb8-4e3f-b787-518e21c006b8", "value": "T151560857B9D24943C4E43677B8BE81C432631EBA9B8A52566D05FE3C3EBE1D90E39304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063494, "uuid": "e47d7e92-8957-4163-bf26-c2fc1bf2e4fc", "value": "49152:KGddR6/P1P9GkG5rCNjeUsXixyxj+xu/nLUg6/If6g5EL:KGyt2aRWxj+xEHEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063494, "uuid": "4201307a-1a5d-4947-a134-28b51fc8076d", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063494, "uuid": "d309dd04-ef82-4891-86b5-ab2a7bda56d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063494, "uuid": "42eee4ff-c995-4262-aab1-8b8bce2d55a5", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba58f2c5-88ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785041516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041516, "uuid": "e1b8170b-a47f-4481-88fb-10ab33005c87", "comment": "Malware payload (Mirai)", "value": "aea382e895074ff48bc9e50f6918bbf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041516, "uuid": "526a17f7-738c-4ff9-9966-aa3ec9c05199", "comment": "Malware payload (Mirai)", "value": "e7f3b31f2d6074f1f804fb3f6e51f172a60c75834d68cbd55e495316f41455a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041516, "uuid": "cbe03912-d2c0-4aa4-b3fd-8eceb64e1e06", "comment": "Malware payload (Mirai)", "value": "7be4aa4f829fd97eede5ec02fcddb44174bc9a46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785041516, "uuid": "48ef2eb1-936f-45dc-9811-6036f72a3a38", "comment": "Malware payload (Mirai)", "value": "5b612b25f425666e0d2c0c3b74d324aa5bc8e92b320d4c45f10cff11a114eee7018208ed66d795e710f2b38258a0417b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041516, "uuid": "76f021da-da03-4501-95ba-4cc51584c0a4", "value": "T189630956F8814B22C5D5027AF92E118E332357FCE3DEB2129D206F2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041516, "uuid": "3944a000-03b2-4092-8052-dfdda3b7ab8a", "value": "1536:dpnqh/sOR5YbAP+uppI4NEwxaHA1zuIUiY8c2+lhCS5bYonh:a/9R5MEPa98c2+lhCSRBnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785041516, "uuid": "e32e5c47-8c63-4326-b250-1898495a08eb", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785041516, "uuid": "a8e84dcc-2602-43a5-b65a-6baf17e383ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785041516, "uuid": "24c7998e-9c36-4801-ab86-5d0a1481b738", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccd92d0-88eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785067934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "49c5bae0-a423-4cc4-b5c5-d951f6cdefda", "comment": "Malware payload (Mirai)", "value": "362910eb2cf249860449d75f6ae3c1f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "e8df74aa-5670-4fb7-b3c1-8f1d599846bf", "comment": "Malware payload (Mirai)", "value": "e8e671bc3101ffe1e677d2a4d222fd2ecbf4862e1c4a8553d678cd0b632bc6dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "c1a99fbb-a6c4-4113-8022-b1fda4fcc881", "comment": "Malware payload (Mirai)", "value": "03aaff6b6efaf2eaf864dc792e07a6c0689d48df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067934, "uuid": "75efeb84-9393-43cb-9603-c7e96dab5b41", "comment": "Malware payload (Mirai)", "value": "700e9b0e21bd30deb2b35d25ca5228cd2526b6b1ffae484eb3614cfd45b9293485ea38acd6c7142a89eaecedbf9f7cc6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067934, "uuid": "cdb9c3c2-b98c-4df5-b67b-84a261fb39a9", "value": "T134733955BC819617C6C2627BFB0E428D372663ACE3DE32079E145F21378B96B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067934, "uuid": "2a62eadb-7222-41fa-9f10-1e1262eda9a0", "value": "1536:SFrN3Ao6lc5EdYUICtd8RBsldlAL/1uebEwKBWHldC8nftU7+krHAl5B:SFJ3AoecRUIxRBslTAL/1ueIw9lU8nW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067934, "uuid": "449fba0e-5a48-4552-9272-10d37ff0591f", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067934, "uuid": "b1a6161e-5d38-4d1e-8fbe-50b3e265d3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067934, "uuid": "51e3d16f-5bda-47d6-89f2-eec70ab13c6b", "value": "lul.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa080e-88d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785059901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059901, "uuid": "16a8d3c4-f6b5-4563-94dd-34ca270e86c8", "comment": "Malware payload (LummaStealer)", "value": "ad0828b0a53cc41bf2edde1d0689356f", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059901, "uuid": "103f35ad-d461-4598-a2c3-ee471e3eeb4f", "comment": "Malware payload (LummaStealer)", "value": "e8e9e5a2b793f043ed422e9b3d5906d887919c37218e24cc28eec3e086f5db4e", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059901, "uuid": "6e74b2c6-0a99-48a1-b13b-e30e03f090cf", "comment": "Malware payload (LummaStealer)", "value": "9642cc0027221b1c7ba1b9b3a39f66fabec670d3", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785059901, "uuid": "085a8102-b898-47b8-a483-6f710d48c52a", "comment": "Malware payload (LummaStealer)", "value": "bd0cb864dd966e689b96a78eb6854c6da6f44514712b2946ccbf8190901be1b086885deecd6997eb0a3a6efdfa41543f", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059901, "uuid": "95afa555-e790-4eff-a2c9-4e68c2da0629", "value": "T1503633F5F4F297DBF53BD2714202A9F1DD0AAE559AB240F3482E793191B3BD12B94220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059901, "uuid": "8a1dc049-7b8f-49aa-b4ed-2c945d05f61b", "value": "98304:eEU99eE9Pov1x+FTW0EJZI5KkqgepBSe9atp/tDBy7cJapnIhfY8oiLnDZT:eEU9oE1ov1gW0v5Xk2D/toyapnioqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785059901, "uuid": "ee95ebd5-1744-4f4a-b253-f5b4444bc2ab", "value": 5267456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785059901, "uuid": "c67cfe9d-0eab-42aa-ba4d-6abec8beac6d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785059901, "uuid": "d1dd2a0b-8d34-4627-a365-84cbbde93da0", "value": "EWPZBSBT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1e69bf-88c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785050998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050998, "uuid": "91b34a88-5429-4d4e-b842-8344bac48b0a", "comment": "Malware payload (JackSkid)", "value": "7881c3cdde52961ed3ba7eef8fb1e8aa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050998, "uuid": "9cd0cb7c-cc2e-448e-a17a-8bbc8cc9cc46", "comment": "Malware payload (JackSkid)", "value": "e95a624d496acffdaf87ec8fba2d5e5fc662b5870ce69bc45505434109092bf3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050998, "uuid": "a426caf6-159f-4be0-8183-4e0c361f54b8", "comment": "Malware payload (JackSkid)", "value": "5cab38cb69418268b7a6a211d24d3f975e294822", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785050998, "uuid": "205ef9db-bd10-4f1a-b3e0-2d98a671fb4f", "comment": "Malware payload (JackSkid)", "value": "9c76c4d6fb40d16fba3e64306c562a30ead19d9ad50a32efd53c38bd5ed03396f4f840edbf79a24436294b5877e780f0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785050998, "uuid": "88e6d6ea-6886-4024-a562-7fcb1554e85f", "value": "T1CC6412E96A19A87EEEEE3277493B173902781EA0D011C99F05418674327135E9BCF7CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785050998, "uuid": "27085546-7008-45c0-9968-509b554755a0", "value": "6144:alqjA8qb0wBN/R7T/d1lgsst1mJePVX4l+RrrbPpiWBpjNMnN:eb0yNZvlgDmedEQXEW/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785050998, "uuid": "f2e14db7-e05d-4495-a801-70a613ef1c44", "value": 324642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785050998, "uuid": "e3041d84-e8a3-4056-b33b-29b34e056ebc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785050998, "uuid": "d7b402a7-c92e-4c4a-ac63-a640a3218a6c", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdd2063-8937-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785100769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100769, "uuid": "84e7d5b7-ae32-40ee-af84-ac798357c3ed", "comment": "Malware payload (LummaStealer)", "value": "1b7b5a050a3c834448c925de7e33633b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100769, "uuid": "7926a19f-c4ce-4453-939f-dd3b9de5c24c", "comment": "Malware payload (LummaStealer)", "value": "e964b3d18222d68e19230c089fc7599f1d9fd6dc205fca13705c535feebe0627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100769, "uuid": "3cc7651f-a352-4974-8a08-b9438aa6b6b2", "comment": "Malware payload (LummaStealer)", "value": "c4748eac0048e91b1a95f94b5f4fd835a5200f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100769, "uuid": "454c060d-4335-4546-83a9-afb3ac3c4e44", "comment": "Malware payload (LummaStealer)", "value": "83cfac37f40c2a05d58cd2472e1f6388104a3b6d58c3affac571944348c6394a8a9e4b06c5abd9a27d137814238c54c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100769, "uuid": "1e8ce52c-4224-41a0-ba10-f447a8e4b465", "value": "T1D3A55B40FDD359F6E002163295A772AB2335AC050B3BDB97EB84BA79F9772D50837209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100769, "uuid": "f21aae8d-1809-436c-a18f-bd53b2db909d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100769, "uuid": "1ca1f99c-c196-4625-b95c-389ed52bd67c", "value": "24576:joWN5h3U4Lg/LFlsYyZ61U+BRqATkMdzMrioyMaZzqZwnv0o4zW/ItJEzb3gqswW:j/NrRr61z1s2v0o4zW/IjEzbQqshbgGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100769, "uuid": "363ccaa2-20db-4310-9d43-17bae5ff7d2e", "value": 2243760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100769, "uuid": "9713de10-37a8-440a-92c9-30f5321c8060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100769, "uuid": "1d1c2934-766e-4073-82e9-ce3d937636d8", "value": "Build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288117cc-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785063605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063605, "uuid": "49d52b06-8380-4bd5-a408-61fae53774dd", "comment": "Malware payload (Mirai)", "value": "22f973fdd19ffbc175ea4197b52f2186", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063605, "uuid": "aa43a955-9066-4d6a-ad6f-cf9f700e3508", "comment": "Malware payload (Mirai)", "value": "eb17bc993361150759bc35afc8c1120dc6f230d87f25e5b9f240ca9781b05860", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063605, "uuid": "b29fc346-9563-4548-ac5d-a15e0e14f6c8", "comment": "Malware payload (Mirai)", "value": "33d79e22b40b1bcff0a9fa47cd55baa0225b2c69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063605, "uuid": "5a74816b-b38f-40b1-952d-43b60ccb8b13", "comment": "Malware payload (Mirai)", "value": "1393f6c883ee303ac4381cfa7093ae812dba32fca02f3ae3f4fc7dfbc94593a7082cfd940887dbdff3e12b0ec02774f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063605, "uuid": "eb06ac18-a5a2-4a68-8891-ad713ef0f732", "value": "T17551B48663846D386CE7EA13E6B7C238348194A22DE16FE6DBCCBFE4468ED143540753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063605, "uuid": "977a7edc-0086-4567-80b9-80344be705b4", "value": "48:vv+7s+7N7hv+N+6Gv+gF+zPv+d+KWv+b+oUv+7b+7o7Uv+f++3bv+c+9Rv+n+cgd:vv+7s+7N7hv+N+6Gv+gF+zPv+d+KWv+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063605, "uuid": "63564a01-c412-49d9-980a-beba6184caa7", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063605, "uuid": "8250f559-cea1-4cd7-8828-9c7b7964f077", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063605, "uuid": "3fa95d52-7bf5-44be-8427-2f16c1195cc3", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b402b9-88e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785067115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067115, "uuid": "2d997170-dbfa-4489-bfe4-c4ea4e38b328", "comment": "Malware payload", "value": "41f5406784269317e061d3540390925c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067115, "uuid": "31a2630c-5191-424a-8da9-d0d7b5ba811e", "comment": "Malware payload", "value": "ec6036d456f112cf7cdc3b35ef7a785a1018edad816dcfb36f46e03f7029d6a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067115, "uuid": "7b7beb7d-cd62-43c8-89e4-afa58f4f2d4b", "comment": "Malware payload", "value": "0c1c900ad7309cba7c98a99d10a655c7a70d549b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785067115, "uuid": "a6f33694-9cef-4531-b6ab-e376c88822cd", "comment": "Malware payload", "value": "39d74aeda591fc58d35c56f0d4fa0c8a9de6f368d161347d239ac0104c1cd3785f92f5e114061b4bcc075ffcbbb441cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067115, "uuid": "fad91896-6a4c-401a-954f-4c81cd129b32", "value": "T1E6F0FFD1F2A607F3CFCE9D5BEB07496D705A72CA2A174FD82C99A159D3706C6F46000A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067115, "uuid": "fad71774-52e7-4251-a47c-e9eb34e73910", "value": "12:KpxRt7oBbLTWkttoBsAWktgkoBgLKVTWktlfoB6YWkt9RoBnWn:KpftMBv6u2BsbuCBOKYuOB6Tu9qBWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785067115, "uuid": "986c59ff-a918-445d-97e5-fad7c2d683ca", "value": 594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785067115, "uuid": "b8eef11d-c796-454f-939f-e3a2c101f93e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785067115, "uuid": "3137b194-c486-45e3-acc6-eb20bddd7ba1", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9366b929-8937-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785100721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100721, "uuid": "2e5a3f8c-81fa-4156-8977-f12e317d3ccc", "comment": "Malware payload", "value": "4e679b35fc6e23403d369fc1e93ef2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100721, "uuid": "fafa4426-459b-46e1-856b-4bc2a2ed9647", "comment": "Malware payload", "value": "ed401886b771152687f6fc844e8c2c296705456e810a1ec5886c7065735f2951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100721, "uuid": "8aba0b76-c8bc-4d55-88e5-890dbb657564", "comment": "Malware payload", "value": "0935ee0928ed100fb28fcfaa3f7dee6f4403e93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785100721, "uuid": "c315c2ae-1f58-4043-ac48-d8c247e12f72", "comment": "Malware payload", "value": "d008e9a037e708d006a98aa060e086b1773f06da9eebe8898566b9c76c4fc2fe9c9cbd3a4c4224341397503233e15832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100721, "uuid": "789aec01-9d63-413a-aeb5-f661c01d9e72", "value": "T1AF448C59B7B51CF9EDA7853DC9424A06EB72BC0647A0E68F03E00A975F236E05E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100721, "uuid": "97d05e2b-dd42-4370-9617-16302f48c22c", "value": "fe133f5557cac3cd3d72d3e03c96c29f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100721, "uuid": "3c7b8c5f-364a-414b-b58c-b740bbdf5077", "value": "3072:50+nnW7foMeTUN4MySOswQdiOylAzLyH4EvMu8smzrI9d8CqdnJ7sn4c95N+ppKR:508dUl3ZdiOam8DbL8tKsp+sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785100721, "uuid": "191ce7a5-2230-4f40-afcd-19ebc91ee68a", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785100721, "uuid": "1518bab0-10b0-49ca-b9b9-e021ecbc449b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785100721, "uuid": "763d7933-e167-41bf-b6bc-00fe38a90316", "value": "encryptor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cf8e88-88b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785044506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044506, "uuid": "fe0013fd-4e2a-4afe-b3a9-d3a27df3b029", "comment": "Malware payload (WannaCry)", "value": "a435d6c5f9780c325f01ae1e13d8e7e6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044506, "uuid": "087a54fb-8db9-462c-9427-a0c617ea13aa", "comment": "Malware payload (WannaCry)", "value": "ed404b104008ed091ee3bf996d419b4a7ec3d65bdce1af8ae8196b94d4638d06", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044506, "uuid": "1547b2e6-ebc4-4ea0-a765-07f3e3c50374", "comment": "Malware payload (WannaCry)", "value": "afc7b16b2edd11af270ad4faa23567d4d2e867a3", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785044506, "uuid": "43a9b051-eadb-4d75-8301-8104c0aa834c", "comment": "Malware payload (WannaCry)", "value": "e0b5c0ee11c9980881d80d8d01582de843f08e771c4561fa9f7f1019a5ee20b12da2172523d818427d7aed55d63a6c71", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044506, "uuid": "fab887c9-e719-4281-929e-bcd49c97ab2f", "value": "T1AAA5235932BC81FCC006257944B78E67E7B37C9A13FE6A0F8B404AAA1E13755BF64742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044506, "uuid": "03f39a03-ae98-4b67-a6a2-98a5a342311d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044506, "uuid": "04c58268-39a9-4ea2-9873-9079e355561d", "value": "49152:jnYnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SA9:DI8qPoBhz1aRxcSUDk36SA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785044506, "uuid": "f268259d-6b5d-4ed4-98f4-81e54f56e955", "value": 2062336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785044506, "uuid": "ff3509e6-7e0f-4a4d-873c-1e6339f1de7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785044506, "uuid": "bddac697-0737-42f0-b928-75cad5e43cfa", "value": "ed404b104008ed091ee3bf996d419b4a7ec3d65bdce1af8ae8196b94d4638d06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0409b9b6-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785063544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063544, "uuid": "85cbc442-f05f-49ab-aa25-507751b1c071", "comment": "Malware payload (Mirai)", "value": "1341382eecd57f9484c2007aa956056b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063544, "uuid": "284e44bb-6bae-4cd9-8367-5e189c34523d", "comment": "Malware payload (Mirai)", "value": "edef92de76c828d85960b4feca11d91bf5d61a345c8fd3bd867cd7ecbb35fa90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063544, "uuid": "4d01b80b-04c9-452b-8c8e-2e1e34cf8d4a", "comment": "Malware payload (Mirai)", "value": "1fe7892d0d592b2594c57b82a8975d1f5eeb7e6b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063544, "uuid": "0c8d12c0-de5d-4c55-8075-603186fc83c1", "comment": "Malware payload (Mirai)", "value": "a2e16a0a5d8a75301207a7eb4d9aa950f354ab485b9c7e31ffbab8ad321d0db6ffc6f8ec95cbe3889bbe27d2bb8d3908", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063544, "uuid": "ad09bdec-951b-4c96-818e-2776d559b374", "value": "T13873F886BC919A5655D423BBBE6E85CE330323B8D2DF7103DD055F18B6CA84F0E7A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063544, "uuid": "abd98e18-d55e-4d85-a7fb-e93a1f4cc689", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysX+4if3LEVwjU5:T2s/ITo7WCkybotgsJ913DhrbW4UYSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063544, "uuid": "1cb8cd98-24eb-4ce5-945b-8fd53e6df6c9", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063544, "uuid": "1c9857be-9dc4-49c0-9bef-6911a03874a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063544, "uuid": "821dd996-acd9-4f28-a5b4-73fd905ef54f", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f18c5fc-8927-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785093654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093654, "uuid": "3f57a888-7011-4e43-a077-2abb6c9ee863", "comment": "Malware payload (Mirai)", "value": "450d55b930f11faed9ad2a2fd8e38948", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093654, "uuid": "9f3679cc-4696-43eb-a39a-e5cc78fedc72", "comment": "Malware payload (Mirai)", "value": "ee1e2234a51bbba1bfdf4726fc06c351b2dbc3a952215e608e9e4a5874e380f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093654, "uuid": "4a0dced7-b4c0-46f7-be59-32eaa2b2e5aa", "comment": "Malware payload (Mirai)", "value": "fd7ab4a722faeec3e948910b70fb8e1c1db00647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785093654, "uuid": "9da5c5cc-76ab-40fd-813c-bf3403412b4b", "comment": "Malware payload (Mirai)", "value": "852819c8b8a5d36dc5d5b768c33b5e91c5b023145298b2057ae55c5da79e244281450d7dc2850a5cfd34c4e21586b39c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093654, "uuid": "9c413b92-c8f1-451a-a109-06a9504dabd5", "value": "T139F38C67D8356E6CD224E4B0F4319F7D2B53D66180931FAAA9A7C6748047DCCF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093654, "uuid": "7b4979fb-d4b8-4eb6-a5c6-3809b61c6e80", "value": "3072:Ldbbj+N1D9ffVuY14vn/j8It7YWLh6aFiiz:Ldu93AY14vn7hBLxFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785093654, "uuid": "d7c68ccb-a869-45a4-b609-7c2f854bb262", "value": 159108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785093654, "uuid": "fa7f15e3-372d-4b8a-a439-1b087072cd41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785093654, "uuid": "679d5b1b-4e7b-4f22-a6c1-a47f90d61de5", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0e291-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785070061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070061, "uuid": "8ec57676-94d6-44f5-846f-1569b7748e58", "comment": "Malware payload", "value": "e569ffc33c4df90a80be01935fa29241", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070061, "uuid": "fbf5f493-9dd0-4f43-9712-ece023dd792b", "comment": "Malware payload", "value": "ee35906ce0bc0c30606124a15ae2f80de1aa7bc7479985e1b3632d0e80b3439a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070061, "uuid": "3c141c06-e5bc-4309-bc5c-5cce14415b70", "comment": "Malware payload", "value": "c2fe9141c57e30ddd29844b554418b1516da523c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785070061, "uuid": "f39fcc79-ca6e-4f70-a4c5-98ad9ec6edce", "comment": "Malware payload", "value": "86119c75e94d802719799f32c29417a0b2535eb72bb3eb2614ac4724a81fc5a9fe76bdb80442465b0c6a2c3172828da1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070061, "uuid": "21df1f76-b47e-4d36-ae70-20c0b02fb3d0", "value": "T17D235C512A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070061, "uuid": "51b9c6e5-6515-4e68-829f-e4f874d2705d", "value": "768:4QFWzZx5f9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Lkzicr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785070061, "uuid": "647d05f8-e497-430f-8969-f0cc6f21e2d8", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785070061, "uuid": "02037e09-d110-463d-82d8-dc81e4c771df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785070061, "uuid": "03f2d363-4d64-48bc-9d39-c5470dcf2f0c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f9dd2d-88be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785048753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048753, "uuid": "41daa51e-d31f-4c2d-8b1f-bf267cb36c09", "comment": "Malware payload (Efimer)", "value": "639cd8818adf9dab85b5bdf8e96d6d9c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048753, "uuid": "1797bca2-de49-49c2-bd4b-1e3efd2c4a3f", "comment": "Malware payload (Efimer)", "value": "ef9b9ea96d71138ecd1f3bbeadf24a4dcb5ead0fb7d3cf58ac37ea41f44f7e69", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048753, "uuid": "e7dc78a9-0f10-49ab-938c-9594a1bc3d6a", "comment": "Malware payload (Efimer)", "value": "cbc1bad5b84f82b0bf3b233cc02421033256b204", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048753, "uuid": "02f6f70c-c784-43f4-a38e-73c2689b7a20", "comment": "Malware payload (Efimer)", "value": "08fb108c099e1f4845777e059ccaf43e6a53d93452303f15a3dbb67e4b8d04c228c863e0d1df10909bd1b5a5ff3a812f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048753, "uuid": "7ab979cc-0515-4ecf-ac2b-5b2d5df6331a", "value": "T1B4E6338862C052DEF6B3903CFEE156B6E66978A447B0CD9F539966A7DC032C4893CD13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048753, "uuid": "54611f1e-320f-4d42-b0bd-be24b57e8f94", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048753, "uuid": "6d50f77e-6c31-42c2-beb0-f79f8dcba978", "value": "393216:PgvjM0g2UzHF1b+ewn+4iVXMCHWUjXGcuI3/PGTAI:PgvI0g2kX8mXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785048753, "uuid": "ffcb7143-2488-4434-8a24-de56d9b0ebf1", "value": 14267208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785048753, "uuid": "8a74ee11-601a-4fca-81a0-c2dcd13ee6b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048753, "uuid": "4b155168-520a-476e-9705-bcd91bd04658", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e1eedc-891a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785088245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088245, "uuid": "d1c13239-5523-4bf7-b9a7-f76d1739febf", "comment": "Malware payload", "value": "c6921378a841fa907e2ab095b828cc25", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088245, "uuid": "9f5d157b-f35c-4866-89ef-729dd67e4702", "comment": "Malware payload", "value": "efceb8294808ff27ff53a7870bb4820277fdbf3f817f9f20d951840c5da1531f", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088245, "uuid": "efd6e1b2-6dcc-4dcc-adfb-095b450476d6", "comment": "Malware payload", "value": "5cd6bd8ac4ae1a2a3462127886c97c1c4b082643", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785088245, "uuid": "6f6277b2-7375-46cd-be41-4e6d6607e03b", "comment": "Malware payload", "value": "472d23a459a0b3e8395f2831be7c656c26cabfe20903b79dbbfb39e0a1dc0559b46b84efd9c24ed98a6f0eb15fb2c619", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088245, "uuid": "5a9565e0-15a0-4676-a4bc-dd8655682ac7", "value": "T1400178DCD0A9CB400AF8C482F5F04805C49190C3A1B693CAF38E1926EF28D4E396324E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088245, "uuid": "99e3c2db-3b40-432d-bd53-aba89fad95c9", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+QDjffAp5AyhjZhG+E6:FH8j/wWi2jz8XfYpGyh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785088245, "uuid": "69145da6-7f20-43bf-8d4f-50b434416c19", "value": 689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785088245, "uuid": "ea7dffcb-b82f-4705-870c-d1ea1e86d52a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785088245, "uuid": "cc78df48-d9c8-44eb-acba-2309c8e1e7f8", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2690b348-8923-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785091948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091948, "uuid": "295ea632-7c1d-45cf-aee8-5e5e01235466", "comment": "Malware payload", "value": "dbe604a519a46c1d97c48853b7666886", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091948, "uuid": "a80204ec-67b8-4d39-9d1a-307f38537d9d", "comment": "Malware payload", "value": "f02758770d616fc8ff7ddbe5caf069d4bbd2bae5422a32a95cfa8c7f6a0a9b8d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091948, "uuid": "58ab3dde-e4e8-4a1d-b813-608cc1b1b8ef", "comment": "Malware payload", "value": "288671a4f0294228030d12bc8d7b2add26d24a37", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785091948, "uuid": "ed5e95db-79b5-42c1-81f0-cdfac872b88f", "comment": "Malware payload", "value": "78aa11b7653f9c1a1f2a158caa6b052ba3e4087937f99e474643292449ce194b58190b1f501673d14c4113c5897f947d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091948, "uuid": "e9d1a580-938c-4791-be9d-8b3872be0055", "value": "T1BBE6330CABF901FEEA734279CDB185A5E864B4735B72D18B0B9843A21D272E14D3D717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091948, "uuid": "d2ea73db-344c-4f6c-9d1c-968156aeed09", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091948, "uuid": "4a62789d-a2ca-4768-86a1-5cf720bdbb50", "value": "393216:XmRnr5q552TiIWV3LaPGuBmrhNOXMCHWUjXOcuI3/PGTAI:XmNU5gTijVu8GXMb8XjH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785091948, "uuid": "a76ba245-ff5d-49a7-a5f3-784826b05cd8", "value": 14304211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785091948, "uuid": "4a950df3-cc25-43c9-bacc-24db3b576f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785091948, "uuid": "9ccf202b-c944-4405-9e6c-2d7423047629", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bc27ae-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063357, "uuid": "5de2b906-955d-40d8-9b2c-fce28cacd937", "comment": "Malware payload", "value": "6059b67c7198d84c5e00c81681d06805", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063357, "uuid": "41b5ca85-4bbf-42fc-b26d-f85e79e7671e", "comment": "Malware payload", "value": "f048fc2a2f9c80134d16a7b45bfcf41b86540770cc6cc5eb9fbb6b18a4627158", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063357, "uuid": "a73d1806-0a7b-4045-ad91-b92e8710e6ae", "comment": "Malware payload", "value": "12f1c014acb957bfbd3909d4c4e0bfff6bf9ee55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063357, "uuid": "9aba3eb7-1c5c-4217-9877-22633184a1dd", "comment": "Malware payload", "value": "331a2d9520368fddd3b41609ce2c341a439782f90c1305602252d02e26ecff4795d02878d1f374bd1678ad98afe775ad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063357, "uuid": "65735dff-f48f-48a5-b943-49b38384e03f", "value": "T1186607C1E991D24AC63D6D31EFD6EFE8E26B2F315D885A4AC9C9F73E08B314480B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063357, "uuid": "3448cecf-fb8d-4f6b-8ccb-83529e4452ca", "value": "49152:PzFR8B3snrFWH3g2fGBc254AloGlLSIZiTUG33Eo8jdg6WNuGPMRfLviHHDt5Ee:PzoB3snrFV2fc1ggLKnDjEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063357, "uuid": "4ddeda5d-2198-4aaa-b6d3-69a7401ff454", "value": 6553748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063357, "uuid": "430722c6-b820-4a37-9e30-4c0f10b8c8ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063357, "uuid": "505e7484-5f43-4a97-a71d-d1d37cdd2552", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4caa3c-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081219, "uuid": "863cdb59-abaf-4d87-91ec-ac67319346b1", "comment": "Malware payload (Mirai)", "value": "48cec489a262d3de02be4a44f1264ea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081219, "uuid": "2ff3daa4-b35d-41f7-9023-188120f1d8c7", "comment": "Malware payload (Mirai)", "value": "f129613a6522531b534777a228f5e2c63bedcf531463c2bb4a383dc1f76feb18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081219, "uuid": "8443e4e3-6740-4932-bc99-7193687b650f", "comment": "Malware payload (Mirai)", "value": "94da465830e54d15d24cb49bbf22e613ab24de8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081219, "uuid": "b864a4d4-7207-4290-bf63-ccb1bf932f0a", "comment": "Malware payload (Mirai)", "value": "95504976665de7d8159097368a24e421a7280eb392803182304ee4e428de64843c49c2740c5eb0a1c3b15b5ed34cbb3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081219, "uuid": "57ba4b95-0fef-4140-8935-a9ec0411d2f2", "value": "T18B048E9CAD0EBD01C7DAE3BD8C098B62B03774B44325D1B37D0052AED9BBDA6D5E2521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081219, "uuid": "75206071-a2ea-4984-ac5b-b3b799790286", "value": "3072:bs44B913uRwRLgOuPucRfuAv0niKljNlHayTbD/VUOpPMoilp69KLSvvr5:Q44BDf1/FiKl/HaIbDKOp0HpmKg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081219, "uuid": "b30c9770-3641-4ad4-8ac8-3357ff64f536", "value": 173808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081219, "uuid": "0ea95235-4f70-4218-bd9a-fa6814e5f068", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081219, "uuid": "543f036f-d899-4557-8683-d1227af1dfc5", "value": "flutter.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a15e8a-88aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785040302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040302, "uuid": "0c1bdf70-a448-4acb-a1ca-f0a6567ea9b1", "comment": "Malware payload (XWorm)", "value": "3c4f9d2346850b1daf329b5bb9daa18d", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040302, "uuid": "89ceecde-8460-4d7a-9cfa-aabc56499a43", "comment": "Malware payload (XWorm)", "value": "f1a75d5acaf8fa5a809bc814958cdd466d22aef012641f756e8bb16f04eb2556", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040302, "uuid": "7f3d2055-01b0-4a00-b833-791830aff58c", "comment": "Malware payload (XWorm)", "value": "efeb78efd4f559b344339da15c94aed6a8535682", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785040302, "uuid": "bee5c377-923f-42bf-9ff2-df69e5489c0f", "comment": "Malware payload (XWorm)", "value": "c94053855a117ebe7d7707f42e155cacc7fed2d0c9a12978329eb5356a9a487de4d0cf7fafe5f40ab7fd791961dc8d96", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040302, "uuid": "a4cbb1be-a3a9-4a38-b28a-54ed74f13fa9", "value": "T1CAD33A6EFFA24C14C64E4EB3C4A351444BB9D897542BF7E725C91CB99CE2C2D8C8B690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040302, "uuid": "06f0c655-5aeb-4b52-88d9-4ec163475914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040302, "uuid": "0c0e7049-d8cb-4063-94f9-12e855754701", "value": "3072:WIkVg7JSGNcRHjquJ22Pqxfmaogrhb5RyZFo:WIxVSGCifmvMhbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785040302, "uuid": "b0c26d56-0d58-48fc-a23b-b8efc3006f86", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785040302, "uuid": "8bc5aedc-b60c-4aee-a1c9-0323796ca634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785040302, "uuid": "60cab35e-76ee-4e91-a440-3ed539d9bc4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd695bd9-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069868, "uuid": "788c1126-142c-4a60-911a-943e1d89e2f9", "comment": "Malware payload (Mirai)", "value": "0d3d8247bfda62747c0c54ad7d33f0d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069868, "uuid": "e825609c-162a-4f6b-a3aa-6b856a306853", "comment": "Malware payload (Mirai)", "value": "f248b51e4fc4be60b02fa3db68b774bf35771809119e4faa4194cc01e4b4baad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069868, "uuid": "df6280fd-2a71-48db-8f5e-397c2406fd61", "comment": "Malware payload (Mirai)", "value": "e31e0ead769444fad2677e76268012bb08bbfde8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069868, "uuid": "89d42f12-6056-4d4f-a27e-2ea27df375e8", "comment": "Malware payload (Mirai)", "value": "cbb0fd0ab1fddbd998a905680fbf0f55f025a0b4b38ab64f89d2eff58ae6d5024af711837d311e9817d18260f92dec56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069868, "uuid": "9207929b-5593-4519-8479-22aba06d62fa", "value": "T1A5E2F1B04D548E1BE301837FD28ED42E9032ED725A866FC63E9CA6A9ACE1574031CDDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069868, "uuid": "28a653c3-3485-444e-9545-0a1e4bad5bb6", "value": "768:Nx6j0e4mzxFYpUVKyRqRvt6GI2/MIls0gAWLL3vfaA+d:Nx6j0Rmv1s6T2ajNLrC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069868, "uuid": "2fe02660-e6d7-4f8e-81a3-67a8df542ef4", "value": 33172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069868, "uuid": "2de08dba-d56e-4468-8700-37e76fa91361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069868, "uuid": "ccf8ca78-3006-4d50-bed1-3097cc74873a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44666cc7-88c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (JackSkid)", "timestamp": 1785051196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051196, "uuid": "519272c0-33f2-4d6b-8cd6-bdae5aa7a233", "comment": "Malware payload (JackSkid)", "value": "b3114235d4448fc85f6264904cee37b4", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051196, "uuid": "eea29936-2c03-4c8b-a35a-3ee686622a7d", "comment": "Malware payload (JackSkid)", "value": "f278a86c15f3bf05a94455387178aafa99e4b2aca3e23f1990ff81d22aa0fd0c", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051196, "uuid": "374e729b-780a-40ba-968d-bb60e8534491", "comment": "Malware payload (JackSkid)", "value": "9d33497c47e6aca2553a432429865c63f84644d2", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785051196, "uuid": "0402d933-4ce1-48ec-b71a-7ae2d34cc3d6", "comment": "Malware payload (JackSkid)", "value": "4f09884ea97bfa20495360ab912c7196e5d3777996a4efbcac58c0e03c35d42142ccf53d07ed7ba923a17a2a53ff5533", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf.jackskid", "colour": "#AD1EC3", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051196, "uuid": "e60ffea4-a303-4ca1-8685-eef8d5e8f523", "value": "T1C7F0786122B10E712E46086D16C36846611A0C443DF61DC6A2ED3860968F8AEE3A38AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051196, "uuid": "67604dbc-acf1-4b52-9012-b35985472b4d", "value": "12:9pcgaOWpcgaOxcgaONyFQcgay2H5v+aQCROLvmPjwvmGSpvmPjm:94OW4OwOyyS5v+aQfbm8mGSZmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785051196, "uuid": "62af46c2-5b19-43d9-a5bc-0758165232cf", "value": 606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785051196, "uuid": "29c98655-ab94-4562-8efe-9546d420fe49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785051196, "uuid": "e0d4e90a-e077-41e8-b432-3ffbac0f2f28", "value": "stager.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd33ac9-893e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785103721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103721, "uuid": "e7602363-877f-4930-bdf4-a46eefe49420", "comment": "Malware payload (RemusStealer)", "value": "4a8a5fdf5feb574213c53bca1cb9688a", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103721, "uuid": "64613ea1-d435-40fa-a2cc-5a382ca981fa", "comment": "Malware payload (RemusStealer)", "value": "f30ce99a34cfc61168a99aff2ad0463cf0dac2902f86b1e73d060a28499bcf7f", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103721, "uuid": "e813d515-af9c-4601-aa93-9397fec918c9", "comment": "Malware payload (RemusStealer)", "value": "22e8454bee44e98d9be147e9f397bc1a554342f5", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103721, "uuid": "ab7efeab-eeda-48b3-8d2e-71f1a148b32e", "comment": "Malware payload (RemusStealer)", "value": "a1f53156677c4fbf3a944884c738b474a72cdb53b0bdc5b6bc47dd45b0fb6826995a9c734713b12045dc40eeae503314", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103721, "uuid": "a68cc399-9b24-4f96-a6b0-359e2a55f7f8", "value": "T11DC55907BCA149F6C0AAA33189B252527B71BC085B3633D72E90B7382F727D15D79B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103721, "uuid": "74cd61ab-52b0-4973-a1b4-a085b405def8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103721, "uuid": "b0c04836-bf62-432c-ac34-53114dd5c13e", "value": "24576:ZIYvYEzAZJ8SxwQ7gPZHHn7rYfcISSmCJCOLOMO1ME9zeZVaPZoBele5I9DUAKRE:ZIYQ8ArxT7gFb1/qECMBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103721, "uuid": "e2a10632-0c52-4a23-b711-ae021a3f1e96", "value": 2612568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103721, "uuid": "f7cc0cd8-eda9-4743-9c70-2d058e9b47b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103721, "uuid": "5ba1c108-afc1-48c3-9ac5-ae79b817ff10", "value": "ARbeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704f5767-893e-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785103669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103669, "uuid": "84dba254-445d-4c34-b452-28570287f9fc", "comment": "Malware payload (LummaStealer)", "value": "d5254b68ad505660d433d8eed93c371f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103669, "uuid": "4d7d1fce-9d2e-435f-b6ec-43600da921dd", "comment": "Malware payload (LummaStealer)", "value": "f3761ae2ffb508e1df76e974692226ac38b368b213349e2969d72fc49f51ea7a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103669, "uuid": "9c3237cb-fe1f-4f8a-ab67-4fe9c5f4e334", "comment": "Malware payload (LummaStealer)", "value": "c41da0cd9d017f4ff38bdfbd19e8f7ac6d9e2a0b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785103669, "uuid": "a309ff8d-d6cb-405c-bf7f-8e498e4a8fde", "comment": "Malware payload (LummaStealer)", "value": "b4943750309e4a11338c7784f0008c2a1f89c69cb481e1b4bfbf1ad9ab092a8568bd24d27b0df425589a115a8ba77ce7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "monitor-monitorportal-cc", "colour": "#0F4B2F", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103669, "uuid": "4486f738-6793-4b1b-9c7d-9983af8c8b56", "value": "T1F1D56A01FEC755F2E503163154A762AF273AAD065F35DB97EA807B7AEA332D10832709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103669, "uuid": "eba9059b-b68a-47b0-8a31-e5584eff9f98", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103669, "uuid": "4993c6d5-f2b7-49b7-a5a3-db11a1dba181", "value": "49152:/LDANbVYqBDXfQnjI78Va/DwMRYXebQhfBz:jcNbSafqSR/DwMRg1h5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785103669, "uuid": "750f7e52-3676-41f0-ba35-4a6a0066b0cc", "value": 2999144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785103669, "uuid": "059c6ad6-9661-426e-ba3d-43171c804f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785103669, "uuid": "25f57d6e-9001-4bd4-933c-d2c57ca1ea61", "value": "acr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd67f94-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785106483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106483, "uuid": "72b5fada-ec96-4c49-bad7-6c86e74983d1", "comment": "Malware payload (RemusStealer)", "value": "f4d4e4242b6344f5e54b36fa8e882f36", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106483, "uuid": "441f0a75-518b-4d36-b842-a33280ce14ff", "comment": "Malware payload (RemusStealer)", "value": "f43b33aacb1d9f73ec3d687285c0e22ab6bafd6e5797106b711778aef073a9ca", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106483, "uuid": "50daa7f1-30e0-4a01-92b8-b5c43d5122c8", "comment": "Malware payload (RemusStealer)", "value": "453f7fe1bee981cf41006f07e8b5ad6e736ad22a", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106483, "uuid": "73ecb1f9-ba84-4762-ae86-1b70be58d210", "comment": "Malware payload (RemusStealer)", "value": "b6c0e255c6670ed2ac9d42c5b7887fcb0b7a0f5069ee001f167204ec2d9bd678866299ed3454ad89206ac11164750915", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106483, "uuid": "4c7efdc5-2aa4-45fe-8025-c1b6b7b824f4", "value": "T1F624096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106483, "uuid": "bd061b9b-f8fd-4951-a45a-c58257cd9083", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106483, "uuid": "a3e36084-44f3-4bdf-ac7d-4c5170d012ac", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFc1nCGiics:Qj5WUEBx+Q7PEfFnQU+tS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106483, "uuid": "12ee11c0-97bc-4d4c-a40b-1f4394bd92d8", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106483, "uuid": "6967fff8-d2f2-4dc2-b8ee-311424b2edb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106483, "uuid": "d84665e3-1577-49b7-b675-9ecd3584bccf", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2a7167-88f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069998, "uuid": "23a7b73f-9a6f-432f-a75d-82732e9d3ac2", "comment": "Malware payload (Mirai)", "value": "4e2fa277fda3fd116f4a5ab8a9713139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069998, "uuid": "37a54034-0d2d-4f08-9485-44be4019c0b4", "comment": "Malware payload (Mirai)", "value": "f440eb529664b6207dfe42405c559c70b775cd82813c8c30949efa6f5c3bc1e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069998, "uuid": "3acd4489-9ff0-4ef1-a5a2-07ae6b1e5e4b", "comment": "Malware payload (Mirai)", "value": "f05c10828f91b2e49291bb89c553e860ea1551fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069998, "uuid": "54ac2ae5-50bd-475b-b4e3-ac782ee3884a", "comment": "Malware payload (Mirai)", "value": "4117a529e1ff02c4e96f4132fa856d12410d10726990ef5b9558535151c9e8987ee40a3293d80824e12a434e7dd87b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069998, "uuid": "a14b5415-a215-4fca-b52e-284f2480d6ea", "value": "T107A294D2FD42409EC7C007FFAF5ECBC8735393B1C6EDB216EA088614649A94E5F1A980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069998, "uuid": "41869c9c-e371-4488-a7be-b55d4f834faf", "value": "384:aq3V9lN1dFtV9lqS6iKyaCqS6r+KyaCqS6itntT/TiAXTdTHU7s/UWAGjU9ZGO5U:aq3V9lN1dFtV9lqS6iKyaCqS6iKyaCqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069998, "uuid": "929174f3-4c24-4233-910a-5814a4946c55", "value": 23044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069998, "uuid": "93a02748-44e9-4f33-ba94-668abee58301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069998, "uuid": "7d03a25e-463a-4380-8f0a-9998fa9e70a7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bade346c-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "0f937963-86c4-489d-aad1-2e8eb16b8f59", "comment": "Malware payload (Mirai)", "value": "35fd866c2fee644b3353da60653c0dee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "cb6a150f-f811-4454-be4e-d464d18910b2", "comment": "Malware payload (Mirai)", "value": "f4a7f6a1d7307c10af9a7f6b5bab6599c979157656b901e2bae8191c5fab8159", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "13ace37a-10bb-4b5f-8c71-51f44db9a9d0", "comment": "Malware payload (Mirai)", "value": "7a75aa31108b7fc491b7d7de13517dc5c894a13a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069863, "uuid": "c05bb195-ca5b-417c-b0e8-a88b01f4b797", "comment": "Malware payload (Mirai)", "value": "cce9bd1e6b693f60401e6562384665706f2f16ce72b764d2249fca3304040850ccb20b0fb5b80d220ef834d6d1a701af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069863, "uuid": "6df6769a-b193-490f-aebd-4f0d89e1beaf", "value": "T1FCE2E1484064CE23D99B4279C33D2DDAE9FB9C4C4FAFAE1113D095966AEB870572BC70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069863, "uuid": "9cdf0e34-2e04-4e56-b89f-b4435fa265aa", "value": "768:StfgASG0hpXOHjemo63Ig5TLn0hr8SG8vXjFPYROenB:StYmZH14d0OXBwQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069863, "uuid": "c7a518a2-b877-4ef5-9c0a-0de0b8b13bbc", "value": 34028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069863, "uuid": "097365d2-0a42-46de-bf79-e09c0f688a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069863, "uuid": "7c4ec99a-a6f5-48cb-906b-cf530f416936", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d5f1d4-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084887, "uuid": "3a02f025-97fd-4901-a385-97dae4bbf5d4", "comment": "Malware payload (Mirai)", "value": "c1f1cf52e7bb55f2957a04f0e26f6987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084887, "uuid": "10edfd2a-e8b9-425e-9f38-483de26287f9", "comment": "Malware payload (Mirai)", "value": "f4bb3ccd5f060dae8b40b16db746be9818deed7f831021931c6585123a856804", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084887, "uuid": "b3cb4a96-71d9-44b5-b115-c12ea6123c95", "comment": "Malware payload (Mirai)", "value": "0475c25383dd0b470ba487decdebbbb43be14abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084887, "uuid": "f2291e0d-d555-4ea6-a6c6-a0f4a02551a5", "comment": "Malware payload (Mirai)", "value": "cac90ded7b3572595f58eb0edecdc32fc3a1c7935b02d4fd548762928286e1b8d9b67d913214bbe1ab38893615a1a393", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084887, "uuid": "200764bf-6b5d-4e4f-89c2-2eeab10da7eb", "value": "T13D932A56FC815B21C5D502BAF92E118E332317F8E3DE72129D205F21778A96B0E7BE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084887, "uuid": "2a48c3fb-10b6-4628-891d-27b94be9c496", "value": "1536:yPUnaSPzir/TJkJeVnwPQZpTRU2hdkaCiTQCM0iu7ZnQrKan5RY/Ba10YY:yAur7JkJ+nEQZfkan7ZnQrKanvGwBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084887, "uuid": "2e5b384e-7095-4f58-8726-9ab3d59140d0", "value": 92748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084887, "uuid": "70317c11-fd13-4192-8fc4-70c35f8c1081", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084887, "uuid": "cdd16f49-e442-4c03-a5c0-ac58f4364fcd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d85710-8944-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785106332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106332, "uuid": "142f9c69-dc79-4c7e-9e6c-0f2645e03a5e", "comment": "Malware payload", "value": "f9979541d2af1afa4339b737f42f5b8a", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106332, "uuid": "fb7e200b-08ad-46f9-a54b-3c03bb96f91d", "comment": "Malware payload", "value": "f52809d57d816cf9ea7e95de64df46fcc1cf62d3da972c167497935b5eca74d7", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106332, "uuid": "79caec3d-bc75-4721-9f6a-ac331817a1bb", "comment": "Malware payload", "value": "2bf70a77e73578f09f44d7a0c5701ef048170408", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785106332, "uuid": "972f6e55-81c5-4653-8d84-7bd071c39371", "comment": "Malware payload", "value": "3d4b50dd2715ac4ae92ef7050f4c931aa2e318d5ac16fad3530f376455cbb9d72f1bf7a7e8a1b44e57f1bb13364b3742", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106332, "uuid": "d8ebc9e3-a01f-406b-b22a-dbb924175f32", "value": "T12D24096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106332, "uuid": "6541e179-83bc-442d-af27-d640f25e5d7e", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106332, "uuid": "0cd1db60-97ad-483a-8ebf-f7f670a65b38", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLF51RCGiics:Qj5WUEBx+Q7PEfFnQU+tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785106332, "uuid": "43f02fcd-110d-47da-9c1c-3060a96c9212", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785106332, "uuid": "2af6b09b-029d-4ac2-98b2-6d7414e62db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785106332, "uuid": "f0573fd3-d8f3-4f0d-8401-e9f418119b0f", "value": "crazy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f9f7e3-8912-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785084894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084894, "uuid": "0aa1d5cf-5770-485d-bb4d-c14069413b64", "comment": "Malware payload (Mirai)", "value": "45982f363e808cd2a52439bbcf1923be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084894, "uuid": "d073a2c3-31da-4b41-81df-408a6672ee31", "comment": "Malware payload (Mirai)", "value": "f61c4dd62f5c2e5d5d343512e37d6046ffd40a18db24dfa5c5f06c0c0393b162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084894, "uuid": "36ede467-7b5e-4a26-b498-db7d617738bc", "comment": "Malware payload (Mirai)", "value": "26092ad43f87401cc6f411de11bf481d7e965ff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785084894, "uuid": "062f5caa-fe00-4cf3-b903-a2705acbd14c", "comment": "Malware payload (Mirai)", "value": "2452c53bc6a5ed6d3f16f612b2484f2645b79bd264998064ef8c2fbeccecaddd3086ef7aef6cf88386f67361dbaef94b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084894, "uuid": "acb49189-9708-4cc5-a803-70a97aa8ee7f", "value": "T164834951FC815613C5D612BBF66E428D372663E8E2DE3213ED216F113BCA82B0D7BA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084894, "uuid": "66546020-ebde-4d1b-95fa-71e4e24253b4", "value": "1536:lKPXgT5THcjmY57o68uA8v6UJIlPDuGHTgJ2xv2ta10d+:lK/dZcj4clTku2k8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785084894, "uuid": "f888c734-643d-4f4c-9d43-8879ce917e0c", "value": 81340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785084894, "uuid": "0f91eecd-078c-4042-a5da-1ae779615d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785084894, "uuid": "e664e576-0cdc-48e2-9698-1ae3fe6eebae", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9c4c36-88fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785074755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "1deb6ee5-eb39-4630-9d67-d572c9a0f96d", "comment": "Malware payload", "value": "8fd519ac18f7e5b647949c150e7152b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "5bee1d20-36d4-4cb6-a900-d8e8104d8c6a", "comment": "Malware payload", "value": "f788f51aea765ae5fea9d3ce3d13fa381a27eb31ed0019393fd6a6b86d22c731", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "86670de9-d60e-4397-9e5e-2c6bf40c0dbb", "comment": "Malware payload", "value": "b28c172af68d27766953f57e903d288389b4a8ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785074755, "uuid": "83b49fa8-b1bd-4181-bb1e-f107f80d58a4", "comment": "Malware payload", "value": "327614d734dba0bffa73ace740a6cf5ff8c8c8997a0fefff51ebfcdc325f4f327746652e37502b109344f8fcd986941c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074755, "uuid": "7bd1e081-06cf-4a97-b590-c97f996f9a1e", "value": "T10DD02BB05C13C1B85DCE636C1E61C563E0450A465F9600CD4A0B367D99303E775EEA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074755, "uuid": "38baa312-7de6-408c-ae78-d474e2d6d194", "value": "6:hvjqIagcNoo+tdHanrO/BH5UiHfwYfgTlpGBdIZ3:9jqxNoo+tNanryBH5lIYf8h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785074755, "uuid": "22827c42-eb3e-451f-81de-804440fa2084", "value": 264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785074755, "uuid": "8f9a1cbb-a1ab-4b6c-8f9d-ea82bd5a77f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785074755, "uuid": "2fead689-fe64-4e73-a1aa-dbbc1fa43faa", "value": "sync.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8b14a7-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066132, "uuid": "85b48fe8-7b0d-4c27-9bc1-0c2767b34bd7", "comment": "Malware payload (Mirai)", "value": "76a6ad58a112ff122f16992538dff487", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066132, "uuid": "50173952-d6ae-47fd-be8e-c7b10fe0da2f", "comment": "Malware payload (Mirai)", "value": "fa0798740f9e335e26ed2f00bc7ae295b024aff795c2e3767d96daf1f849993d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066132, "uuid": "7afc0ce3-6b93-49e1-9892-9480232cf78c", "comment": "Malware payload (Mirai)", "value": "df3b80d7c248c3b4763fefc10ea4b8ff9fdf27ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066132, "uuid": "b81a9c10-6dda-4c71-b157-8f3895a1c260", "comment": "Malware payload (Mirai)", "value": "7957b6bf17396805a7044c32261e5423d49308bdefb9646bc7093394466a367c710d70fea37ea7b4c9a29d2cd062fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066132, "uuid": "2539b599-e2dd-494e-bda3-8b90c3ae5d18", "value": "T144739E76D0786DA4C5048A34A6ACD9B88B17A40467A33FF2C681CF55004BEFCF6157FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066132, "uuid": "9b5b0980-51ef-4317-9d3c-ef86f4851af5", "value": "1536:g/kM1D3B45wtFN8PSS1E/ESXtRwUtK430MLCnc5:gMMh3q5oMdS9qkJ30ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066132, "uuid": "2d47ef2c-2104-421c-96ca-3074d39a6de1", "value": 80588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066132, "uuid": "f22ad73e-9571-4ff9-b92b-5fc22117827b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066132, "uuid": "36e07555-5ca3-4efa-9c51-470d0395980f", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf465e3-88e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066859, "uuid": "29025dc8-04d8-4ad4-8866-95efcb9da3e9", "comment": "Malware payload (Mirai)", "value": "9ec628ee992c58c00cb13e9b8071b759", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066859, "uuid": "4d53c7f5-3168-405a-ba9d-8b745b127319", "comment": "Malware payload (Mirai)", "value": "fa5fe463b2cf38ef3f7f610bce95ae7735074c71eb3874bf03433ed50337058a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066859, "uuid": "cc9ea11d-3c66-4245-b302-4c7dfd239b66", "comment": "Malware payload (Mirai)", "value": "1b4e53e04a5ffe5c6b0c15d84a020547060a0dd1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066859, "uuid": "7c6c7b8e-03ed-4899-a82b-947fcce7c0f9", "comment": "Malware payload (Mirai)", "value": "1c22a74495a9b75f4c86ce709289636fd1c0ffaed112a8c1a409064ee8c43a9d9b9f71c56e9f483e250d262435950bc2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066859, "uuid": "5ca5b7c0-cfc3-454d-a83f-6b34058d19ec", "value": "T1EE434B1271791A07D0D165F9117BAB4172921AEF12A4D2CFBE720E4BFE213082D66EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066859, "uuid": "4ae5e9ec-cd04-495d-be7c-4529fef8b8ec", "value": "1536:X98FGV9QDI/mliFVoRUWMtul8Xps7EKAsTXFCJjWIymQY2AUYci5hh1gn6m:XuxXIMAsrFnqhh1wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066859, "uuid": "454c0404-559d-4e99-90f9-3be6f7cf243a", "value": 60408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066859, "uuid": "1669f607-e4f5-48af-901a-b66158d3898c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066859, "uuid": "9f60733d-3307-4fd0-96d9-3c063d3ba002", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f54ddaa-88e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785066140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "d456dd27-15b2-4bbf-a57b-05ba769e0c26", "comment": "Malware payload (Mirai)", "value": "aac08a2549111c9cffe2a3fe2f62ff2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "2d9c8f0f-afc1-453d-9d1d-918e8bf6a8b2", "comment": "Malware payload (Mirai)", "value": "fa68f204065309710f1265ae3afa10226901713f23de185de59ab63fb002cb83", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "9ad53de7-dfc8-4dcc-a2f3-fa147b7f787b", "comment": "Malware payload (Mirai)", "value": "450354be220d98c60471c780deca02fe740744b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785066140, "uuid": "5e4dce7e-5c59-4790-94b9-4fa1b5727171", "comment": "Malware payload (Mirai)", "value": "62031f7a30f6005a7a74bc76c6bae2063a386c720725799b5f50992144d53e8cd75932257a7f106a001939c23756fefe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066140, "uuid": "5e0b85ae-fb1e-44f4-a155-0f5090bd44f9", "value": "T1F4831982BC40A629C7D0137BEAAF508E3311B7DDD1DA3243DC254BA47ACA91F0D67B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066140, "uuid": "f8b548d7-191b-42f2-94d8-675a7b5b725c", "value": "1536:tmYUqUtaen3KSv7XCgmIkylNXQCsETjDxCwCB8t46iy99v4:tXUqUt/ZCyJ3Dxty841yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785066140, "uuid": "51f07489-c2d4-4e9c-9342-48fec8cd7764", "value": 81552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785066140, "uuid": "23ed8a63-95ff-4761-bf7f-5f163d7ac18f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785066140, "uuid": "b82c254e-309e-40a1-bf26-bc9ac7eae524", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf58704-88f6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785072820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072820, "uuid": "a8209bf1-4cc9-46fe-a835-329e360655bc", "comment": "Malware payload", "value": "8f9f54bf5c55bed78886da0676036e42", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072820, "uuid": "c860c06a-bfc0-4abb-910f-a84e77ec37c7", "comment": "Malware payload", "value": "fa6f5c0a5eb6edb095d652aa7e5985fa2d0b1a7e7a5e33966bddfb5c5ed3fdfb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072820, "uuid": "da9d24af-0ac6-45b9-9c1f-123341f24737", "comment": "Malware payload", "value": "dbb7a05c7d2ec1c17a2464dbbc0f1287f8038dc4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785072820, "uuid": "9525a86b-f71a-4957-a883-cb6dc83a74b5", "comment": "Malware payload", "value": "80bad965e9b006fa1a664cc42eb6d96bac739b25adbbc362ec1d4a88e93fc205696671f68e895a8c2448f0e7b3352872", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072820, "uuid": "6b5fe518-10d5-4a36-ad16-5ee51712bec9", "value": "T11AC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072820, "uuid": "7fd2b5cb-af22-4986-b82e-5a86e45a0e95", "value": "768:438vCB+25j6es8RUr9FYpMSUpi+20qUpi+20YQX:y8l25JU9d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785072820, "uuid": "e5e31377-31ff-47a9-8ff4-521ed9f3e54b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785072820, "uuid": "e9d66dd1-4cc2-4177-9fba-58602854cdf3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785072820, "uuid": "ed27cf9f-30fc-4f1f-b0ff-64c938207f03", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f64376-88e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Sazoora)", "timestamp": 1785065882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065882, "uuid": "a7a919b6-2d18-4d13-ab17-1557f86ebc09", "comment": "Malware payload (Sazoora)", "value": "11b40f7a933bf15d2eaf184af96d62e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065882, "uuid": "cbb8c0ab-0ddc-4182-88b9-dc97efdae3a0", "comment": "Malware payload (Sazoora)", "value": "fae42d2a7fb879f328cdbd7157de318bfe47134156f152cf2356e9652e732852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065882, "uuid": "32944688-580f-49ae-a7dd-2cd50b560d8a", "comment": "Malware payload (Sazoora)", "value": "67cddbe5b7bf70c71e05f80b5bdc70a23dca0ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785065882, "uuid": "d354df0a-de31-4287-bc4a-53a1240d87bf", "comment": "Malware payload (Sazoora)", "value": "baca307df230c37cdbe0395c7e715f14d6efe4746decddbcfd1541c31a71077d77490ffd0544e43988ca250d2e3ab3ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false }, { "name": "Windows-Update-Assistant", "colour": "#F0501A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065882, "uuid": "c28ca084-bb1a-47e8-82cc-39aae737f134", "value": "T17D183376AA25027ACE854F7452B047710AFFBF716F7590BF99A0701E9E334879A30D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065882, "uuid": "de539c32-99f3-4d27-9f0a-c5f9fd560ee1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065882, "uuid": "ca49fada-271a-44af-89a1-3773272d7f74", "value": "1572864:0rziNx5qlpvenpSeA5MR8TIHzFV7w2rOs5FkDgRPn7:fx5qlEpHdTzbhis5357", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785065882, "uuid": "8488cab5-45f0-434c-bab1-fceadfa6251b", "value": 85019037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785065882, "uuid": "a6c94d00-5284-4d7b-8fbf-298b433b4e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785065882, "uuid": "36ac0566-5e5b-4df0-84f1-80ffc953e15a", "value": "Windows_Update_Assistant (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b807556a-88ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785069859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "a04150b2-6f1f-4ae3-a8d9-f4bf2e7ac794", "comment": "Malware payload (Mirai)", "value": "29e58db226f5b906a2f52431f27ff764", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "79f8cc8a-29ee-4319-8bbd-7af4a02deff7", "comment": "Malware payload (Mirai)", "value": "faf9b993d87a98c90b6cd4cefcbd5b0687cbbb012dba6a244195ef3cdc02f2a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "9f60e57e-f167-43a8-b3ff-9e9facf2a574", "comment": "Malware payload (Mirai)", "value": "7990271ba7d1ba649f6ab411e65ce981c4a46c2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785069859, "uuid": "09302363-2836-4cec-9223-9eacfd3d00e2", "comment": "Malware payload (Mirai)", "value": "88a8a76b45b7aecee24e1c25d16dc9f248d2cde67dc6d679336266f85c6e8ca0dbe75874aca2d966bdc0ae131df08789", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069859, "uuid": "04907044-8c07-4dc7-b376-6d03ab55b643", "value": "T13A22C041BF3229D2D3A40DBA029859E6A462E31434E653AB89C01777AC7E17ECF1C85A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069859, "uuid": "d1ecc99f-9ba8-4b74-895d-24ad85b34945", "value": "192:X+EK8RSl8HfSBNlctdquLWztjtugYEyBZQJaeRB2thQJ7QfdPV1MoRhTpWOltZZ7:X+ji0AZLQTugY9ZQwes6ehV2ahTp/ftH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785069859, "uuid": "781e4e43-98b2-49ec-bbe9-85af86d0637b", "value": 10620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785069859, "uuid": "11579ec5-2f10-4c79-b11f-67d75ad250d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785069859, "uuid": "f08ca969-f778-4efb-b18f-72ef44a6c36b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea65062-88bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785048959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048959, "uuid": "6bc53582-9777-4b26-81c6-81022076f399", "comment": "Malware payload", "value": "f507338b960d43fd15de593e68c82a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048959, "uuid": "a02e431f-5d66-4449-89df-2e17e34b5012", "comment": "Malware payload", "value": "fb25285685fb7dfb3dba8e83ebafdc9faad15243d980aa4e99c807c4ffda6ff4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048959, "uuid": "c4f70a77-08d1-4f77-a653-a8c56f25fcbc", "comment": "Malware payload", "value": "575ffb4fff897be96ecd2febec7eca7495b918a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785048959, "uuid": "570d9d4d-4504-4825-9954-88be1bd87f4d", "comment": "Malware payload", "value": "a30a394375d74030f18043697e38dfa6bc413f5312eeb57d5c4bebcf00b4172537b2451faa0682eb22531d50dccd953f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048959, "uuid": "a0f89607-2625-425d-8d57-6e96876a76aa", "value": "T1EAE41B0AAF400EFBD82FCD3701A91B5235CC655732A93B357174DE14BA5EA0A89E3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048959, "uuid": "7358b03c-805f-42fe-96f7-90db225f8e56", "value": "6144:790MUZUhTkp1Go+L9+2moB4Q2EILqO099eg6tku6r+wZYtUF:7901qL9+2moq1xbg3u9wCtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785048959, "uuid": "e9c46df0-818c-4fa8-956d-99278230ac75", "value": 660616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785048959, "uuid": "94742a89-0864-4d88-a574-b1e265c8fa4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785048959, "uuid": "dac3142c-ac8b-449c-8721-8b712461338b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b121652-88ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785068468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068468, "uuid": "e8927d7b-5f73-40bf-bb6b-63e222173c60", "comment": "Malware payload (ConnectWise)", "value": "42b4b26e0594daf6706082ff8c4a78e7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068468, "uuid": "fe092ba2-e82a-4e83-a92a-274cf58595b8", "comment": "Malware payload (ConnectWise)", "value": "fc91e76ebf70cb6911d9c2e989907b2e7e5780232c97d595f48b31345399db11", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068468, "uuid": "aa86a5b4-d9a1-46a5-a01f-5d07276172bd", "comment": "Malware payload (ConnectWise)", "value": "01d1a76ead445b2cd6e4cb1eaea4e772efacc08e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785068468, "uuid": "bb47b3e5-375d-427d-9556-51d8f95620ae", "comment": "Malware payload (ConnectWise)", "value": "1cc3d07bff23b888517cea258a6c85b985d8e6c1a15a2368d81d7de2ce9059aaf62589b0236364e2677c370b57931146", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068468, "uuid": "808e2c11-f06b-4c0a-8fb2-9ba958aa7056", "value": "T17A46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068468, "uuid": "5cff4d3a-9091-4ce6-be23-a7b7fb9b6757", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068468, "uuid": "20e78c22-1f50-401e-8d9c-6d0ba0c434e0", "value": "98304:azIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ahfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785068468, "uuid": "7a24a0d9-85fe-4294-ba0c-dbea7d659f1c", "value": 5641512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785068468, "uuid": "7c7c8018-0fee-4d00-b610-33401503d68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785068468, "uuid": "91917130-f538-4a3d-9001-fb314b48c99a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192f0803-88e0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785063150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063150, "uuid": "6845cf0f-95de-44b4-93c4-d2ab38651dab", "comment": "Malware payload (Efimer)", "value": "f05dc2cdcc68a1a80cea2236bef76642", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063150, "uuid": "53034865-49b9-47ae-b27c-ab0e1cb087d2", "comment": "Malware payload (Efimer)", "value": "fd52d0fa4d52fe38a1d9c64bd90815711e3e51b6e155bc9d32f4387c8e43cc0d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063150, "uuid": "0128d58b-1850-41c9-8c13-059f07a1c356", "comment": "Malware payload (Efimer)", "value": "3503c9af8fa80df84fb7c793d7afa020ea20790f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063150, "uuid": "56e604ac-c943-410e-8346-94cd9eb283c7", "comment": "Malware payload (Efimer)", "value": "2b556ecd4e862b518200f3d172ec70928a938b16787669de39e9bb233aa616d7c093808c23e6814e80456ceaf4bd3aba", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063150, "uuid": "c4d81167-4b25-4a39-8d4a-2880495edf1b", "value": "T1E5E63308FAE011E9EA739038AED161C6D5B5B875ABB1D1DB533897E39E132D0C43DA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063150, "uuid": "9c214a94-06f2-46b4-9b4e-4e086ab7beaa", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063150, "uuid": "b77fb8c4-20d4-4d2e-a2c4-91fbc938cfbf", "value": "393216:OZ4dOZ+OsUz8rllzXMCHWUjX9cuI3/PGTAI:OgHsArlhXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063150, "uuid": "032ff7a3-e489-4b63-9d34-51bf61603419", "value": 14280312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063150, "uuid": "2f73803a-ef09-4908-aa48-c0c633211419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063150, "uuid": "c8517794-774d-4884-a674-ec458ce2bd93", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80114dd9-88e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785064611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064611, "uuid": "75463532-129d-4ef3-a538-24c7a49e73dd", "comment": "Malware payload (ValleyRAT)", "value": "5c98181ae3e4caf379f656b4dc29d5e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064611, "uuid": "58233628-a214-4a6d-97d6-3361b543c08f", "comment": "Malware payload (ValleyRAT)", "value": "fd7eabbbd882d35397a594a781602d982bf8b49acfa63d97c9de16b319b63d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064611, "uuid": "71ed6c6d-667c-478a-ac4c-a5d75a4985bf", "comment": "Malware payload (ValleyRAT)", "value": "65ff72b5820357350e94441d5a73cb9f2bd16717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785064611, "uuid": "5605fff0-429d-4bb0-ba8b-c22bc5decd1b", "comment": "Malware payload (ValleyRAT)", "value": "ec7cf4957e331c5b0ae35adfd809e379b172014333ca11327972f1819c874925b654d61fd0e2ed038033b8ad7154f1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064611, "uuid": "b03239b7-f33e-457b-af3b-51106b61c99e", "value": "T11A26BF4A63E900D5D5A2D079C607891BE7F1B8100B32D79F43A5876EEF732A24E7E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064611, "uuid": "1dc62b1c-99ef-4604-91ac-a69475671831", "value": "600a46901805697137d747df5f4816e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064611, "uuid": "9d3af73a-cad4-482e-839e-b1794fbcdb26", "value": "98304:j9gqCy8ohb6xZfFGm94cVHEj6tj1U+kRAfqoB6rBb8elaZLGJPjrR3mLt/NAvad:jS/oybGm94cVHEj6tj1U+kRAfqovegyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785064611, "uuid": "b09ac8a3-c6b2-4e81-984b-4c0fca6be534", "value": 4665186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785064611, "uuid": "88adb4a0-0674-4f0f-acf9-9d69196fbd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785064611, "uuid": "fbc3a0fc-778f-47e0-af57-178ae19b5766", "value": "\u77ed\u4fe1\u5ba2\u6237\u7aef2.0\u7248\uff01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae682be-890a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785081165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081165, "uuid": "ffc57f4f-070f-499a-8f4b-0694cda74bf4", "comment": "Malware payload (Mirai)", "value": "69109da86a28775c01686fae376fdbd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081165, "uuid": "485f5141-c634-4d0d-9aca-fbb46cf54314", "comment": "Malware payload (Mirai)", "value": "ff8cc49de161af0f3742133eb00b0c79d9cfe7d2032c33e12ab973a22d49a910", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081165, "uuid": "b167a98b-fab9-40b7-ac42-437bce631c88", "comment": "Malware payload (Mirai)", "value": "a76e88db37e2fca93286c394c284787851fee075", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785081165, "uuid": "6bf309fa-fb2b-41b0-8e08-808f45b78b2b", "comment": "Malware payload (Mirai)", "value": "b3bb45bbce95303caa8e9c4fd4c3b065cd1db30a6a0c0372eb25dfbde8c0aeca976a6014aff86598417627a5e421aece", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081165, "uuid": "3f899bc3-b904-428b-9ad7-37592d6c7350", "value": "T198F37CC9B1087D2FD5933F3EC50D1617A90CCF67A8838A1280AAF9875BB35971F3654A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081165, "uuid": "c7539090-518b-4e87-97ad-4c9c74e7e14c", "value": "3072:xw6TUcUINFTv9GcvIkotddYoeL1TFv8ro3DvXn+vavvdoeolb:e6TLU4Fr9vQddYHL1TV2uvX+Zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785081165, "uuid": "783683e4-6aa9-4756-83f0-00cda6ee75ec", "value": 166740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785081165, "uuid": "54dc1951-b5d3-453d-9bae-b9a1ef30628f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785081165, "uuid": "88e010ed-0648-449e-ab95-553262706888", "value": "flutter.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22929366-88e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785063595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063595, "uuid": "2479cefc-1df3-406e-80e3-91687ce22195", "comment": "Malware payload", "value": "eb139067acb6ab0a84318bc52df76809", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063595, "uuid": "8bd27ddf-6f51-47ec-969e-659a7a2855ce", "comment": "Malware payload", "value": "ff9a07563fbbade90540e668443bb57453e696d832067f12185ad031a52d31e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063595, "uuid": "3cf2c35b-7d84-495f-995b-ab921f9e434f", "comment": "Malware payload", "value": "9e1aeddf29a7c1a975dad8409d80b889a41ad059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785063595, "uuid": "cc7a39e5-9530-4595-bd08-fec169ebf57b", "comment": "Malware payload", "value": "ea3046aa122d6c28bd781e21e3ae7230cfd43a32894ef607e65602d72030fa7f60d167cee427b2942ff6a6e463f7beab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063595, "uuid": "7055bc60-d215-418e-bff2-e588c55a7ee5", "value": "T18A560897B8D24992C4E43637B8BE80C433635EFA9B9652566D05FE383EBE1D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063595, "uuid": "f4f087e4-3816-4ad6-9666-a19a0d1ad45e", "value": "49152:QWIQsBczTcziEjKszzCv2eq1UjMDmfaak0kOqROug5Ef:VIOkew7/9/0kOqCEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785063595, "uuid": "9a95b293-b195-4648-8080-4d1f241d12c6", "value": 6226068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785063595, "uuid": "7f412e8d-2d35-4295-b91e-f612a57ab6da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785063595, "uuid": "af80fb7d-7290-4bc1-986e-6c7fef5e80ec", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }