{ "Event": { "published": true, "date": "2025-07-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-07-14", "timestamp": 1752537782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "782b3282-0115-4f74-ac2e-caf097bd13dc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431275de-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492335, "uuid": "6e23795f-3ac5-4a32-b02e-14718e965dff", "comment": "Malware payload (Mirai)", "value": "e08c721bae2370a4f4ef0cc5fb5f16ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492335, "uuid": "14d7f329-109e-419f-ad25-bbeed34e84d4", "comment": "Malware payload (Mirai)", "value": "001cc4477b7d6f1b8f6ec3ed0ff078aff32f1049643a774496a0f14147595905", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492335, "uuid": "2ada5960-bf19-4cca-86b8-4e0e9d542b77", "comment": "Malware payload (Mirai)", "value": "42fbaaba7e5bfd40151ab1539b09c872954bc9c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492335, "uuid": "69a7b9f6-f091-4085-ac64-7269abc86671", "comment": "Malware payload (Mirai)", "value": "3890afbd2b115c5ccff717308941dab4156459166ff8be45929219954e7d4eaff3839391a5be6fd913839bc06be755ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492335, "uuid": "36ce24c9-d318-416e-921b-a53a14057779", "value": "T1AF93D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492335, "uuid": "61120fb7-2846-4be6-b134-9b768f2b0833", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqshK:NFjXYyCEx0VhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492335, "uuid": "8a69c758-f0c1-48e0-a244-9c0db9f19d01", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492335, "uuid": "9f7bc7a3-3d80-4b5b-81ba-fbeaebe5e21c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492335, "uuid": "577126ff-d9ef-4b7a-82d4-3167438c91b9", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2134750-60ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496468, "uuid": "b9d9cbc7-9433-42b4-83a7-1c5e9605342c", "comment": "Malware payload (Mirai)", "value": "3050f2c86bb3834bb3f7d07bb2100299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496468, "uuid": "a5cf9a72-7fd3-4de0-a2b8-a3552e105e92", "comment": "Malware payload (Mirai)", "value": "006a4aa7cff6188a9909a4f920edda3f250e12889a23da4fa962f45c8b2eeb89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496468, "uuid": "463630b5-26fe-40b2-bebe-49916e2a806c", "comment": "Malware payload (Mirai)", "value": "4e919751a25d6256e383d77fb6600cf371f092f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496468, "uuid": "027dc1aa-747d-4803-80b2-559b4ced9ca2", "comment": "Malware payload (Mirai)", "value": "7f76b60537f67efd19c98b19569649e71b874d775a2c5c5e58d1b901ce46821b42e11236eb08e64959330a2006f2efeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496468, "uuid": "f154171d-a5cd-46b7-96ef-14379504ba72", "value": "T1238464379A254DA7E4158CB3126732425C4E87BB84EA2BE3FA668954FF2580F41F7DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496468, "uuid": "098bc0f7-0f3b-475c-92c7-4e974a7498fd", "value": "6144:HkYCK4/jZ2wjoWO1Omk/mrjhTJfjUHcMNb:fCXZ2wjVO+/mrjhTJfjUHcMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496468, "uuid": "6ac541c6-7dc2-4b59-baf6-40f7ae57c7d4", "value": 390453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496468, "uuid": "7cbf603e-39aa-4852-97aa-bcf808b637c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496468, "uuid": "583ca7f8-9807-4636-b992-b02277c10752", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f296ab0e-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504656, "uuid": "5f01f9ba-f75c-4465-b89b-fe0eb16e6c5a", "comment": "Malware payload (Mirai)", "value": "14544c0f630615e2d394d26298be8715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504656, "uuid": "f91e4ea6-16e5-4061-9cc6-2446d92f9ebf", "comment": "Malware payload (Mirai)", "value": "00a397bd45acda041dbc80fd13dd921bc79a6915c16e668f4856a93393fb63c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504656, "uuid": "03068241-ea6d-4ba8-a826-550eab31ed0f", "comment": "Malware payload (Mirai)", "value": "99af03b4aacf22b4ca27dfe33321fcc9f8e231ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504656, "uuid": "5db64a91-cf21-40ff-833f-4161679bac96", "comment": "Malware payload (Mirai)", "value": "da3e7066955e50eaf05d08e366357caa294d55b5cb081f5bb2001775708a01b64e9fcdae5a320f7799d5729a300876bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504656, "uuid": "1303a36c-a58e-4938-88cc-f5cdcbe838ed", "value": "T1E7D2E1BC670249D7CAAEA0B84DD10B262D60CFE2E1426C07B658D9D7BB0586D3CB5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504656, "uuid": "21d7fe16-7226-41c7-88ab-7ea2487ba168", "value": "768:94ylAtv6pqLJM0RXaxGyUbXtheU/SK92JgGlzDpbuR1Jw:GMBqTRXa+Zhr/6VJuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504656, "uuid": "d349d170-6941-418f-99d1-5a67e3ecb476", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504656, "uuid": "950efb1d-475f-410f-a600-577e24d9541c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504656, "uuid": "7e91c140-d81f-47a5-9b96-54c89fd65449", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e957d0-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494780, "uuid": "f9587847-fc01-4c05-a2e8-2926f9bcdb80", "comment": "Malware payload", "value": "1705d793062680642be139b1424ff178", "object_relation": "md5", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494780, "uuid": "cd3e0e8c-6149-4185-85bf-e177d590c030", "comment": "Malware payload", "value": "01a68d749e7b900aa41fc7ab6fc96891fb10a95980c043a26bf19128b906e324", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494780, "uuid": "09e763cf-c51e-4506-84ba-702256dc3f88", "comment": "Malware payload", "value": "1d9d6cd9af2d9e22cb6b381a8d849ed25f8ddd9b", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494780, "uuid": "d3273b8f-faed-4f0c-996a-6506c20d3a58", "comment": "Malware payload", "value": "7f556784c05e04bc07ac17d7ce48bedd9d1281bd3e1a445e81f3464118aabe5e4ba601afb70aaa2917de6645369ad854", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494780, "uuid": "600daace-7fca-494b-abbd-210913745d99", "value": "T1DE513C196EDFE46BF64957B43310A72DC81A6180430EF6A232C24AACF4374B84B431DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494780, "uuid": "6850d2c8-0d62-4960-abee-0f8e8943217c", "value": "48:9atmMQfpVTijQ5iwWeGBy/6z7l7fictA4Ws35PWg8/7zHLzwG7dB2xg/e:Y3aiTeGUSXlecWNsdWg8/PzhB2xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494780, "uuid": "1b2be0ff-d76e-4fe4-821a-0c9c955d4db8", "value": 2789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494780, "uuid": "9c1157f5-01a4-43d3-accf-f1096832654b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494780, "uuid": "82b2ab69-cb9e-4be1-bafe-8890d15844b2", "value": "ZEUthe4uxV2Ix61ObNBJm.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804224a7-609f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752489861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489861, "uuid": "e38885ce-7397-4433-bb0d-65e8858c5503", "comment": "Malware payload", "value": "6d793a171d5bb6454ba7cd1c4b23646c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489861, "uuid": "5169a1c2-90ae-4b7f-83cf-0a0f2edebf23", "comment": "Malware payload", "value": "0206c75862da59a8153fcc7c14a5a0b7bd817f6e612aeb1cc94fef5e09455cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489861, "uuid": "da8d9b63-8344-4a3e-85eb-419c38c79c27", "comment": "Malware payload", "value": "7130ee631be3d8a3594293201a01328fe11d84fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489861, "uuid": "b583fc67-e9af-42e0-bae8-6f6f81598d45", "comment": "Malware payload", "value": "5e034535f6f6c17f14de2072e17027cbcfb9211dfd0f74e5f9b804e83c5e552d65aa24c44bde2830a31f66005ee32d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489861, "uuid": "bb9c9f7a-c5ef-4c0a-861f-cb5fb5d4f35d", "value": "T108B6AE02F9A09135F4A73272B83CA73D5D367EA39B3486CB86403C986FB46D2553935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489861, "uuid": "305b1632-2569-4418-90b4-a6eab3b3b1c4", "value": "2ce9718e3984c38ac95e943acdeabe9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489861, "uuid": "4d797b6e-c017-4510-9cdf-8120e3dbced4", "value": "196608:1iENKhpjM+VjAOAoeZ1GbNdpF7B3eNzFf4KpGMG/9vR6POA93K8nICYHwrFIvTg8:1iENKhpt6OneZ1GbNdpVB3eNzFf4KpGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752489861, "uuid": "d2ab00f2-4f32-4f2c-950a-230c142f4646", "value": 11324152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752489861, "uuid": "5eabd9e5-d7b7-40be-9860-24a06fd25e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489861, "uuid": "4e315559-a680-477a-a7f5-dbc281a9179c", "value": "UpdaterSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82961fd8-6076-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752472256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472256, "uuid": "17ed2215-42b6-45eb-bb76-ca5171ca551b", "comment": "Malware payload", "value": "c3971b5e1b48fe6353a6c29a9af6e3bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472256, "uuid": "505a2aca-92fa-49db-93c5-b4d1be4557fd", "comment": "Malware payload", "value": "02578ffff95ada469004cdd7b646230b47a04a8e52a23cce61a6134987472ec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472256, "uuid": "46166cd2-9bb5-4e91-b2fa-97cb53172766", "comment": "Malware payload", "value": "b21a5637523d88c9b572a2b860382bedf7fb2079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472256, "uuid": "467c5a08-fa70-4122-a3e1-0a0ca287ebbd", "comment": "Malware payload", "value": "1d4d885be35038f273c4e9d5711dd9983ff02f9d2d2a9d290b35c2fe5ff286c1d547cb4c515aa861285a8e46f61752e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472256, "uuid": "72f3422b-a36f-493c-972a-f3dcedfe13c5", "value": "T14EB41228EE4E38D1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472256, "uuid": "fe4fd0d7-2829-4f59-a420-c1e8136c9e0a", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472256, "uuid": "6da20cca-9b25-4027-a3ae-c41c8ed2e249", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472256, "uuid": "7a1ba443-7f14-4984-8d67-031684d6d9d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472256, "uuid": "d591dc51-8ba2-46ab-9b48-5b1ab2f46332", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0342af72-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536467, "uuid": "9c815595-c67b-4371-8e06-348ae0593f37", "comment": "Malware payload (Mirai)", "value": "884e23909f25a146248134b103d2d4b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536467, "uuid": "2fc9dcc2-f4d2-43ad-aede-609f924eeabe", "comment": "Malware payload (Mirai)", "value": "02e217b8bc2b7eb4fef7137e3a6a924bf9a599b010bc256610699c1ccbe79def", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536467, "uuid": "5f45ef6e-9379-4a6b-ae69-dd26bb42c291", "comment": "Malware payload (Mirai)", "value": "c427ea9d77385ac67b5ca5b66624445e9e181ba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536467, "uuid": "32d6b99b-ba6b-4b2a-a525-9594b10d7201", "comment": "Malware payload (Mirai)", "value": "c80fe49ea13ab941820779f2805117fdaa90bfcc2f4ad98ee5ae06fa0dbec2805c6dc1883bebec0382242ff5bec1baea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536467, "uuid": "939b7813-8007-4d4a-921c-042e6bfbd1ba", "value": "T15204EA09AF510FFBDCABDD3342E90B0139CCA55722A53B763674D528F94A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536467, "uuid": "05b0f17c-5147-4f7b-a026-75140ad58e65", "value": "3072:nu+pqtUWK4pxHFfagV3K3pHrXqvZFy8z+4QwvMGwhz/:nu7tUkpxHF23pD6FtzUw1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536467, "uuid": "a2e72da6-59a0-4b16-b3a9-6c8dc657a2d6", "value": 182092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536467, "uuid": "fc73493d-9cc1-4f3f-af44-5b3bd9fb218b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536467, "uuid": "c991d79f-f7d2-4459-9a17-1ec10539d879", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72fb67f-6087-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752479726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479726, "uuid": "705316d6-2e3e-4eed-a60a-107fe4811057", "comment": "Malware payload", "value": "313cfdf0da85328552a024ea2920404a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479726, "uuid": "026f67ad-d1da-4247-ab9a-5a4ab0968a9b", "comment": "Malware payload", "value": "031fb487b55e8c29e540e9884b067191043dc08c26363e6edfb38d21923b3179", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479726, "uuid": "4bd4be00-1851-41fc-8d15-5a915429572f", "comment": "Malware payload", "value": "4484c9700114b4ff48e5f1dedd271253cdace22e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479726, "uuid": "5ae1e439-de73-48b5-810b-9c919203144b", "comment": "Malware payload", "value": "b7f844355c4bcc540cfc44dbff5a1b563cfd9e2dbe8afb960e904b19ba80bab1322a878ea33cfa73f6208c57d8172a7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479726, "uuid": "e0a95600-7430-4485-b14e-94a873857d83", "value": "T1A4D17540A62E835570E2C6517B0A8CF006B0574779ECB9CB1EDD7446AF8576D32FB8B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479726, "uuid": "a57d0410-a7a5-469a-9161-ecba079d64d7", "value": "192:qMTiX7VdniSL8kGOO7240wJYNqoXYX8tXURXabua1DiJd53c6iU3YfTS:qMTiX7VdniSL8kGOkE+Xa149Yml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479726, "uuid": "39c6d1d9-d2cd-47ff-8825-38667dbb631a", "value": 6684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479726, "uuid": "ce872279-34a3-469c-b526-e97108c9b060", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479726, "uuid": "01280edf-9976-40e9-b679-aba1fd63cf8c", "value": "Dokument22150.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253fdaba-60f4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752526216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526216, "uuid": "20c65989-595f-428a-9c78-501d1ee8eef0", "comment": "Malware payload", "value": "33ffa82684cae0771b53586dd615a121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526216, "uuid": "51ab54aa-0d69-4452-97bf-f28c8b87747d", "comment": "Malware payload", "value": "034376b7cdb06a63b0232f54fb906b95f37fc7f4921e9c6999c37f4aad9d61ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526216, "uuid": "8eaa5db1-c319-4102-9f5e-29007ce64307", "comment": "Malware payload", "value": "e2aec86a4e5750c4363dd9c9ea563205ffe28bd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526216, "uuid": "437807f6-4e0e-4470-a8d5-7abd31ab491c", "comment": "Malware payload", "value": "722fdb67b04b43e67289925c8b69cf7634086cf1b3474561bea8f555f420a6e012037a8f063cb54bedb005f0277c339e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526216, "uuid": "e462f1c3-36e3-475d-a819-8368974e80e9", "value": "T149F402002239DF12C5BD0BF61A06D1B023FA0D9FA121E3579FEAACEF79A8B450551B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526216, "uuid": "1b907190-6b64-47eb-9a62-7506ed014cfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526216, "uuid": "4ac150fb-0b23-471f-b32d-e2575d7a1ccb", "value": "12288:LfrNKK/3plPMTugLelVL+A17qw3YtLsGgAmxSMD0ISDK6kvKPoIyePP:TrNKu5lPuutlVL+O7uLsGh5MwISz/PcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752526216, "uuid": "52898c73-33fd-4c94-8c5e-9acdacca0b41", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752526216, "uuid": "9013db08-6496-4846-a4f4-9cdd647cd667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526216, "uuid": "058b6b45-c83e-45e0-87d8-04b5c4c25d33", "value": "USD $298,004.pdf____________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb225f3-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485104, "uuid": "d9e1bc24-c82d-4a58-a80f-a0708f278f9c", "comment": "Malware payload (Mirai)", "value": "3f509221733369d2a0d2dc20d61154d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485104, "uuid": "43c52f49-b682-4009-a6ca-bd8adbf2024b", "comment": "Malware payload (Mirai)", "value": "03b2ec2e231ffcd0f26caaad7112641b97ed46155094f387191d63477ede16c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485104, "uuid": "0f849c63-a0c0-4050-aae0-13a1e9aed5d4", "comment": "Malware payload (Mirai)", "value": "eb9df7e7a45b93251234fff09b56c2ab5300af94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485104, "uuid": "e4041e0d-9eda-414b-8852-97bea4d83e8c", "comment": "Malware payload (Mirai)", "value": "f5f7142ef4273ee43b8b3994fa0d350930ae33ad3f322e15d95baf6108004d0c7894618431405b35edce5cbfa1969a44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485104, "uuid": "59ffe759-37b0-4c3d-88ad-3c8039d417df", "value": "T1D6230271490A9EB124703C76EA95D793B6E125B1C6673023D62C0A3C2FB57131E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485104, "uuid": "935e8278-8239-4780-ac7f-6121c6390ec9", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b379q3UELbUXfi6nVMQHI4vcGpvn:gECFd+A6YHAxaLRQZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485104, "uuid": "04772f0e-aa7c-4509-8787-267d760898cf", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485104, "uuid": "fe4c1e00-ab9a-440f-8cdd-a4acfb51f228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485104, "uuid": "45a68dd8-1159-46c6-91c1-ffd5fb23c54c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a1313b-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503933, "uuid": "03524dd1-0156-4e10-b5f1-95177c0ab4d4", "comment": "Malware payload", "value": "27993199070a617600c42d665e9ea5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503933, "uuid": "4876daf3-28f3-400c-906e-8228900a0c26", "comment": "Malware payload", "value": "0420b3665975705ca100c974b39c6ea93187ef5796608b9b3d01054ab67a529e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503933, "uuid": "1f95b7a5-86c7-4d39-9276-dfb88d45a50f", "comment": "Malware payload", "value": "350cee825f3bc7d005a006b4d7c4cdf48533148a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503933, "uuid": "9a0d57e9-be5c-4eb8-a0de-3887a5b44eae", "comment": "Malware payload", "value": "e151ace020605652b806addc8b21be6bc4b259ae88cfc3de1680a67eadfbb5a4d505d99b5eee032499f4cb4c9b7e4eb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503933, "uuid": "d5eb1d68-a46c-4853-be4d-b4e66efb26a4", "value": "T10E234B41B30C0D47D1776EF03A3B27E1E39FEA8121E4FA84691FAB859172E315586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503933, "uuid": "ecd57e87-45bf-4889-b745-6c273e35331c", "value": "768:f91hcVbI5IVQF+jtZxUlRvWt3Lfk2jR8iIWOqgIX:11hukojLxUls3Lfk2j6+gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503933, "uuid": "02e959dd-6e90-44da-b628-6a742cdc1997", "value": 46328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503933, "uuid": "90e16973-276e-4e87-b8e7-27ac7e0882c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503933, "uuid": "eb119de0-3d6d-4b43-8543-284488056ae5", "value": "proxy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ac0310-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752537256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537256, "uuid": "f24603de-d0e8-4565-b2a7-bbeedfefa0fa", "comment": "Malware payload (Mirai)", "value": "de5f4dcb5858e215c89d834d810aeb8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537256, "uuid": "4561b3a5-3ca1-41e4-bebe-2c635c13ee58", "comment": "Malware payload (Mirai)", "value": "043c0dff9090640b4f2490842633b44c13644f3b1282c48a1e8076fa8809bcc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537256, "uuid": "ef2f13e6-ab9c-496c-b486-c44a93891cdc", "comment": "Malware payload (Mirai)", "value": "c66721d3613b75e55415df15ddf2bde5107f08f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537256, "uuid": "dadc663f-9ec8-4aec-8d91-fcaef909fffb", "comment": "Malware payload (Mirai)", "value": "c1225a9a8cfa2e9ab49dd1a067a8cff1981f3f9acace16e31358fe63933f424dfa3477e09b9ede57fbd7e815683a1012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537256, "uuid": "07137f5b-177a-48f7-a91d-32661a336d0c", "value": "T12893A74E6E219FBDF268C33147B78E31979C37D626E1C685E26CD2101E6024E585FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537256, "uuid": "e61e69be-4efc-4b3c-8309-994a9655cb5a", "value": "1536:E+jpjDA3VmVwTlVqqVqWuq9o+RbUIXMAlUGo/yeVDSMjJu5:TjpEVmeTpFUIxUGo/Fjc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537256, "uuid": "7e80f19d-aa8b-4f7e-ad66-4cd4d3d5e65d", "value": 97336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537256, "uuid": "8b1c59b7-7e93-4c42-8853-c9f56b2f64ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537256, "uuid": "944e8509-f4f4-4f09-89e4-6e7fd3bd2f01", "value": "lmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dfed47-60ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752496256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496256, "uuid": "48639269-c3de-48a5-a44b-ff15adffa4b8", "comment": "Malware payload (Gafgyt)", "value": "ddd4d08ad9f0525f9d61dc28985c2334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496256, "uuid": "20ebef4d-4fd1-4f17-8105-94de9e635b09", "comment": "Malware payload (Gafgyt)", "value": "04e4727b0fe9af4c94417df2482a6463f2d80dcc6c116cf055c5f29d692d401a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496256, "uuid": "44b65bc9-6a77-4763-9279-eb8b7b26bfbe", "comment": "Malware payload (Gafgyt)", "value": "d4e5bdefd1dd2b6d82551fbb44fb04ddca5943b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496256, "uuid": "4c6483b1-578a-409c-94aa-a5d72ec1ed8f", "comment": "Malware payload (Gafgyt)", "value": "a417b020ee8ed3d0d0afb22f7191a776d118d535b6c940499a19039a1815235f7808b77c2f454bbb3e9e21bfb919a246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496256, "uuid": "cd2aec85-764f-4d5c-8832-891b29ec9815", "value": "T12274A623D8154595D1614CF322273389AD0B87BF89E732D3EE2A59A0BF6051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496256, "uuid": "fa0b1c5b-d02a-47a9-a9f0-a1ff43da6aa0", "value": "3072:sbgQxdnFjImmejjPKwjoCU+ObmAUmE/9aQaSXRigRNb:mrIm93iwjoz+OemE/9aQaSXRigRNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496256, "uuid": "367eca88-1a61-43ec-8275-77a0c88be9a4", "value": 352457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496256, "uuid": "90aeb24d-11a1-4a15-a728-90f8f055ec6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496256, "uuid": "423bcc4a-13b6-4be0-903f-2789e73ad053", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3479a062-60e7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (jRAT)", "timestamp": 1752520658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520658, "uuid": "885b1dc0-620e-486f-ac02-2c7be308bfe7", "comment": "Malware payload (jRAT)", "value": "6d5a25da18a5ecf4b1c45e912c2ddd33", "object_relation": "md5", "Tag": [ { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520658, "uuid": "7f0476d0-da5e-4e40-9046-2c4918732956", "comment": "Malware payload (jRAT)", "value": "0512e7dafcf263c34aadf3329c66e2340d1efa4ee494cdcc7893d0e0ff2cdf86", "object_relation": "sha256", "Tag": [ { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520658, "uuid": "a1d49afc-238c-481d-b591-b76f5bd50c76", "comment": "Malware payload (jRAT)", "value": "d432c69278bd010afb2fbf5e34b17e35e59c0826", "object_relation": "sha1", "Tag": [ { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520658, "uuid": "847126e4-602e-4e72-b926-0a4d817fa3bd", "comment": "Malware payload (jRAT)", "value": "519d81be6c9522c71c172c875c6966303587d792a82991fe2efedf116c4237e476e965d5943e832eea7b40ce74b07524", "object_relation": "sha3-384", "Tag": [ { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520658, "uuid": "ad595ff3-5b4f-4a2c-8597-d35436388d8d", "value": "T1769733EDD2316D5EF631B07E1D90AE08E8ED48AB8D35684BA41717771864A8C7BCF01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520658, "uuid": "299dd6d5-db58-47be-8e9d-cbc9975dc305", "value": "786432:jPtzehKNmQVZFVWlIZ6HmjscZfQrhiV8C736Tnysm1R8ayd3Bk9AOko2MgWx3rw:xwKHVZhfXZ4rh1C7QnQzyRBGXkTMns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752520658, "uuid": "129f4509-bd40-4e65-b0af-e6047d652029", "value": 41311323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752520658, "uuid": "43a5dd00-740b-44e5-bf77-87f9765ffe10", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520658, "uuid": "6b2b5d52-ea95-4fa6-bf1c-98305aa426b6", "value": "AccessPlex-1.2.0-x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923d479c-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494186, "uuid": "d8005489-0935-4603-ba03-b7c2acc281ca", "comment": "Malware payload (Mirai)", "value": "0e2164b900191fa262b035f5d4dbde78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494186, "uuid": "9c986085-23fd-4f0c-ba81-5d540d1398c9", "comment": "Malware payload (Mirai)", "value": "0515af001cfbc5f9643a35c2f4a87e7ffc5b966a49bf54e078ee5cb00792b285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494186, "uuid": "baa29e23-15c6-41c2-b3c7-8e729145e28d", "comment": "Malware payload (Mirai)", "value": "7ad4cc5228af590c8388c055346b8e5ec6871580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494186, "uuid": "9088f2c0-b87d-4cd5-9c29-507e4cfc98d8", "comment": "Malware payload (Mirai)", "value": "f4216fb792fd4396bcfbec32e23a5942db09ebf3b39160b336bad6bf51c8b34958f5594c94836f477f2117608835fba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494186, "uuid": "de5a1f1c-5af4-459c-97a4-070b6689c0bc", "value": "T12B64A733C82589A5E0108CB2226736419D4787BF88EB26D3ED6A59A0FF3545F51BFEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494186, "uuid": "d37b54ac-0c37-405a-a2cc-0f701f94a883", "value": "6144:Yec7yz4fSjMYxzwjokerymaXtsrHqaK1N/:Yef4M/Jwj1SymaXtsrHqaK1N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494186, "uuid": "f697dc66-887d-4b80-925f-b3adc6971f38", "value": 336726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494186, "uuid": "77a16d2e-c26f-444c-8594-219d854a8f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494186, "uuid": "f1b47745-96c6-4e6a-9ef1-747ac115912d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4aa5669-6071-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752470273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470273, "uuid": "e2fecf96-e4e3-4438-b5ca-228319199ee3", "comment": "Malware payload", "value": "8093aa259997041a0149449d3507d22d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470273, "uuid": "55580984-95cb-4c98-8a1e-ceec76c38a2a", "comment": "Malware payload", "value": "05c83ddb2852c1fe3ab48f72ec00e70af72e5c76dc74f0908d042f608e580fc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470273, "uuid": "d4c2abc2-8764-4f26-8e11-f9f6733e7d12", "comment": "Malware payload", "value": "f91cac6cc6b889df135f1ede87dc0c0633225cfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470273, "uuid": "f98120b8-69ce-49a5-8748-0b3e40b2fdae", "comment": "Malware payload", "value": "3ef0e57c1ac5b3743c77b1048149a76ef58de6cf0368c29087bcaaf698fb744a4590819189a09b2ce3b88a79e7e68924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470273, "uuid": "a7e354a8-679c-45eb-8b93-35be08af31c1", "value": "T1E6B402018F881F87C5AFCD750A2E167311AEDD9F46CAA53E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470273, "uuid": "2330916a-4d4d-4bf5-932c-58fcbaa6a73d", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470273, "uuid": "7efaf814-3530-4a35-bcfd-d9e876793def", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470273, "uuid": "6f5331a0-0cfb-41b2-801d-17a7c1a47bcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470273, "uuid": "08c0adc6-6f0f-4a4e-926d-92fef0e80d36", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84f4d85-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516584, "uuid": "77794e4d-f633-4529-a965-037b6b2d987e", "comment": "Malware payload", "value": "b2d8fefc8d247b8c3dac5698e54a5b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516584, "uuid": "0e056f13-c773-4dad-ad5c-fb63020bbf69", "comment": "Malware payload", "value": "05dd1db4b6409bb4c85ed24170423747d30796e42d0ccdc5bfce7ef486dc1d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516584, "uuid": "9d8a25a2-6412-4bd4-837b-7fa5aa690c59", "comment": "Malware payload", "value": "f56995abb7b932d3dcf857bb782a59c3340c0cda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516584, "uuid": "85866d2f-dbbd-45bd-90e6-269447c267bc", "comment": "Malware payload", "value": "866c6d643b4588611e28911757e8e6c439ab6f18607c22957b09c08f50869a8994e4dea880c5d20d707dee82d86768ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516584, "uuid": "69214f70-f827-4c4c-8c71-80bfcbcd306e", "value": "T15CC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516584, "uuid": "8d398c04-cae8-469d-ba47-e291e2c6e513", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7z1:W7v+mrY2xzf03yvZ/YIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516584, "uuid": "9e166f64-2c8c-4d49-b8db-7ef71525de1a", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516584, "uuid": "65cb3f3b-e5dd-4db0-b037-53c960371529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516584, "uuid": "2d4113a3-c446-49eb-b8a2-8b777333df2c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264a179a-6069-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752466517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466517, "uuid": "2ee8d652-045c-4820-af51-14c6f7172fb7", "comment": "Malware payload (ValleyRAT)", "value": "8987b44ddf533652db37dc9a9eea846c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466517, "uuid": "8775f4c9-2bbe-483d-ab69-192aab077f95", "comment": "Malware payload (ValleyRAT)", "value": "061588b2a2b1c2044fe99d99bac0529d99d708802ead6da37aae29b590921bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466517, "uuid": "e25fb728-421c-47a2-bc98-5477711626bd", "comment": "Malware payload (ValleyRAT)", "value": "50714337abdcefa1215f824ca77197e59e34057a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466517, "uuid": "3bea0d1e-31a1-4e33-9449-126abe2c27c1", "comment": "Malware payload (ValleyRAT)", "value": "79c34920278b2ca82364ddda645d359d5a71bfb12b95a4080bf2b2d29eae382776ee78df1a9e58aadeddddfb4dfe6dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466517, "uuid": "7c53157b-54e2-474b-9f2d-7336bfe730f1", "value": "T135B7332276D7D13FF16D4B3B02A2D564A8FBB631A513AD66EAF0808CCF175581D3E242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466517, "uuid": "61fa8931-e161-44d1-9341-7a89dee1277d", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466517, "uuid": "83137e28-0758-493e-b445-16f1907ed1d0", "value": "786432:Uds7mA9M2CKwzcN4BaDJMZfem/pOs528Qp1d3YYHavshx13+JPudSHwTbYDI3YB5:i8M2Qqkf/pcpD3Y3vsF3XSQYDIIB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752466517, "uuid": "2c1e7919-c5f8-4c01-932e-42482e010c0f", "value": 48059552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752466517, "uuid": "1bdf1fba-36fe-4634-9f6d-9641dea7753c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466517, "uuid": "4a807ab8-8f45-442f-80a7-6d96a1c8720b", "value": "8987b44ddf533652db37dc9a9eea846c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9c23b6-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494392, "uuid": "0ce5aaaf-ab3d-4bee-9eed-a9b68d7a1294", "comment": "Malware payload (Mirai)", "value": "f3b4545b8fe19f2f3eb5438a7f032351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494392, "uuid": "2e8a9c7e-397b-4642-968c-2d5049806bdf", "comment": "Malware payload (Mirai)", "value": "062f4c8cd05261b1e10a9b79c5a70eee7c5cde71f99ee9760a8490f7f347fc6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494392, "uuid": "f6f7bde5-57c6-4ba7-aac2-1927b28d99d1", "comment": "Malware payload (Mirai)", "value": "1deefd90c5c4f55bea6c8ef89fa8954be39de7d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494392, "uuid": "65c8a5e9-f846-4f2a-a696-6c144ef8537d", "comment": "Malware payload (Mirai)", "value": "881026908743dcd06c3d85211ccb5b928b1a8e5d54cee87b2b06d439b39adb9b31ba08492e19efb2ce2b0ea7e9873cee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494392, "uuid": "c5927c83-64b5-4005-a9f3-6b29870ef53d", "value": "T1A874A723C8154995D1614CF322673389AD0B87BF8AE732D3DE2A59A0BF6051F52BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494392, "uuid": "a7fea0d0-8ed0-4a53-9ba2-f8b85775507e", "value": "3072:Cygja8O5ZaIz88EOBD5Ol3cJKwjoCMYdzaqBIWkrCmIQQAzXETNu:UKaShEO6ccwjoIdzaEcCmIQQAzXETNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494392, "uuid": "d8ac40df-590e-49e1-aafd-fd21c3069d76", "value": 369904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494392, "uuid": "e0871aa1-1181-428d-9ca3-0712d175d00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494392, "uuid": "75bcb6f7-1fe9-4b11-9149-38208b22f9c3", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0abd1b-604c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (UmbralStealer)", "timestamp": 1752454177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454177, "uuid": "a7cfa73c-e31d-4877-be1a-036a790ab61b", "comment": "Malware payload (UmbralStealer)", "value": "2bcf7451657a8763e7db8f0107f4cfbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454177, "uuid": "c14f826f-f8a7-40a0-aab8-33c1f0bde61e", "comment": "Malware payload (UmbralStealer)", "value": "0678c22f530e429e94cf94137178fa9fd5f02b0df6cdf6b9606941e0bd2f2ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454177, "uuid": "f0e67df2-5184-488d-bfb0-e675b07dad1a", "comment": "Malware payload (UmbralStealer)", "value": "f94e1afcb138d519270ed0834dcb52b94a51b69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454177, "uuid": "5034bc86-242a-4fe6-92ff-8805a54ef21a", "comment": "Malware payload (UmbralStealer)", "value": "41fb5f9c25fee5a0816fbaef17cd677019d44d1c32bbbd62e324b10d66bd350e99bae7c1892ffe40d5f3eb1392795307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454177, "uuid": "f3592a41-5e3d-4045-9131-acf06a360e44", "value": "T1C0346D1437B88F12E25F9FBDD9B1549F8B71F103E90AF78E0C8895E82452B42EC49A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454177, "uuid": "83d13fbf-3d02-48f4-952a-f87391b93fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454177, "uuid": "84429d1a-80ae-42c6-bc1c-ab6e351eeeff", "value": "6144:VloZMzrIkd8g+EtXHkv/iD4IBhsbhS6FuAxDeeb9BFlH8e1mIi:3oZcL+EP8uhsbhS6FuAxDeebF9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752454177, "uuid": "baaf51c0-7a7d-4656-82ce-d29a72aa5523", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752454177, "uuid": "dcb8b374-29e7-4c03-9c36-66467b326961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454177, "uuid": "9b9dfebc-8be0-479d-9243-3fbe19ef638f", "value": "piterhook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d798ca9e-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752537252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537252, "uuid": "59a8fe3e-ca43-4ce7-891d-da643721ec14", "comment": "Malware payload", "value": "a7ce01ac40a27ce72a69e013d31a90bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537252, "uuid": "c0b0151f-f969-427e-aa1d-0e494c046bc7", "comment": "Malware payload", "value": "06b327f39d12949bd2c8f82760a7c1ff6cdea9c5effae8b624aa5023d25c898a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537252, "uuid": "0830090b-41bf-4cd6-9887-f7afe447a708", "comment": "Malware payload", "value": "bc85e13701f64e3d535ffabf1af044b28bb5b76e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537252, "uuid": "135079d4-88d2-46f2-97bd-9dd927f0620d", "comment": "Malware payload", "value": "b2adfae167592cad95c120c9d4e2245f27f59473e55fe7c1c1c97cba340ef92403bc0c7f45d5a5f0bcc59d3bc401264b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537252, "uuid": "fedc7b9a-e2d1-40a0-9578-444800eb2a2e", "value": "T1E4E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537252, "uuid": "46400e9c-ad45-43e5-91d7-1823637ea424", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537252, "uuid": "5513a88a-6eeb-43af-b70e-6359ad5f23e3", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537252, "uuid": "4c2adc6c-6f19-44f6-abc7-c54c295fa81b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537252, "uuid": "72a4e1d3-a6f7-45b9-824b-95d3036c1016", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64836630-6074-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752471346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471346, "uuid": "80ea6538-c4df-445b-bd05-f547385c60c8", "comment": "Malware payload (VIPKeylogger)", "value": "0ddbe840eff14b37eec72e7acde0b833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471346, "uuid": "79d1556f-00f3-4397-aac9-a63f37a81690", "comment": "Malware payload (VIPKeylogger)", "value": "06ede9a79380740bc6717b85c81962911c87ef299c0f9925e44cf66569784154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471346, "uuid": "0a2f677a-4f14-48fb-8f42-1432a557ab70", "comment": "Malware payload (VIPKeylogger)", "value": "387c6d2e6616c4b1572867a946007e80620a195c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471346, "uuid": "e92d5dcc-2ce8-4e22-8d8b-7e66d99d5b04", "comment": "Malware payload (VIPKeylogger)", "value": "e101eb4273008042fd6c8dc4b610c57802b38a957d66e5fb2d042da269057699287f6d812c98d9982a108eb48587fdcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471346, "uuid": "425136fc-77ef-4f3a-8a30-4755be8d4e6c", "value": "T11FF40105A136DE11C4A60BB46722CDB423BAAD8CB410E7075EE7BEDB3776B4018C1B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471346, "uuid": "97deedc8-e7cf-4d02-b8d2-2c18bc140160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471346, "uuid": "7cddb6f9-f597-44dd-8e19-622ab2614b63", "value": "12288:jR1/3plPNrmNRn845n7JDPQLxiGrWLu+ajPidRLrnsIq8rrMmjIqC9J0MZrnlai:1F5lPNu58g7J7QkGrm2j2RnTrI6IqCjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471346, "uuid": "bb834bd7-77aa-403f-a779-6f53b58c57fd", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471346, "uuid": "25a60bbb-a556-4db0-92b5-9efb5301ebfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471346, "uuid": "14aee5f5-0242-4c95-a9ec-d24d551546cf", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1660b5aa-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752495696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495696, "uuid": "d3891229-d863-4194-8bb0-9cb90200971c", "comment": "Malware payload", "value": "2dce809b8cfe515a6b5d9a0240546a2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495696, "uuid": "4627a743-038d-4d0f-b764-ece0d3de7acc", "comment": "Malware payload", "value": "0701d9cd675fde7903849da11a18e8f77d512ed45af9d9a1f55100aaf54b0b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495696, "uuid": "f9043da6-a533-4e98-b5f8-7fd52bc7b5a8", "comment": "Malware payload", "value": "5ab1e5a1f2856042fda90b260c5f34f61e8c429e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495696, "uuid": "8d5ac3a7-802e-4820-adc5-d7382af6db12", "comment": "Malware payload", "value": "8062d29663cb3926c8c8771b727ab1da888cf35cd3783690ebf9cb0b1d583ce8628f90fff1e6a48b9f3ec7d29e33142f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495696, "uuid": "86389095-b8da-4ced-a5e0-10999a700782", "value": "T119A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495696, "uuid": "d38951b1-e3f2-457a-b77d-e08607137dfc", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495696, "uuid": "9cf5bf9b-801b-450a-9e74-2c624f4b2757", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495696, "uuid": "12d65559-c36a-445c-bb40-eb79ea840174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495696, "uuid": "0db7c7b2-8c69-48e1-94a6-a977de9a7c65", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f8cda5-6049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752452798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452798, "uuid": "c39535a5-98c5-407a-bcc5-6771f60e34b9", "comment": "Malware payload (Mirai)", "value": "94e01f4f85bd781d3112abab1f22fa89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452798, "uuid": "c1222cfb-66fc-4b29-8b29-6da623f20349", "comment": "Malware payload (Mirai)", "value": "07c18b98b7e4dba680e52e53745a22de7a682736d7934e986829d340d256eab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452798, "uuid": "00b4c91f-b2bb-4e23-8618-3c8ad23f55f5", "comment": "Malware payload (Mirai)", "value": "43267d55bf7b3a1d0fb68e298ee3f2320dff87c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452798, "uuid": "85eea4e9-f880-403b-905a-5f7210add696", "comment": "Malware payload (Mirai)", "value": "869a42b1678906643c23dd49724327819dba286e6bedcf8b5004687ad52d9bf54046df4918c83465165b59743d87c0cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452798, "uuid": "535418c5-ca50-4d67-adce-4b9345737661", "value": "T1A1933A91F5459A22C2C115B3FB5F12897B1A03D8D2FA32039E398FA1774B85B0F36D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452798, "uuid": "e9c0443b-e3a7-4100-8c94-b6d1984410d0", "value": "1536:N6RjmoZ5Am9zI/qBx1sKPDcn+x2bM751Ok3Uva4WVG:NUj7yiuqBx1sK9ZZiwVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452798, "uuid": "9fc0ad44-5688-414e-a6ac-0f51b1e4d01c", "value": 91576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452798, "uuid": "913e3c1e-cb76-4c6e-88f5-7367ab78b51b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452798, "uuid": "59e12bd7-290a-4575-86e4-d353a606d13a", "value": "klogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4adbcb5-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503693, "uuid": "02932735-cf91-4ab9-966a-091a1931ede3", "comment": "Malware payload (Gafgyt)", "value": "e3fae14ee361deba44283b24fe66ce22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503693, "uuid": "87d0c4ae-963e-4368-848a-8420f80311a4", "comment": "Malware payload (Gafgyt)", "value": "088244fcc4feff995cd81632fbd3472c29da4597a75808797c8b846cbd5fe6b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503693, "uuid": "d87366ca-bc67-4a81-851f-61e6d4960f6f", "comment": "Malware payload (Gafgyt)", "value": "b758205c40d843176313c7bfc912ee80dc72245e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503693, "uuid": "bd07819b-0bcf-470c-922b-b4fef3994b07", "comment": "Malware payload (Gafgyt)", "value": "d288264b792d27ef3addb39d58719a8e6dda9370cba32c2c6109bba85ebd39ff1ea4087efae79c744a52dfcdf2b6535a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503693, "uuid": "86f067de-b91e-476e-b623-44dec837a6c4", "value": "T1BAB3D85F6AE19F9CF3658330A3734731E1DD92D62AA7C6C093ADD4110E602CE646F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503693, "uuid": "9c0b7565-0214-4d51-ac44-54a20d9e8b1d", "value": "1536:ByfdycamazbVCFu/8gjaJHa2JFkdG2JNc7c1ev8QMVT38RFH:4fdyc5QwJQG27c7cNQi8PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503693, "uuid": "61ed552d-590e-4cba-855e-4c2d4bb178a8", "value": 114264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503693, "uuid": "fb9a1eca-b691-4114-8a6a-bdb01e49d933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503693, "uuid": "e028dfec-a7cc-4797-b502-627ef017e373", "value": "rtk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594d4e55-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1752473475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473475, "uuid": "804a2abb-81c7-4f88-a2da-ace33eb56b0b", "comment": "Malware payload (AurotunStealer)", "value": "c8e35461eabb266d1d64be4e1466b34a", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473475, "uuid": "30accd48-eea5-42c2-97eb-6ca7b44da754", "comment": "Malware payload (AurotunStealer)", "value": "09568422f2f97358c64faf720ef846bcc018c2d3400620800d418e340cb93f11", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473475, "uuid": "15aa8e70-29ff-450b-b928-6a29310b3ca1", "comment": "Malware payload (AurotunStealer)", "value": "085347486996fdb6b324392a18b1adec861ee586", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473475, "uuid": "bdd5569d-54cc-460c-a73e-6a642e1eef43", "comment": "Malware payload (AurotunStealer)", "value": "7dfa9a6125c9b102dd24e53ffb22bbd9a2c9ae442d47add1703743115e3c22f703563c0d016c9bec7b1cae9ce4a2d246", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473475, "uuid": "951ca162-5774-494b-96e1-b2182bc10b7e", "value": "T14B763319B60FDCF4F387703C59EF60A685315AE9E89686CC47AE6A5E087344BC43B14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473475, "uuid": "e94f402f-0dd0-4742-97e0-5e3a32206b26", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473475, "uuid": "0da1c8fc-b088-419a-985b-1ecf32bcf4e7", "value": "196608:6DLzhhUD5yJOg7BDryx1GcoooekR3vvQMOFiL:g/hhVJlRboyH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473475, "uuid": "c3aef6d5-8507-4079-b94a-357f5e5abaa2", "value": 7629824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473475, "uuid": "8335e753-e908-45ce-9ccc-5b50d62beca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473475, "uuid": "da14900e-4529-4dff-b13c-d7138abb3ecf", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b126368-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480001, "uuid": "65415045-64f7-4e8f-88a2-870edd593434", "comment": "Malware payload (Mirai)", "value": "8de12bbc38a64965178518a22c0887db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480001, "uuid": "e66b9c98-4c12-4414-bc27-91370144f8e4", "comment": "Malware payload (Mirai)", "value": "09c03620ab0292edbf23443279bd2648d251083b4e3512ef6e5386e88eb7a07e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480001, "uuid": "eca69ba7-2be4-41d5-a4e6-ccf4aefbd8a6", "comment": "Malware payload (Mirai)", "value": "3e04ffee15d23857d18ae1b57aa23aff36dc53e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480001, "uuid": "3427f6ba-a314-401e-8dde-b65ad0303b36", "comment": "Malware payload (Mirai)", "value": "dba7891b892edb76934c780e167a6178f326e6551b562a703543cbe48965d03769390fa806dabe02c90316c75f704763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480001, "uuid": "bdac0210-0c42-4e2b-b41d-345032b4e4e1", "value": "T1BA835B22F979193BC8C4A57762F30335F2F6438A24ACCA1E7DB10D8DAF6865022577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480001, "uuid": "c97d0d00-5293-49e9-9807-4215c20a9881", "value": "1536:lpLZMUdKrdn3dx+O5rtn5NT5s38c4WQtBz21:lAdR5NNssm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480001, "uuid": "6e9eddbe-395a-44fe-8bca-29a163f6daa4", "value": 86568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480001, "uuid": "ffb444be-c768-49f6-99cc-9342aeb8a23f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480001, "uuid": "608edc48-65b2-4a0d-a915-4c658e7c653c", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee6a96e-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528487, "uuid": "ece152d5-a7ce-4359-9a5e-a37abd9e384c", "comment": "Malware payload (Mirai)", "value": "c4e09e97d69ea2d3dfd364b25ab7debe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528487, "uuid": "b68e71ac-caf9-4017-823e-51f6707f4aa3", "comment": "Malware payload (Mirai)", "value": "09e349e3650c079194d65b9e11a38379d14e3c692096bb6e4927a4dd88bf96b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528487, "uuid": "94e136a7-31a4-4fc9-9152-8bc101f50968", "comment": "Malware payload (Mirai)", "value": "76a66b87add1424bac071b30d1ab26987b973580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528487, "uuid": "7b5e62a9-9480-4e83-9a64-1aacb3af7c31", "comment": "Malware payload (Mirai)", "value": "9abbd955d7556c76e2d44bef84c980f913b3a5bcab74bd12f2ad76a8025a3b014cfeb52a21a76b84bbd993ff46db8662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528487, "uuid": "76779504-a1c5-4fa4-84e5-582a471eb318", "value": "T1CCE31B46F8819B12D5D111BEFE0E128E37131BB8E2DE72029D246B35778B97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528487, "uuid": "3e5c3c84-6261-489c-aba6-5ec638112002", "value": "3072:Jf7Kinafv+UrFTQZnXgDz7FDadY0BWPIa1yXNAWQuW:97KfGEFmnXez7xafWPIW9WQuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528487, "uuid": "0b2b9f5c-1d80-4ce5-9bdb-50170a63ffa9", "value": 150364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528487, "uuid": "983ba9fc-e5c9-4aa1-8573-330514cf108a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528487, "uuid": "5a91f2d1-4759-41c2-9869-d4057e3e57b8", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4611dc19-60b2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752497924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497924, "uuid": "fa13d4c4-82d6-419c-bff3-2e905e23fe50", "comment": "Malware payload (RemcosRAT)", "value": "8341867de12bade52c5d5091c990379a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497924, "uuid": "f5a92608-ff22-49fb-a4d1-d3455600af3b", "comment": "Malware payload (RemcosRAT)", "value": "09ed77b7dcd2dcff435a3c045a419e82671ee6e4cefb1a988e52f4266ee970cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497924, "uuid": "02278b47-f598-4509-8677-0bca00817823", "comment": "Malware payload (RemcosRAT)", "value": "54b1d7adf4638d9bf30de357b63f20b532be6d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497924, "uuid": "60799d80-03e2-4484-a66a-954d1e91f322", "comment": "Malware payload (RemcosRAT)", "value": "ef453da57e6910c63463913115a812565f92c3c3321dc7b0f9a152c310c742c6068858ba0fe57308a4baf80b230a911d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497924, "uuid": "af644cd6-e570-41ab-a286-6f5aad070fb3", "value": "T15455D02273DEC361C3726273BA15B741BE7B782506A1F96B2FD4093DE920121525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497924, "uuid": "bb53c7fa-ccca-43f8-8ab2-c596e6033bf5", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497924, "uuid": "9199bceb-530a-4ac0-9490-542dfc434bfb", "value": "24576:6tb20pkaCqT5TBWgNQ7aF8I9RR5jutRQbdaMrU+xYpUt6A:nVg5tQ7aF8I9ROWk+U+QY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752497924, "uuid": "3787ef3c-770e-44fa-9b3a-55c535909677", "value": 1324032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752497924, "uuid": "77b3fc91-68e9-4f08-a9c7-7eec74d12baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497924, "uuid": "a671dd75-831c-43a5-9c78-d51a244907e9", "value": "FHG09876000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308c1c5e-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518074, "uuid": "bf99922e-fbae-4d2d-bfbc-7823e25fab9f", "comment": "Malware payload (Mirai)", "value": "0755b636e5ef74f101e33efa0a67c7a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518074, "uuid": "6098c5ee-c2e2-47df-b83b-82fdf297a5a0", "comment": "Malware payload (Mirai)", "value": "0a026cc6b749c31a3c0d969598e0eb30b7b7efd74e54cc019660f5edb6cfafd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518074, "uuid": "6cb2ef41-d329-4463-a2aa-ffbad46bd873", "comment": "Malware payload (Mirai)", "value": "6367af20561623d786ac48b86b9547933aebebd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518074, "uuid": "e668f969-8524-4f42-98ba-b766978888c9", "comment": "Malware payload (Mirai)", "value": "dc21a726e5353df8d6404a4cd81c8f048442fba13df09ce4343022ba17ea9224ce810573423b2603e25328ec609b8273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518074, "uuid": "4a742fde-503b-443e-85ed-1962eec33c90", "value": "T11D041946EA414B13C4D627BAFADF42413323AB94D3EB73069528ABB43F8779E4F12505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518074, "uuid": "d638b183-614c-465e-bb5c-6d0b6d23ef70", "value": "3072:hxOpxmT27H5yqMw7QiKabniacA22mSePCPLO9BroVM/RkD6c:POpxoqMiVKabniacAjm2PLOTUVM/Rg6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518074, "uuid": "c4fd667b-a57a-429f-99e0-a43e2f9ca0ec", "value": 186622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518074, "uuid": "010365b3-e870-4127-b81d-ef356de715ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518074, "uuid": "8c6e675f-426c-48d5-9b21-8e9a9518084f", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1acc47-6075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752471713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471713, "uuid": "c1a735af-5e3b-4b3a-90bd-d6a76e7f6b5c", "comment": "Malware payload (Mirai)", "value": "414d03b5f06df817dcee6e2217d5bb48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471713, "uuid": "404be0f9-1690-4165-b3b1-a4b42687528b", "comment": "Malware payload (Mirai)", "value": "0b73e52f1d278b4274b06266ff059911f21a1a102ac36e2c7ceee7ecab58f964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471713, "uuid": "f8b07568-1a31-4405-81bd-f44572235021", "comment": "Malware payload (Mirai)", "value": "980e06f3b5882a214cf9308ecf7ca15f9d5f05f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471713, "uuid": "ca6f0e61-22b4-4c0e-a199-7324922b21c4", "comment": "Malware payload (Mirai)", "value": "18096717afe2a9430d696411778ce9e6b3dcabbe5b8dc416ba69589b5ba59437a5138589c34b995a8a86dcac722afadf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471713, "uuid": "03ca9a92-076c-4eba-8a0c-b59d8311df08", "value": "T168D32945FC519B13C6C652BBFB4E428D3B2A17D8E2EE72039D255F21378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471713, "uuid": "7875b122-0612-4a69-b213-582aa0ef2558", "value": "1536:pSzC31h0y8WJnycZ6MHBUrFA+xPj4VJColTOWm5gyMmoY7pPogRWlT6wyw5RaX/5:pSUQWpxyrFrL4a2zm5g05JhiM4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471713, "uuid": "2724ef0a-7446-4490-bb14-a790ee0215ac", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471713, "uuid": "6c9f6761-6c2c-43ae-9739-6d1b2dfc078c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471713, "uuid": "e8cce059-4a21-4f92-bae3-a28cba8fb999", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772b72e9-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485121, "uuid": "822a5abb-1c89-4d17-b4a3-0993ecaa3e2a", "comment": "Malware payload (Mirai)", "value": "ea0a45e1c52c285a313641679a100f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485121, "uuid": "60a88f7b-ffc7-4eb2-b205-6e29333ec73d", "comment": "Malware payload (Mirai)", "value": "0bb131687391aff68f1d06efcf3ab9cd2e0eccdb57f6048d8f404b86eb4d460b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485121, "uuid": "49cef676-486c-4421-bca7-49f85022101f", "comment": "Malware payload (Mirai)", "value": "852211a7cd031ce65f2cb003a6c1c46c5e896612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485121, "uuid": "f5536453-9ab1-4860-852e-8f8114a2dd59", "comment": "Malware payload (Mirai)", "value": "3fe1cf136d0f2eb4116feda27142a3ba1332f992bf2f134c16d58cd030d057cb6d6f304cd9d2d9f1d41e93f5b1675f96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485121, "uuid": "359762c0-cf52-464c-ab64-b5081451ac05", "value": "T191E2F111591A847AEB30C471E0F5858777692FBCB9FEB1A24572024DDCC294293F1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485121, "uuid": "105aec56-8591-463e-a227-bfd92b01889f", "value": "768:SEKkUgXAnURCr6HmDFStmYtGgU9q3UELdt:akEn7uHEem89LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485121, "uuid": "a4fa1768-2dd8-4931-bd9b-ea730ee7f0ae", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485121, "uuid": "7cfed683-1f64-49e5-85ea-9686df0fed84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485121, "uuid": "d7e1f5da-2dcd-4b84-9353-7cf60584a78b", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6775dc36-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528474, "uuid": "55c338db-d95c-46f5-af64-d6e6cde1a43c", "comment": "Malware payload (Mirai)", "value": "b809dfcc45ceb6dfe57788f2e1bed3c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528474, "uuid": "78f92cb6-7b24-4289-adc6-5dbc587930d9", "comment": "Malware payload (Mirai)", "value": "0bbb6ecfe49682c33612c1a6ccc40172939472683cc2ed3b7a268747e0eba6f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528474, "uuid": "5d54fbbf-00a2-41dd-b7e9-478c5aa663ad", "comment": "Malware payload (Mirai)", "value": "c445fabcd9604f9e7bb38904eee39fd23c6af022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528474, "uuid": "637712e9-8bfe-4782-8b48-65e3ac78ee22", "comment": "Malware payload (Mirai)", "value": "da15bc87ffdd56d0865f49eac30e2f21b4c4284e658548557a61078965b156349cf08e1ab3428e7a823bfa235e0a66a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528474, "uuid": "cfa1e175-1536-4b09-a43e-bf06d75482a5", "value": "T1AD03011BD4256CC6D8A880F2D65340863B915FF4E4F9B2936360CEE49CB68DB34B8E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528474, "uuid": "e5575618-2148-4dea-9f2c-0ae94e10abae", "value": "768:fWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5fQOkui9q3UELy3:fWXasPGxplekBgTP654QwGdvk6LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528474, "uuid": "c07f5425-85fb-488c-bccf-dc5183245b9a", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528474, "uuid": "270184b7-80ab-439a-868d-5066fda835e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528474, "uuid": "f4ced096-028f-4fe2-8988-d13b1c826064", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebe3d8b-6072-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752470451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470451, "uuid": "0e74fc19-f4a0-4f5a-9986-3d92877c4177", "comment": "Malware payload (Mirai)", "value": "5b9c3adec98a668230e8ebeb7762f6f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470451, "uuid": "eb70a74a-840b-4528-8e3b-e191389f8c1c", "comment": "Malware payload (Mirai)", "value": "0bceaef459d8846ce0e31a6a23c4c752f65b839d6ff3c273f08eb22eba999c1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470451, "uuid": "8ad4553a-a913-420d-ab77-fd09e2bd3f51", "comment": "Malware payload (Mirai)", "value": "efed316767dbc73f418985cd33cb5818550befea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470451, "uuid": "d7949593-6d80-44b6-9546-6e035a0dfdc6", "comment": "Malware payload (Mirai)", "value": "5b7de362c703bb29a99e175e9bd1a389c78599cdc3132e412997d25906b32ed0e40fd43cbfe08a39f4727b00c21939df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470451, "uuid": "5db52578-514f-4f16-a702-aead2cd3aea3", "value": "T198042B45EA414B13C4D22BBAFADF42453323A79493EB73069528ABB43F8779E4F13905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470451, "uuid": "0aa4ac75-2595-48ab-b153-0d834f243c70", "value": "3072:cBtHK5Bxmm35WFBwMRilaMkfJ8grj5vuUHG5POZBso+M/RswK6p:cNvFBVIlaMkfJ8gP5bGtOXx+M/RsJ6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470451, "uuid": "cfca5218-0424-4431-85ba-0228c892f96d", "value": 186364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470451, "uuid": "74df13a9-3133-454a-8f61-647fa5bf4e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470451, "uuid": "a21da844-5c1b-4b93-96ff-0a606263e3aa", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fcad43-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513087, "uuid": "3ce079f9-f058-4f1a-8de0-82bcded110dd", "comment": "Malware payload (Mirai)", "value": "dcbd285f7277ac869b40d999d845b2f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513087, "uuid": "b360791d-3cd9-43b9-9eff-bfcfd3726698", "comment": "Malware payload (Mirai)", "value": "0c48ec07bbd31f822bbbc9c0db584655f60bcc58910987e278c4eb57ff1f0b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513087, "uuid": "d4dc8521-7f93-4407-87b0-051ef61f9612", "comment": "Malware payload (Mirai)", "value": "a74c5a500d15f20cce82a98bae2684a6c3cdcb42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513087, "uuid": "4af7377a-b89d-473d-abe9-88aa0bfe1454", "comment": "Malware payload (Mirai)", "value": "7155533680878376798360a12669404c7fc3dc974b614211245cba3d47bda87fa8c871befdc34275fd7b695e7d743cf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513087, "uuid": "1766cc8e-296c-484d-86f2-d016fb016c50", "value": "T10AE31B46F8819B12D5D111BAFE0D128E37131BB8E2DE72039D246B747B8B87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513087, "uuid": "66d2865a-43c0-44f0-b065-1c4e5b2c2d42", "value": "3072:7PLqrnMILUdFtkKX+xAFbadYf42RCUbbwfkwKIX:7PLnILCsKXkABaA42RX4kwKIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513087, "uuid": "ea45125b-58fc-47dd-b2bb-da08850be77a", "value": 154460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513087, "uuid": "ee08ed42-3d1e-44ae-a92e-cbef830924cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513087, "uuid": "60e4b0ad-c4ce-4a6e-940b-f651368f43eb", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6a21a4-6075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752471712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471712, "uuid": "2cb48896-163c-4d1b-be4b-78f2fa42983c", "comment": "Malware payload (Mirai)", "value": "af71d9e13f07189e91fa7e95305a2b51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471712, "uuid": "178593c8-1150-49cd-8a1d-2d06ef770550", "comment": "Malware payload (Mirai)", "value": "0cf960398bacb42c64a18a34db7c84974a253fd18d96eca5ce83590d08213f31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471712, "uuid": "5e198a1f-ed08-45b3-8b4d-941805af955a", "comment": "Malware payload (Mirai)", "value": "cc4363d9079aa3804818bd2c03bc9213d573f7f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471712, "uuid": "2d30e407-e391-47f4-b2c4-3ea19ee8436c", "comment": "Malware payload (Mirai)", "value": "7811af560d99f322a6a62beee221b9622570c683c365a23ce879c56189ca213b756d1afe485ea41746d862cfd93eca94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471712, "uuid": "2496ce8c-d04f-4bd6-a40f-6cd647988938", "value": "T194D2D0AEE57442C5FD4D5C3E808C3FA10E59E581231BEB9267218C4D5B36C57F16E4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471712, "uuid": "0365ce33-5343-49a9-a826-cd356f445f63", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjIZ1bRWGVCz0Nva:8MYHb62x4ahQ3CfdwLj/W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471712, "uuid": "80ed765f-2235-4533-9333-e256f6aa290f", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471712, "uuid": "0a7dd663-8e4f-4023-a96b-1c4e97c1d908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471712, "uuid": "9cd32ebe-d9ec-489a-8cb9-ae5a5a0358f7", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae76a4a-60f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752527916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527916, "uuid": "3d539c5e-f92f-4d31-a371-d76654729b7a", "comment": "Malware payload (Mirai)", "value": "a5f692ce2db7a567fb273f0fa9f57d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527916, "uuid": "a8140728-e192-4445-8092-e04a5e79220e", "comment": "Malware payload (Mirai)", "value": "0d0e61dee2fae358a61a5dc0a265589724654b407979cb08086b32c1a22ffcd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527916, "uuid": "247454eb-dac1-477b-9dc8-91ea7b1f3f28", "comment": "Malware payload (Mirai)", "value": "74be4583d4106c3d3bc669a6d6631dfba69639cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527916, "uuid": "a76250ce-e15b-47db-84e0-659fe77bf163", "comment": "Malware payload (Mirai)", "value": "5ae0427029807b21702a75529b082b52952f0406e88bc8877f51d93899e940193b97614706936b00d65b56255d2e3c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527916, "uuid": "f9401ad5-94d5-4c7b-8381-893db284d412", "value": "T16593D61ABB510FFBDC6FCD3706A9070535CC551722A93B3A3A74C928B64B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527916, "uuid": "f9c87f33-1d9a-408c-9837-a66edecabbf8", "value": "1536:NqkEkVGUnb9dVSi4sjYXN4716KgmF7S9L5fhZ6UmTg/+als0pth7:NnEkVGcBSy6TmF7shBTHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752527916, "uuid": "ace1a38f-a2a0-4f29-b9e4-0e4eb74e6da7", "value": 97336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752527916, "uuid": "7818f316-4dce-48d7-87dc-c5b29fb300f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527916, "uuid": "860a42a2-5813-4e07-b211-7d3fa9523f4b", "value": "SecuriteInfo.com.ELF.Mirai-CYW.4084.27300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf2e09c-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513156, "uuid": "d9488593-95a3-47ef-bdf5-a249ae5990d7", "comment": "Malware payload (Mirai)", "value": "da3c9f51b242aecafa4640fc43439c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513156, "uuid": "ce0f94e5-962d-4b75-9170-6498e0139c43", "comment": "Malware payload (Mirai)", "value": "0d90d5de7b06bba91d5c38ab95954a2394c0f0849163f5596f34e8a82943ae31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513156, "uuid": "74e5096c-85be-42a9-9a7e-edb4ae519ba7", "comment": "Malware payload (Mirai)", "value": "dd1e1799812d94efec75bbe87f8be8d84dfcf52a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513156, "uuid": "7052130e-c782-4049-b945-f515def32d0c", "comment": "Malware payload (Mirai)", "value": "cd84371bafde49566a875443d92631dd1ff9de15b56977a3eac595101658ebf1690d291f78e630335692c07dea60be2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513156, "uuid": "7c97f3b0-b116-4492-a8b5-ccfc8191fec5", "value": "T171834A56FD819652CAC512B7FB1E028D3B2713A8E2EE3203DD295F21378791B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513156, "uuid": "9a11fc1e-f82a-44cb-b28c-949b91832e69", "value": "1536:Tvp9flMWgOHPAo19mb1tWguC6E+1ymKAkvcdH:TvfflMcHIo19ozWgmsBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513156, "uuid": "5454bd75-40a0-4982-a02f-50c13001ee3a", "value": 83664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513156, "uuid": "afbdf6b7-2fa7-488f-a314-400652d00888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513156, "uuid": "6570fd08-d192-4044-bc88-663041106bf4", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70296a59-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485110, "uuid": "3d8ed696-2f39-43a7-9a4e-42d446ec8dd4", "comment": "Malware payload (Mirai)", "value": "766a082b486c07a8b636503a99be6293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485110, "uuid": "ae03bb05-e240-4f2b-9056-89ded7c92499", "comment": "Malware payload (Mirai)", "value": "0d92f852707c0fe838811b0db6c21b600becafa9bb4018ac41ed05e461fbc7e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485110, "uuid": "b026edf7-4005-4ac8-8a1a-d57916b5926b", "comment": "Malware payload (Mirai)", "value": "876422eba98bfa17012571da204fd8814e82753a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485110, "uuid": "062da1fe-f05d-4213-ae5d-6e924a813590", "comment": "Malware payload (Mirai)", "value": "f0380008b683e6280e5e7027c84d3c296c94d84df20cac43413b1bcb350eac7e4208ac7aabffd9a975478794175158c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485110, "uuid": "cdce35b8-666b-4d1b-8f78-fa46bf706d23", "value": "T1CA336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485110, "uuid": "ed75a122-1010-4da2-b93e-d6d8e22e746f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485110, "uuid": "e97723be-c70a-4d7d-88d1-7e5006a4112d", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485110, "uuid": "ad20ef5a-2551-4fbb-b7bd-a2d3fe514c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485110, "uuid": "1bd0a23d-92a6-403f-996a-543c07d648b3", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63553305-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485088, "uuid": "d6e2ab27-fd94-4b1d-9685-92d1299a5ea8", "comment": "Malware payload (Mirai)", "value": "ec971e02694202efb30d62b15b0d12a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485088, "uuid": "81b73eb5-f6e3-408f-9c92-a094f5164f5d", "comment": "Malware payload (Mirai)", "value": "0e248d554bc7e88e69f16eab9b6bc4c7152cd52c8d93cef002241e1ee3f8c18c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485088, "uuid": "dcfa75de-987f-4885-a0f9-53a33e62a444", "comment": "Malware payload (Mirai)", "value": "56065327ba8d4052dde3005c294e4ab416a953c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485088, "uuid": "2444f67f-aa60-4e90-873e-cc7b62285ac8", "comment": "Malware payload (Mirai)", "value": "7da99498b5a6c6b2bd22f8a047198fcca039e71342e5e33d59d9bb9eebc1ac1269d3a0f2bf5b7f5db973131346ab6b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485088, "uuid": "76eeff5e-b94d-41df-af06-b71a5c9153da", "value": "T1347329D7F800E8BDF80ED37B44638909B630E3910A930A7777677556EC760E5486AF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485088, "uuid": "919b9891-2b4a-46aa-b15a-6203924241c5", "value": "1536:wQiVKzD0MHOwO1zsrBH58/Pvv9FuMyEC6WeHAtekF3/6QJ49yVByYB:QsAMQzsr1sv1y96NY3/6249yVBdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485088, "uuid": "a746335a-867b-4bb3-bc78-442af0286603", "value": 78920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485088, "uuid": "63025382-f35a-458e-b03d-ac06fe2a38ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485088, "uuid": "c2672129-ca2c-4d61-9480-9ebbf1deeaba", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae63b307-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492086, "uuid": "97475dae-32a9-4580-babc-b00f136cf6f7", "comment": "Malware payload (Mirai)", "value": "ecf9c94725a5476d0de1880a6c7a5a85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492086, "uuid": "af1540bd-93b8-48ef-b19b-f84d091052c9", "comment": "Malware payload (Mirai)", "value": "0ea7f9c899753840c12cc3132cc246663457e7f5adbfb3f42292443adf199110", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492086, "uuid": "72593cfb-0fa6-4524-a7ff-0c9f42c1226f", "comment": "Malware payload (Mirai)", "value": "bb1d7412dea3283c867e1a3297bdbb4dff289b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492086, "uuid": "ed44ad8f-fbab-4a3d-8602-2554cb4b4c34", "comment": "Malware payload (Mirai)", "value": "6bd443c00df391a770c65b0269c4d4ac688f7291c90a2fb6b8c65bc00110b0e769b9f724c573429d12b708da2e892ac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492086, "uuid": "ad6b2062-fadf-4318-a5d0-287a799a27cb", "value": "T151647433D91684A1E0104CF3126736869C4797BF88A726D3EF5A5DA0FF3145B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492086, "uuid": "ad74231b-af8b-4a7b-80f3-73c4e2d92be8", "value": "6144:WetmWXMlP8ZiNyKAwjopCu6owmXFvtMdxDaJaT:WetmWXMawjaCummXFvtMdxDaJaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492086, "uuid": "012ce4a6-d115-40cc-8b51-a32616c67b4c", "value": 326955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492086, "uuid": "b1c1fcfd-6695-4950-9da5-1ab90a2b34ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492086, "uuid": "f6f05abc-cc83-4a7d-b4f4-c604fd115b34", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1f8d99-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496887, "uuid": "cf2463da-a413-4194-ba68-8f3670adf226", "comment": "Malware payload (Mirai)", "value": "87c862ace652fd1e72ded0a584cb7062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496887, "uuid": "fb8a3a3e-5501-4cc7-9546-66256ef7fcee", "comment": "Malware payload (Mirai)", "value": "0ed4c74b365e90a119cef72033540deec531fea035fceb164326a7582e42e491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496887, "uuid": "16cd56dc-21fa-4980-a9f9-9d466a87b6b4", "comment": "Malware payload (Mirai)", "value": "f11376225f55cf95fdde9291e06471be6329b221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496887, "uuid": "d7e777ea-0568-4485-ae06-1880db724657", "comment": "Malware payload (Mirai)", "value": "be2c4527358ef85f2599eed49dabb7d392d7a77cec8b7871282c677f864a0800da42ae23b1fdc5ca1c06c0f32c442687", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496887, "uuid": "8b382b9e-1ece-47e3-8f53-21d2449b09a2", "value": "T114A3C616BF310FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496887, "uuid": "01a8d259-b881-45e7-a904-1cc3fa298bd3", "value": "1536:RvMKs9oRHbfZT7EQYEWiGlCvaGe1Cs2ooKfALVZPpzKAL:RvMKs9oRHbfJ7fW5lsarVILV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496887, "uuid": "6b237512-e020-4b41-bea3-1051a1b0ce66", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496887, "uuid": "18aae411-07ab-46d9-b103-d12e0a1ba260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496887, "uuid": "d5e51aa0-8731-4061-a446-00b56344e22e", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3af70a2-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493410, "uuid": "7accf396-787b-4b07-97dd-5a80b0194c62", "comment": "Malware payload (Mirai)", "value": "04d00d90f381279c031697dfa883619a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493410, "uuid": "b36d889e-ece0-4130-8a88-43e7641f794c", "comment": "Malware payload (Mirai)", "value": "0f0913d67b8f1cf30c71191c7d9c0299742343434102abd4e5e7c57687d51579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493410, "uuid": "90770ce4-df35-446b-b7c5-04e57d5f86dd", "comment": "Malware payload (Mirai)", "value": "290155c3a0d33e2844dec9048f4383ab3001488d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493410, "uuid": "9926e1c3-1536-49ee-8e28-b7309ebb7d4c", "comment": "Malware payload (Mirai)", "value": "fa7bf2a699754ac32f89a08e71d4fbc3e3335ce655a5f5715b34fbd786c4a4970096aae63b48a57e6cac93dbef0f9e1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493410, "uuid": "6c75c5f2-8318-4689-a890-0a29daf747f8", "value": "T1A9A3B509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493410, "uuid": "1e1142dd-f6f1-48a6-949b-20337b1e97b3", "value": "1536:YOt9m3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7/+:ht9OpPRWu8ERZ+0u8vjhh/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493410, "uuid": "631ef271-cb2c-4425-8e60-91546efaf344", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493410, "uuid": "0df4703b-98dd-4866-b906-897b1d3c721c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493410, "uuid": "18967509-cc74-4fdb-9b93-1095565af134", "value": "SecuriteInfo.com.Linux.Siggen.9999.6198.9599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7744ac01-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752477820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477820, "uuid": "e1f79ba5-626c-4128-85e7-e1aa8eaa2d21", "comment": "Malware payload", "value": "0ff670c99fd90eaac179b120f2f891a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477820, "uuid": "3ab82084-573b-421b-a1c6-7c3b728639c2", "comment": "Malware payload", "value": "0f97d8a7b56c127599f4cd4a099a27ea6d515255f2e3e82d19e63d47f888303d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477820, "uuid": "56958ee8-82d3-4b9e-993d-d7d4b93b203e", "comment": "Malware payload", "value": "78e844fcb2762b6370f5273d5d523d97897b4e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477820, "uuid": "629aa202-1afa-4677-bc56-c9932818b458", "comment": "Malware payload", "value": "a354845bd10fb39ac3189d10854b0c13b15f93f84f37c873965b241d3e238027da3bdfa17d33d484bcf2646d8584ac0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477820, "uuid": "745cbf03-06e2-40ae-8e46-98063da191f7", "value": "T1E802E60877DCA733D5FB0775ACB742411678F7AA4892DA9E1C48528BDE633800A62722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477820, "uuid": "e735fbd0-89d1-427c-9305-da69c7f1873b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477820, "uuid": "6ab88168-d6e6-4402-b88e-ee21dc769891", "value": "192:r7Xaaykhrqn3sdzHCumXaiAuKN6AhC24xnQzJYuyL:r2afhrqnlvXaiA9bCtxnyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477820, "uuid": "4c54b8fb-a4fd-4cd0-bd1a-6569740ff98b", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477820, "uuid": "2e83f662-163e-48e4-9ed7-e82842421b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477820, "uuid": "b959401b-d645-49db-88f6-bd4b659aad2a", "value": "BBVA-0907-2025.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df91afef-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518368, "uuid": "75cad294-d86a-4a1f-843d-4a7333ef6b63", "comment": "Malware payload (Mirai)", "value": "ca9dd5e004941419449b3b81a2e2b0e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518368, "uuid": "fd31b97d-934b-4bf3-aed6-056790c9f978", "comment": "Malware payload (Mirai)", "value": "1055dce2a0f39d4e6b373309d70488642ef2d191a77d0fb7871c5589ef085d1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518368, "uuid": "29f0e0d6-1630-46e9-bf5f-cc42dd1dafc1", "comment": "Malware payload (Mirai)", "value": "d0a0bd4ccc4b78aec5c08ecd73d268a0f624e615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518368, "uuid": "739c0c29-3e0a-4211-a126-113876519ea1", "comment": "Malware payload (Mirai)", "value": "b60096f59dafbb5d47fa448ab61848867ca867110fa49637b3a0951bd37fe51f9ff7810689ea0da012f5d6c264902374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518368, "uuid": "9ab717b6-daa4-4aa7-afe9-0499953f28a3", "value": "T152F2F161F69239F1DEE7B6331C0AD3E36B950EDEBB520EE425A1EF02950843652158C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518368, "uuid": "1bac6e26-3eef-4044-9284-da67bb3870c4", "value": "768:nqWwvxt1MIRyqx2KvIZ0l4mw1USe8J96HmNuA+aV7tGmBuwcVc6gj4uVcqgw09x:nqTH1fRfx2KvIZ0zw1U6JEHmAA+a7dCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518368, "uuid": "5a7293c4-9d01-40f4-8455-0034069a5b16", "value": 37312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518368, "uuid": "393e0067-a101-4bd4-a87e-8a12ffbe0dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518368, "uuid": "caa528c7-de6b-4303-8d1e-f49ffc29669e", "value": "top1miku.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7de6693-60e9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752521710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521710, "uuid": "2a52debf-7065-41a7-a7b7-8d892e0f133c", "comment": "Malware payload (DarkCloud)", "value": "60ed96fdc30d4b1e04c236930b686c79", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521710, "uuid": "4c91e212-48b3-404a-8d47-61a085327e68", "comment": "Malware payload (DarkCloud)", "value": "10b473d1b8926572686bf2c6b3bdbc67e18a8dbf066d7f392966bccac917c97a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521710, "uuid": "372a3613-ab39-467e-9cb6-e7f1ba187d06", "comment": "Malware payload (DarkCloud)", "value": "7abcfd645254d18058362e953dca778c6a3dcc99", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521710, "uuid": "c58112f1-664c-4ac9-b586-b4dc77ae1d6c", "comment": "Malware payload (DarkCloud)", "value": "a8770df02af4f9a7216fba73d62d8e0e1f6718cc3a31597991f48935d1e24ba46f63eccae2df15ef036492281e98235e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521710, "uuid": "95a00705-786a-4bb4-b6ac-ca295913a878", "value": "T1EF151205636E8F12C6BD47F60912D1B013FA0DAE7521F3428FDB6CEB35A4B441A92B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521710, "uuid": "4060f511-4248-49aa-98e6-6b216dd8bcdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521710, "uuid": "9e03fa0a-2f43-431b-bce2-71ba564c28d5", "value": "24576:KrYUW5lPYx4mNKgZD5pq7TDH/QPVc5ffA4IfuXmN:KrYUW5WxLb5pAL/QPQHYuXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752521710, "uuid": "eeb090ac-2b1d-4f5e-b655-779fcdb1abfc", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752521710, "uuid": "62974782-870b-45b6-8569-6c4d0735aa7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521710, "uuid": "c9160d2a-2424-4005-8815-b30fcf3f54c6", "value": "Cita-00373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ec0136-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752482703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482703, "uuid": "77e3696d-a629-4dd3-965c-9ca0373bfbcc", "comment": "Malware payload (Mirai)", "value": "2bfcdc7da3a9c611d8f322575719dc65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482703, "uuid": "fd09b440-7ea2-4a45-9621-1a6c70c7fd0d", "comment": "Malware payload (Mirai)", "value": "10be91e01d67ce10f98b07394c631e99b8beff25c905efcb0739da7433db02aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482703, "uuid": "fd8d597b-70c7-48a4-b134-fac41da9e10e", "comment": "Malware payload (Mirai)", "value": "72a01f0b36c8f473c4f77946cc36b4df66ac5cbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482703, "uuid": "92064e72-0f30-4e82-9bb0-8b227b6c9959", "comment": "Malware payload (Mirai)", "value": "89d0974bc343c02b5c363213fd1a264aee275f1a922edd0a3146d77b381c6157f96898dd174c0c75b10a008955be1176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482703, "uuid": "9a466af1-61a3-4957-a78c-1b3fbf97140c", "value": "T119B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482703, "uuid": "3e78ba91-911d-4207-b620-fa231bb8c25a", "value": "3072:S4uLcytU969yY2J+JStEFrCFqugbWXqGo:S/JStE5GOIqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482703, "uuid": "2f674f41-1651-4d07-b477-3ef37c7f48d7", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482703, "uuid": "83bcc43a-7999-42e4-9a66-453878701858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482703, "uuid": "c2d1a457-7fed-4895-8905-16521cede107", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c38a7d2-60c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505665, "uuid": "dccca3a6-2f77-440b-8ada-9d7cf98183bc", "comment": "Malware payload (Mirai)", "value": "74fac07108d9d55a386d625efc47ac8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505665, "uuid": "29cdd7f9-4d3c-4aa3-b769-cd848d0a43b7", "comment": "Malware payload (Mirai)", "value": "111757d625532a541359130cc837b4d94da044960a6c5a3d5c70f4c5633d276a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505665, "uuid": "94b93ead-1df6-42fc-8518-2d2cc6cf4f76", "comment": "Malware payload (Mirai)", "value": "df56535ae6d9bb0af4d44b8dfbb1ed9400fbc097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505665, "uuid": "2839613f-63ab-4b08-b554-42c465b7863d", "comment": "Malware payload (Mirai)", "value": "899890be755bbb8774e4a82268dc1ba19cf99e93a24a6f690ead464b08ecb08b904b829d54c2ad6f0b8f8d8cb79897ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505665, "uuid": "b254a29d-7c9e-4ab4-97fa-dfd49f9b06b1", "value": "T12AD31A45FC419B17CAD612BBFB5D428D3B2A17E8D2EE3203D9255F21378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505665, "uuid": "b89699f6-ea7c-404e-879f-84f453b3ed94", "value": "1536:kJLECft+5OpYES4k1gwTPANyjn4VrTcTiNlt+RDQYRWOiXJ09WoQHz64lY7wywt9:kJQCfVGCChTP1j4Jcuf8RDXi4bQTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505665, "uuid": "c4015b57-1738-4efe-9bb0-5bcb0cf2d1c6", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505665, "uuid": "77f9b05e-a6ac-4f0c-8b83-8950e448bdc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505665, "uuid": "084d2fa6-e251-4df0-8a25-317b71ea35bc", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7618a1-60f3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752525745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525745, "uuid": "e30ad9d0-7153-4822-9f34-4e6ab9fed064", "comment": "Malware payload (Mirai)", "value": "22fc6dede0dbb746726b13a930178634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525745, "uuid": "967af0fc-dc40-4a90-9a70-0cdd6a9e4740", "comment": "Malware payload (Mirai)", "value": "113d23ca269e2008c1faeebb6cc4dbcae22163aa4ea609b2c1aababb67a26902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525745, "uuid": "054c9132-30f5-4ff8-a3d6-498e11e04468", "comment": "Malware payload (Mirai)", "value": "b3942baa4c0298c1ae1c62cbc926bf2109c0ce03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525745, "uuid": "8e237f51-1566-45d8-8198-bcc7fe2080e7", "comment": "Malware payload (Mirai)", "value": "94be904f2bf4cec7d9d4af6c9897af478db652542115a5bca22bc47de84709da2a9c27b9b85ec878a14f9672a3b58274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525745, "uuid": "24d74fb2-d8e9-42ee-ab74-16de657a0de7", "value": "T12C434A35BA721927C4C5587A61F74B25F6F503CA20E8C61B3DB20E9DBF60A413617EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525745, "uuid": "e30feaca-81bd-4247-a510-439433bafede", "value": "768:EEYdhz3gqed6Tus6oDFJNmmsO+lM5CnctQD1tG2wfId:EN3bs6Tb6oDF+nlM5CNtGffa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752525745, "uuid": "7cad2eb8-7fbb-4c76-8850-2b60645d1de4", "value": 58696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752525745, "uuid": "e717c88c-64b9-4cde-ad72-ecb2cd819a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525745, "uuid": "94856672-aa7c-4e1f-951c-cfd9a94a2274", "value": "fsociety.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d52507f-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494393, "uuid": "50052eb0-ad24-4ff3-ba36-8d372c42b700", "comment": "Malware payload", "value": "d4883358955b4ba3f910e56f1f0c5318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494393, "uuid": "350f3c01-7bc5-4cd7-a5ae-a3d791ac51de", "comment": "Malware payload", "value": "1189264ad4f77a38fea72c5cd3055d6205823a990fc0e79d910af474ac6c38ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494393, "uuid": "58603239-ecc0-4f20-a710-b1f589bb327a", "comment": "Malware payload", "value": "c9453c646dd2c48dc4cc5cdf7a7d3ca596fd23b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494393, "uuid": "b8c0da47-30ae-499a-b107-6bfc4786b480", "comment": "Malware payload", "value": "a7d48e1cd3a931a0d812f576f10f2ea798459a7674de842566bf5e36eb61f53a4d03cf13e31f410eb88a4f35ba0a8cec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494393, "uuid": "2f4e1bc0-2f5e-4dd6-a0f4-357238191351", "value": "T1FEA41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494393, "uuid": "f631e82c-9217-4327-9c56-b73c37b130be", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494393, "uuid": "82bb2743-7a4e-408d-8eca-79b144245fd2", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494393, "uuid": "907e150b-b346-42c7-b103-c10abd513768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494393, "uuid": "67b83a83-897a-45c5-b027-24057ecdadac", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0390e169-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516281, "uuid": "1b7e1855-0144-447a-94c0-610634a3dd2e", "comment": "Malware payload (Mirai)", "value": "b1b7c5d1d966a47a4a3cab164db6c577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516281, "uuid": "f35c4d7f-afde-4409-897b-bb31b849db5a", "comment": "Malware payload (Mirai)", "value": "11a75a0d6c4c7b7ab3e2958f616067f939cb4cf319ed0a9642b9f4910ad94207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516281, "uuid": "3721cfb0-38bc-4b0c-ad33-697c04e69f64", "comment": "Malware payload (Mirai)", "value": "853c13dc1ac398f45a540719c5fe73b1be43fbad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516281, "uuid": "d647cca0-2d1f-4b35-bf0b-22a206e8da5b", "comment": "Malware payload (Mirai)", "value": "9ebad45a90b12e6b225cb19e498c56811f5e13478a930fa32ab37428c6dc6ae92296ae3a69c7650c61519df4fbc94e31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516281, "uuid": "39e9a4c0-4372-43e2-8809-12b2241298e4", "value": "T1CB931875F8408E11D5C215F6BA2D969B3F1303EBE3EA31525B245B20AF934970EBBD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516281, "uuid": "dd9e8285-fe3f-4edf-8fbb-801f2ce512d9", "value": "1536:iyns7Pgh7s+zeqOQqgJaLvQCMDiVBzvfp23Y2/T55I+RYx:yPgtzeqOQPJa3tvfp23YWTAaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516281, "uuid": "9cd7d9eb-6a35-4fd2-aecf-e2c97feb746c", "value": 92436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516281, "uuid": "acf391fa-6a13-4eb1-a6ca-0d7207cf3182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516281, "uuid": "c731569f-3f67-426c-bf10-0e5b39dc0976", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7db076d-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1752501953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501953, "uuid": "533ab483-36e4-41d6-bab1-0fe9e0130b61", "comment": "Malware payload (njrat)", "value": "5ebcca94d3f5cc27af932f493a22053d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501953, "uuid": "74d5035c-cd7d-44cc-bb1e-391640924f26", "comment": "Malware payload (njrat)", "value": "120210b7e75af8c852e66a476b6be89cbc25bf02be007261a7339a50268bb1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501953, "uuid": "1049c3bf-1e9a-4165-bbf0-2fac70587aa0", "comment": "Malware payload (njrat)", "value": "7f851a397bc819990ee1b6a1ebaaef6b08dd2e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501953, "uuid": "7b8197d5-8742-4e4f-bd9c-507e2e0dea75", "comment": "Malware payload (njrat)", "value": "19508e9ab9dc67495a343006b06f5d96ec4454e92efaa119dc7a557474477eb906d64a0f6a1d74f343c1f9e87e4e0e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501953, "uuid": "c02e2b98-ca1a-45e6-8ae1-c8daa45c6053", "value": "T188836A1D37D50EA0D9BE1EB548B1A5010371E2436923E75E0ED464EA2EB33D98F0DBE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501953, "uuid": "2c43a3ca-d59e-4dba-a440-827d3029f505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501953, "uuid": "b2b9f393-08a6-418f-b1ac-d60614a627b8", "value": "1536:qSgaeHD3qrYnMlf+EcIr/9ETwbpaF9bGAek:q4eHzqrSMlf+Enj9EkpaF9bK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501953, "uuid": "483e1c4e-56c8-4f0a-b754-5a751a0ce2c4", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501953, "uuid": "7e449982-a40b-41ef-9b4e-31e39ca19d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501953, "uuid": "4db58a3b-f2c7-4d01-92ae-3541d0702c88", "value": "120210b7e75af8c852e66a476b6be89cbc25bf02be007261a7339a50268bb1e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac15d16-6077-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752472538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472538, "uuid": "8fb5c3f1-0060-4361-b7e1-70cc23575d49", "comment": "Malware payload (RemcosRAT)", "value": "daf3ff9e116330fc74aeed313f894f39", "object_relation": "md5", "Tag": [ { "name": "198-135-49-81--1987", "colour": "#DC47E7", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472538, "uuid": "4fe44a13-e530-4f8c-ab8c-a52613971035", "comment": "Malware payload (RemcosRAT)", "value": "1237e350df673c571d636206575288e49d02729a06baa3df07bf4a99614c9c5f", "object_relation": "sha256", "Tag": [ { "name": "198-135-49-81--1987", "colour": "#DC47E7", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472538, "uuid": "df359049-fb54-4e81-bc66-b3c90e6cc116", "comment": "Malware payload (RemcosRAT)", "value": "37fe33c80e095dfb65d0bbbd013536f0e2da29c3", "object_relation": "sha1", "Tag": [ { "name": "198-135-49-81--1987", "colour": "#DC47E7", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472538, "uuid": "bc4e8def-776a-4e45-b710-6adbb66fe021", "comment": "Malware payload (RemcosRAT)", "value": "776959d36d7b40baa5e2d2f347a91f35f30e5d9ed337435c89c0a4fafc485921cda2c3e1c6f419622b66f10f0e71c19e", "object_relation": "sha3-384", "Tag": [ { "name": "198-135-49-81--1987", "colour": "#DC47E7", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472538, "uuid": "50b28c71-5f58-4f33-bd79-c0450db8cec4", "value": "T153053368527DFD96533112E6000D648E006F6E0B2C77FDAD8EDF4023E22993D5E897EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472538, "uuid": "33db9723-d4d4-42fa-8a31-321b76164649", "value": "24576:6zHSN0dzFVMhSXqFJMg3SZSl5vUsysIv2EIoryrD:6q4zv4F+g2Zv2eWrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472538, "uuid": "2d603dfc-3e71-4bbc-9d78-0e45c795ea95", "value": 839768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472538, "uuid": "62e2320e-d1cc-41e5-847c-ca4251a2bf40", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472538, "uuid": "a3bb2035-1b15-4eaf-a0f6-a5890e38d3f5", "value": "\u4e2d\u9060\u6d77\u904b\u63d0\u55ae\u3001\u5546\u696d\u767c\u7968\u53ca\u88dd\u7bb1\u55ae.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc06542-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515439, "uuid": "3039a214-1960-4f52-9ff7-84f57c993203", "comment": "Malware payload (Mirai)", "value": "406ef3948c24b33f8eae0c49e0601595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515439, "uuid": "3fcfb7e9-128d-4a64-bf08-a5a7c81d8880", "comment": "Malware payload (Mirai)", "value": "123d73a4da77d00c1397cb1bd357b4cbe6529a23a1bdbce652fc8ada02746998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515439, "uuid": "2d9ad005-38a4-4d57-9b05-0557703763ed", "comment": "Malware payload (Mirai)", "value": "94359bb7ffc405649044fe5d041e6b2d48d5c8c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515439, "uuid": "14b3392e-29c0-4e0a-8533-8620f4c28f78", "comment": "Malware payload (Mirai)", "value": "c2d315c56a2614598a8d898755282e9f625b6598a70444a12a72dc50c101b633d42b04f2d3c4d3a052c6d25968a97407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515439, "uuid": "dd4bcf7f-fe6d-4199-bf96-6408e22298d1", "value": "T1D0D34B05B30D0A47D2A32EF43A3F2BE193EF9AC121E4E644655FEB899172D321589DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515439, "uuid": "313bf65f-5211-4ccf-871c-5db74ac7099a", "value": "1536:mFbLC6IaKHAJXAapXj/YIYAE4u56dz+kdXZzxiAqFFuZ1Yi5HyHZJsW+VGXDvAev:arArapTAIr3CkpZzxAFeYbZJuVGED2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515439, "uuid": "ad652475-3662-4ba3-84cc-47301b4ba18e", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515439, "uuid": "ee9c83e9-f512-4343-bb5b-440672abd16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515439, "uuid": "41a43b75-7085-4f94-b943-4d9c49169716", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adbc2ba-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516347, "uuid": "df507ddf-f4ef-4891-8262-3e9bb75951a5", "comment": "Malware payload (Mirai)", "value": "695635d70373954dab41cbf19b6cbe9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516347, "uuid": "ce3c6138-cc3d-454b-aac4-506e51f2fd08", "comment": "Malware payload (Mirai)", "value": "1287e67bf8f57a024b8c11a53fc157cad4aac2975fa5a269c022e4b280baf620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516347, "uuid": "9efcee38-5a4b-442d-840a-615014b3628f", "comment": "Malware payload (Mirai)", "value": "5c5d7c4b1156be62fae8c0a5b1e33c60a8ba1d6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516347, "uuid": "dc441a5e-9085-4a88-a792-25dd4585f90d", "comment": "Malware payload (Mirai)", "value": "14e6d9ed4c605b02ed4bea6b5f9aaa37b83da854316b5785a4fe2e190ce5bb4abc0f34e22328dcc0c2d83d05d7118497", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516347, "uuid": "cbdf8866-9113-4245-9a38-571796a44e18", "value": "T1CF932A5AFD818B21D5C502BAFA1E118E3313177CE2EE73129D146F21778B96B0E7B846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516347, "uuid": "797d3fd3-1cbc-4c53-9eab-473d346b62c7", "value": "1536:q5LnSeSuFQ9GEuC0BhMZVHsWLhs54L2a/LhkpVuUgil1i/8CL7KJY1oE:qceSuFQgBe0WVs6L2a/I1i/8CLmJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516347, "uuid": "997d5478-02b0-4d9c-abfb-4cd74d446525", "value": 91852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516347, "uuid": "0ce898f1-3f47-4629-ab9e-1ebb9ad229eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516347, "uuid": "d29f932c-765f-4802-a57f-d10407b8b4db", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc1a452-60c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505933, "uuid": "beb6647e-54bc-4ecf-b286-f671bb5691b6", "comment": "Malware payload (Mirai)", "value": "150841b2ff9ac5a53ef547823a903b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505933, "uuid": "e2b6b85d-ea67-43d2-8d76-7b16c5740deb", "comment": "Malware payload (Mirai)", "value": "12ad2a2fda890b419ac6f97d8bb6ec811d0e5573568905dc3bd7b64ac0416971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505933, "uuid": "d6b54ff6-e722-4988-867a-8601fe2d96aa", "comment": "Malware payload (Mirai)", "value": "3b8d82b14c08709cfaab980c919e6afd40267936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505933, "uuid": "a1109bda-bb29-4db5-b19d-290ae6ce62aa", "comment": "Malware payload (Mirai)", "value": "d55d93933f9c732fb1ff96b36a57de7070eed5b28aebb437785b5c874b6608c03b7c1632adfe94087f61a18ad1b9c6c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505933, "uuid": "8e03b786-c696-4280-8d0a-554e2a9187e5", "value": "T185632A51FD819A12C6D1227BFB5E828D772613A8E2EF73039D256F20378781B0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505933, "uuid": "90a7b4cb-be1d-4139-b58b-3560bb67d337", "value": "1536:NixMRl5fHEsm0qcoFWBeN7y4kv76HKOG0jHTbHIyS23W:NixWHEsulQBQ7ybWhPHhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505933, "uuid": "a5086504-add4-4cce-8752-de2c7acc59c2", "value": 72900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505933, "uuid": "477bbd9c-5a94-4f2a-b9e8-63e3443d5063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505933, "uuid": "2c7f36d0-f8ad-449f-a98f-c50532dd585f", "value": "larm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d473d8b8-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752482701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482701, "uuid": "b4d0e77b-7b7f-4e52-b3e4-a2baae69f967", "comment": "Malware payload", "value": "5184a73894e4473f755afed3de01fd41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482701, "uuid": "b022b258-284d-4bf1-a0b4-88ba2c3691df", "comment": "Malware payload", "value": "12b8b7a66458729697c01f5b3233605bfdec635b6261f240f78c2012afd8204b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482701, "uuid": "006baa1b-ceb7-4ba0-a142-fa7b6c1baaff", "comment": "Malware payload", "value": "7602c5ef25a6406783cff3742ff77e6877a94b01", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482701, "uuid": "44ecfb88-67f4-4d1f-b826-1eccc04916fc", "comment": "Malware payload", "value": "1563b1fb5b9cd168833c6db5a9f1a1fd55f57d65469080a4def0e2039d2b1ee05f403da0fbcc0b08dab74881a39c51dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482701, "uuid": "8a7ec982-a6fb-4e28-80be-ea50d37a3797", "value": "T129F0B4C8053520361AC7DA4B23228894F354D054EAA74DBC8DCCF9D5E89AC60243CA7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482701, "uuid": "56a8e0e6-e536-404d-90a2-729e5f536b74", "value": "6:lOnFflE0FSiMxIiMBviMuiMbAocbnMAMQrAgiPcbZusYGD5MAMulmAC5Mu8:v0FOIBTNnr2DGD5N7Q5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482701, "uuid": "6895757e-214d-4497-9678-6259dbc5aeb8", "value": 528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482701, "uuid": "544f4c48-6e78-40d0-8582-8e4d4949af51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482701, "uuid": "ab9ce27f-cf6e-4af4-af36-4bc0274d1c2d", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8796838d-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479995, "uuid": "dc031467-93ca-41e8-8ca4-23979fb3ab36", "comment": "Malware payload (Mirai)", "value": "a9c7ecbaabdd6f2aa08e5fa70d3808ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479995, "uuid": "ca5fbd42-bd1c-46e1-92d5-e5c641155cc6", "comment": "Malware payload (Mirai)", "value": "12fce44ba88e9672d23df2758518408678ca730990b315de6d09d40c56c5945d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479995, "uuid": "c2b9c980-58e5-4610-b84a-cefbea5cb872", "comment": "Malware payload (Mirai)", "value": "581bc8cbd2a4422cd4b7737a98f2856cde5aa1a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479995, "uuid": "e8b0200b-abc1-49f5-94c2-2f403e2ac291", "comment": "Malware payload (Mirai)", "value": "35eff7593eccaa46306c22555e24dff7f0edf90786786c00b0354edf0f4a343d24906a5a0921404e70659a9521811303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479995, "uuid": "5ba5e596-798a-4788-a86f-ef18339ce2f7", "value": "T1299339D7B401DDBEF80EDB7744530A07B270E3A209831F36635BB967AD761985823E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479995, "uuid": "78f94b52-f71a-41d6-9e01-e130213fb9d5", "value": "1536:OpXNgceO8sQH9L2IDG5hxz8F6hrZe8D0h7Nyb+NYnH2urjzCN0o5OX6eVSw:SxQdbgs6hrZeh3YH2sA5OX6rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479995, "uuid": "b0aa8330-dc0c-4e08-b589-b88071fd7cf0", "value": 89736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479995, "uuid": "5489f6d8-c51a-4495-8de2-2c4f6c1c3987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479995, "uuid": "28fc7092-f385-4b1c-8e57-f11bb390c05a", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feabdad-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513080, "uuid": "ca2d3f87-10b2-4c1f-9d53-2e8c6b669fcb", "comment": "Malware payload (Mirai)", "value": "dfb0a25f2bb5634f368b344142ccc914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513080, "uuid": "495c8f30-cdec-4aba-8413-875d29a8c822", "comment": "Malware payload (Mirai)", "value": "135fc9bdecc3c8ed082afcaa01c9fb013b2c2701cf08928542005e2c19b3f346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513080, "uuid": "40eb4ce5-4de3-4bc5-8ff3-f094f5ba0807", "comment": "Malware payload (Mirai)", "value": "b05acbc9166fb2e19df8d8318c5abd635226685e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513080, "uuid": "79417233-d1b0-417b-8ad3-c8dcd154305b", "comment": "Malware payload (Mirai)", "value": "06175239470cefa16930752998a08d37474acf92bf451afc3570eecb1beffe31a987a30748690008e8e726700204f96f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513080, "uuid": "f10dd3d2-9a86-43b6-b48a-3adeb259c9b6", "value": "T10703E166CA3CDD0CE3A46239924F6A5995E66C80900525B9FE471FE7C0F27BD017ECC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513080, "uuid": "958b3777-e840-41f8-a024-8ba1ea25539a", "value": "768:WxtRpO08xnUNe7hbWji/Id1Dy8MEiRC2svLIr3eMuxYW/Qjzp:Wxw08xUNGeMIPDHAC2mL23TuxFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513080, "uuid": "0380ac11-cf11-450c-bc1a-29295ec49589", "value": 38292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513080, "uuid": "7eb6419f-8889-4df3-9e98-300f243f294e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513080, "uuid": "fd024a32-8a81-4a8f-83be-2f59a777f252", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82713f44-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485140, "uuid": "012d9bc8-7379-44fc-9881-f9dcab72451e", "comment": "Malware payload (Mirai)", "value": "19541179df56f9e0a26f7296bf68f589", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485140, "uuid": "67ddb397-d223-4465-bb41-0af0d510650d", "comment": "Malware payload (Mirai)", "value": "1371b26e6fe2fc7e2e3cb3161a02d5e5507e95f0fa8e3eeeb8741443f2bc0a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485140, "uuid": "e2a01811-c9ca-4dbb-b28d-15e67939fae8", "comment": "Malware payload (Mirai)", "value": "f0799f5dd72b786a369709a62d887fab3e26353c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485140, "uuid": "bfef85f9-3497-4fa9-81f3-f66724b3fb25", "comment": "Malware payload (Mirai)", "value": "133abe5cc6fd36051c372c7a13c8f315ed141b52ff6065476f875319e5df71487b8a43288ebae159a025897386befd6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485140, "uuid": "a0c28b95-d3b4-44d4-9b35-874865b18c1a", "value": "T1A383285AF9814B11D4C512BAFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485140, "uuid": "3e05f564-262d-4d3c-983f-196bfc7b3c01", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYt8:BVE+2dmTEZCSHYMactW4Bi9gnS4V08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485140, "uuid": "df8b67b3-d66d-4fbc-9634-456dd824f945", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485140, "uuid": "7647a2bb-7447-4385-a172-0761191cc1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485140, "uuid": "07e3c47e-9a61-4f04-86c6-5ea40aa8fd6a", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d259bd28-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752482697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482697, "uuid": "c3564b91-5e25-4b77-b326-5d0955321616", "comment": "Malware payload", "value": "e6f821b367646e0d7bcddcfb68152d06", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482697, "uuid": "7c2a037b-4589-4428-9369-af41d50505ed", "comment": "Malware payload", "value": "138ce950bab5650b6810b8ed93c3c7782986db9a9993126993dc781fda2341af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482697, "uuid": "d4303364-3671-4e17-9fe2-07d2732d6905", "comment": "Malware payload", "value": "005d595bf06945b56ed0a7508a0ee7214f914c09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482697, "uuid": "294a0bd7-928e-4d67-b675-0832464cfd6b", "comment": "Malware payload", "value": "bc584a8ddbc130a91d81e5a9ecda69f3c1eae9223df1333441f4afa3e86227b050f8949e714ca59028e3ef3fcfeb127a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482697, "uuid": "0d837b4a-4f0a-46f8-b7d2-369ef1ca7ef7", "value": "T1C3516CC61263CB363C61D4BA71A6003CF084E59955CE7E12FBE878FCD28DD08B1A9A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482697, "uuid": "71ed5e93-e6ae-4a37-bee5-cfe99418682a", "value": "12:q0F8J8cPFKX0FJZXBxCMFKX0FXi+pYFKX0FQOeFKX0F5LDHJFKX0F5iB8FsFKX0P:vKJ9XCWXxEal572fTynYoEk0fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482697, "uuid": "d3f09159-d8e1-449a-ba14-567c2b915a24", "value": 2483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482697, "uuid": "66f2a07f-5150-43b5-be1a-387955f3fdab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482697, "uuid": "6b7b51f5-6ac6-47ab-acab-e7d141731628", "value": "0x83911d24Fx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab11f3ce-60f0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752524722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752524722, "uuid": "d0071347-29a5-4579-b253-379c5543ce92", "comment": "Malware payload (XWorm)", "value": "0b1b71de20b103f41d614a8f989e6be4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752524722, "uuid": "1fae823e-ec64-43d1-b3ea-6346a22156c6", "comment": "Malware payload (XWorm)", "value": "13a0b8475d70549e63cc395d03f72c45b685d0a0727b4f98410f3193e93faaf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752524722, "uuid": "815b1414-f48a-4387-86d4-8086479fdd63", "comment": "Malware payload (XWorm)", "value": "de88e8daa93539577568873b073c570fa99978c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752524722, "uuid": "16e7f7c5-7d41-4b6e-83a1-a2a4a9a31ee2", "comment": "Malware payload (XWorm)", "value": "4741d3fd92975d62b6e54a3709577685ffddc74c44759514b8ff2caf81545fdb9b1ae3bf8726915934cf0453e0ea0107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752524722, "uuid": "9e4425e4-7bc2-4018-bdfd-c20abc3a94c5", "value": "T133D4010025A8DF02C5BE07F60922D5B013FA5EAEA011E3175FD6BCEF3576B851942B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752524722, "uuid": "d541c660-101e-47f2-a459-c8a919199876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752524722, "uuid": "68de9db6-08f1-4415-a97e-c59e0c7eaef5", "value": "12288:BfrqL//3plPROW9dLmvLritJ9ZbTGzbGVllby7DGoLHCjxe9Bn3eQU7:drqLH5lPfv2mxbTGbWlxy2o7C1e9B3eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752524722, "uuid": "3067a815-9411-49c0-ab90-9985690981ec", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752524722, "uuid": "bd0a49e9-62ef-4fe0-87a3-e84cef3ff1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752524722, "uuid": "3ea870a4-387a-4df0-8862-bc236554f98e", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfc502e-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478284, "uuid": "e78886fd-216d-4cff-b1ae-f85b3211c4a1", "comment": "Malware payload (Mirai)", "value": "18a41c5f6fe539b93c429e7d15b26de5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478284, "uuid": "c83790d8-9088-4404-85c9-c057ac5f41d0", "comment": "Malware payload (Mirai)", "value": "13b26bd2af5910c9c23beb4f8557155a1ed4637c090f250d329843d8a52660a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478284, "uuid": "7e7c28ba-d5d5-40d1-b249-e05500e7064a", "comment": "Malware payload (Mirai)", "value": "e616202ff0da180d84d27c9262ee06e06e28ab4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478284, "uuid": "2d272eac-9234-4cbc-831e-1a75e60c9d13", "comment": "Malware payload (Mirai)", "value": "8143f8f4caba90afa99eb83db514daacc09572157ef151bb2d7610261f1053ed8e7f58a2cdc07f8d43bf26bb3c6a7c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478284, "uuid": "71659f71-43ed-4c1f-9997-44c13ac3b1ad", "value": "T139F32B46EA408A17C4D6277ABADF42453323A764D7DB33069928BFF43F8679E0E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478284, "uuid": "9c894797-ffe9-4616-950d-87cf6897efa5", "value": "3072:AX0ZuZ3Lzh5bIE2aaxE5/+kC9zmMK0/xJJDM3pu5M/9WXz/+:AEYBv/E1aaxE5/+kOzmMzJhM3poM/9W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478284, "uuid": "45410a68-d6eb-445c-8247-cc91c655e0c4", "value": 159775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478284, "uuid": "68136ab0-e647-4b3a-b626-70aac1d3534e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478284, "uuid": "3c1fbbfa-97a5-46c5-90af-e08756245229", "value": "bolubotnetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad583fc-60b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752500616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500616, "uuid": "bbc4e987-7eb7-4b92-af55-3994d5904a73", "comment": "Malware payload", "value": "03ac7af39765515c5b07bda816526f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500616, "uuid": "5d5bc0d6-61a3-425a-aaa1-ebb538d3ac12", "comment": "Malware payload", "value": "1443aa8eb3d98835dfd612eaf6951dfd656f75e7f5f7bbb94ab016ac0badc544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500616, "uuid": "7b298e82-3901-4a69-825b-5d5ed798dfd1", "comment": "Malware payload", "value": "cedb2876cf621ebc037582ac5e4b4e8f3288ab87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500616, "uuid": "33fb067a-85d2-4e71-b483-e3c258ec4221", "comment": "Malware payload", "value": "752f21e0dd6f79a4a8e6f3646f1bb1db964695c49de3e28fb2a31fb7e5ef7f796af4b81930b17cbb20c5c125a2e52d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500616, "uuid": "a442f812-6f0c-4b09-96ef-e072a7bd0b4f", "value": "T141184906770A8E5AE012A43044CA8F9173A6DC71EA71635B3F553F796FFE1089DB2E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500616, "uuid": "59b8558f-ec47-473d-87a4-fa5baf65633c", "value": "f50aa1dfd7723d95926559101f0ad1b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500616, "uuid": "ff16b58d-7c77-4b1e-99e8-590bac71c20e", "value": "786432:Gxd7Vfp1uVS+w13S2xbRDIQ6phvCAVCGCHn:GxXBUweQ6phqAVCjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500616, "uuid": "e3aa7d22-85f3-40be-ad03-494cb804ea6b", "value": 85663279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500616, "uuid": "c14a8c32-ac6f-450c-808d-6786354be476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500616, "uuid": "497e980a-5ae2-4f85-9284-1764164ccce9", "value": "bii.736885001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd7c974-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485076, "uuid": "4f123b4e-053e-4cbf-bb6d-2842aaeec069", "comment": "Malware payload (Mirai)", "value": "942b0be4dcca1be4d85c19685d695376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485076, "uuid": "81f95e52-68fe-4c4e-94a1-b4c95a709ca7", "comment": "Malware payload (Mirai)", "value": "14a8f9c324dd331559022b235c7eb3df93cde3259ef9753d7c8444f2dc2a5a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485076, "uuid": "3bfaaf7b-4c6d-4d1a-8c61-5e2c02311c40", "comment": "Malware payload (Mirai)", "value": "3d0f215a946e552625bd12d5828f5ccea15805d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485076, "uuid": "a2b17f00-7964-4437-8055-6eb83939e6ea", "comment": "Malware payload (Mirai)", "value": "6ce89bf7e36552b92c4e7875f0f5b22220be2b970eb7bad1c6269a3e291d4cacc4d8eca036c5170ae3c419162e651051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485076, "uuid": "3b1dcb70-e7b1-45ef-a4e7-715353d5ac72", "value": "T13A52D0E91FF92736C158E770C1B48359B1829EF5B94B832B1C0B213121D3E6BF906EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485076, "uuid": "b56b4940-3d88-466b-8710-86fd9fe5ed4f", "value": "384:5qxAewbsSj053WiWa9p4ifFf+jF2M9hapZ0OcQN4Q:5UAkU053WizpNF2jFD9kzN4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485076, "uuid": "3f8a7db3-bc45-489e-9c5e-be3fd950aebb", "value": 14012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485076, "uuid": "23d6f638-1f48-4635-92b4-fcdce2776c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485076, "uuid": "59ada9ab-44e8-41aa-ad3e-03389b205506", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e21359c-60e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518634, "uuid": "455c1a6e-5955-4765-9bfd-ce7999fc07ef", "comment": "Malware payload (Mirai)", "value": "6238280e2454c8fdf727a2a5678e0936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518634, "uuid": "f39db417-f455-45c5-94a2-353743515497", "comment": "Malware payload (Mirai)", "value": "14c6ecf6182d1d314c1f504f359197fd29ab830b995bb8559d1ce072074501f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518634, "uuid": "568a9486-8901-49d0-9bcd-75cbbe8a7d95", "comment": "Malware payload (Mirai)", "value": "7262cd0605fa21d536afe6d3d612085badf18bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518634, "uuid": "c41ac51c-ac92-4607-9c40-04de27b73352", "comment": "Malware payload (Mirai)", "value": "eec5c6d4fcdcc1ab6c62b72bac124f22126febb3beef6ece07e546e1f2e6977fcaf2939a4fae5fe15f7af59c9a73a93d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518634, "uuid": "78ca8546-99ab-4576-82ee-32270a9e49e4", "value": "T15C04AA1D6E228F6DF768833447F78E21A75923D623E1D684E2ACC1105F6429E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518634, "uuid": "78bae3ec-923b-4e2e-9f37-0d9ad638872d", "value": "3072:JkjtlaA7xpt8DlNT2nqrq8lyXuT834EBkT4Ww6:JkDaATmDlNan8cj3lkMWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518634, "uuid": "a6ac3799-5e4e-4113-95c9-6748a97a51b0", "value": 179404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518634, "uuid": "1911041b-9b09-4980-a01c-78fc4f53d6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518634, "uuid": "e90f5886-ae51-435a-86f8-a8be654911c9", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bd4686-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752503940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503940, "uuid": "afe3abf2-8bba-4455-afbc-577a3577e683", "comment": "Malware payload (Mirai)", "value": "26d0706b44af1fee4d8a7c8f7f56a162", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503940, "uuid": "a9462776-2901-47b5-8537-4bfb2dba431c", "comment": "Malware payload (Mirai)", "value": "14d0ca32d0303208c5658da66022e5c8b294e228b3413023bc47eb5dfe1675fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503940, "uuid": "04165e1f-a8ea-40cd-99d5-602337df3f62", "comment": "Malware payload (Mirai)", "value": "0674da9c53721f2621aae6d0ac7fc0fd8966e327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503940, "uuid": "3cd8f8e3-439c-4694-ad5b-cb52127b3b88", "comment": "Malware payload (Mirai)", "value": "3465e14f46060cb72c9c0f62536f59a1ca0c0951a3873c3699918ecde304c5ab0f4f6d9ff33541b2af2bf56ecf96f5dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503940, "uuid": "e69ed845-c528-4168-a2e7-e68c4a8df909", "value": "T14043D8466E219FEDF56C863047F74B21A7A973D623F19A85E29CC5001F6038D582FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503940, "uuid": "9766cdee-f3fd-4470-8829-8e17d065f4ad", "value": "768:77WKmuD8vUmYtYy1v6ecvLV+wfy2I7500TXnloyWlI3G:77WKm+8smxecvhm0YV38GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503940, "uuid": "c1be49cc-b669-410c-9a0a-1965eda50a1d", "value": 59684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503940, "uuid": "77c237b4-ff73-41eb-8756-048436a30f1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503940, "uuid": "ec618309-82af-4e2d-b29d-f1007b92b86d", "value": "proxy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e1a472-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516280, "uuid": "147a43a1-33f2-4a71-ab9c-7a702563cc9d", "comment": "Malware payload (Mirai)", "value": "0bb44eea3f5bae70e04f30280591209d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516280, "uuid": "e2047801-fd71-456b-a4be-d554c9e9a1cd", "comment": "Malware payload (Mirai)", "value": "14ee8dac8148d57fccb5f6d05dfb445642281c123d8cdf0c07b9dc8474fdd3d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516280, "uuid": "50c154a7-19cc-4dea-a1ed-5d34eb5951de", "comment": "Malware payload (Mirai)", "value": "6b89606d3e40982b7df79942f97c214a7b882ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516280, "uuid": "0ffc1dc6-2774-4aba-8f52-93c8b16499e4", "comment": "Malware payload (Mirai)", "value": "d6a076731699e386405d9f911e971ae6309b421ad5408ef6b7a56e04fd1149e35ada7051709849fe46615789851a4250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516280, "uuid": "5375f3dd-ea0c-47ef-ac28-502a9bc9a9ed", "value": "T152648433991584A1E0214CB2122777569C47C7BF88E726E3EE5A5DB0FF3141B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516280, "uuid": "7bfeb4fa-92b4-4a32-8a2e-70b24c6cdd23", "value": "3072:ZI/WgC23UPqclZz/Pj3Xo0bZ++KwjoSYCkxtlPW:ZI/RaqaZTjBolwjoTCwPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516280, "uuid": "21aa4fce-1241-4379-99e1-90e7254411ab", "value": 330057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516280, "uuid": "20488cc3-88b3-4f7d-a70d-5431fdab8d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516280, "uuid": "52d00f3f-966a-47a4-a12e-a25710b02ffa", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465ea40e-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503937, "uuid": "7ff88987-0a15-4f94-b9f8-78101e492ec8", "comment": "Malware payload", "value": "37f06445236f547de89afa5c818ef044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503937, "uuid": "2356dba2-d8d8-47d7-b994-1e94deb62bfd", "comment": "Malware payload", "value": "15c775f24830c904a9f1077ca74cc5086ec05a06fd881f6fb4ffae69201baba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503937, "uuid": "3fd9cb9c-760e-4f73-a34b-57c1ea444ef3", "comment": "Malware payload", "value": "600fd5b7a5f1e551deda8eba08b9e5de432ebdec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503937, "uuid": "bfbc030d-419f-453d-98fd-36b7c1ba0aa4", "comment": "Malware payload", "value": "69518caed0c63cf197af6efa647ad218725f7310c4b402cecd79c83ae46df2f9903c115383575e053868fa6eb615d43c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503937, "uuid": "95bd08cd-5086-4d1d-ade3-6c869190a5f1", "value": "T18A4308D7F800E9B6F80DE73B48934A06B270F3A10A921B767757352AEC7A1954436FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503937, "uuid": "572f4553-8316-4978-ad88-fd94316ad5f1", "value": "1536:e+7A8OayrRslBsYuJnfjJ9Pi+zGoBVOV+mk:n7nyrRsnfi7i+z7UV+mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503937, "uuid": "1213f966-50ae-4753-8062-205747bac1e8", "value": 58524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503937, "uuid": "d4eeee0f-47e5-4c9d-9ecd-1c367a68b0a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503937, "uuid": "d2584f1e-3f4e-4e18-b7a9-c45248ec3d2f", "value": "proxy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bbf473-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485062, "uuid": "4e3ead47-ecea-4d36-89eb-05a7c76bbf50", "comment": "Malware payload (Mirai)", "value": "5899f836dc7c69633f699a95fbef4e89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485062, "uuid": "b9eaeea6-c92c-4f16-9a0d-6d808c1cb828", "comment": "Malware payload (Mirai)", "value": "15d719084d89c32ba4484d8c8eafee83bb7b57e822a8b5c99464283aa0d362c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485062, "uuid": "c49d37b0-19e3-477a-9c17-b42f78c37a75", "comment": "Malware payload (Mirai)", "value": "810c5501bcfb886e828ecbf0cd1f262a5dd21072", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485062, "uuid": "8d8034df-cb6d-43a6-8d9b-317b970352b1", "comment": "Malware payload (Mirai)", "value": "c77d0685ecd9f9df8bebad14dbb08ba3ff4abb8cb8a6ec457250431ab6a196d620734ff32c0e580ee42c2ba45e5d599d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485062, "uuid": "71a054c6-d3e1-45a1-bb8d-7ae352b99ec7", "value": "T109030217E49AACC1D85884F1DB53408236926BE4F8FA72937340C9A5DCEA8E734F4E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485062, "uuid": "d9025331-89c3-4054-942c-db1605e41c19", "value": "768:RWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5BB6W7a9q3UELyD:RWXasPGxplekBgTP654QwGx6IL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485062, "uuid": "921ec355-8e5a-4e23-922d-a0e715ea121a", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485062, "uuid": "58ac742f-8914-413e-b456-36105c9718f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485062, "uuid": "be921be9-9ee1-41b1-87a4-5f8856712d53", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70bb261-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493362, "uuid": "4d2d219a-0bb1-424d-b5a3-a7a8be18ce08", "comment": "Malware payload (Mirai)", "value": "b19893840a023bc8a082e8a6c9d39392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493362, "uuid": "edebeee9-c93a-4b6b-94b2-59f4bef7e084", "comment": "Malware payload (Mirai)", "value": "171b414f639ad1f9c310313f002942b1ebb4372f57b893f6979177bef9cd2300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493362, "uuid": "7db7a2d7-2e73-4c51-8787-5d2d33de183f", "comment": "Malware payload (Mirai)", "value": "10590cb0230b272710b45bc0df0865bb869858d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493362, "uuid": "a6d9d0c9-8a78-493a-a971-82b11c149941", "comment": "Malware payload (Mirai)", "value": "bf569d90c383105663e23adf2d6d75f66357a6962d207369c4be729d9e7c50b575ce5c26142d7120f4501e5e2c622307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493362, "uuid": "de4bca27-fae6-41b7-a758-2cce60caaa1c", "value": "T11E03E14A94A0B01BC51F1C3E534901FE25A0B1D6759A7F7B5369CCC9AF3794BA4CC8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493362, "uuid": "4f956407-e5a4-4dbc-ab30-ff5852a572f1", "value": "768:tF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0MjrbrfWV:zl5JnsrXvrKy9QjyBZLvDmR0cvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493362, "uuid": "815a48cd-e8c4-4465-844e-0deaf36358cb", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493362, "uuid": "0d73eb5c-e827-460d-8d53-b3cf5a05163c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493362, "uuid": "96259110-ceb9-4428-80b6-f9d6825ccbd3", "value": "SecuriteInfo.com.Linux.Siggen.9999.6198.9599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c956eb8-60c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752507760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507760, "uuid": "e73c6732-7a17-4a3f-adc3-bbd8a7221006", "comment": "Malware payload (Mirai)", "value": "1439df6f6c599e9f5a7cce8837f2156a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507760, "uuid": "eb4023ea-9dd4-4528-a24d-7811dd13ca06", "comment": "Malware payload (Mirai)", "value": "173e34b48cdc3d12ddc6c2bbcaa41b26620bf10d59cbcc8d18ac8a7c986f6cdd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507760, "uuid": "e29cd70e-1ca9-4535-bac6-4a3d5f9b8400", "comment": "Malware payload (Mirai)", "value": "154a69e370cde2a5d946b970f02239cbe25e308c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507760, "uuid": "17ef747e-f214-4327-9515-842dabcf88a3", "comment": "Malware payload (Mirai)", "value": "04426b0c86c6e85d39323e70bb45a88119980cfd35e8c99c15fa3757a34074bdce0ce3f3170e075bd5995e7a3f5999bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507760, "uuid": "22d5e510-b812-4d21-a36e-60b3ed0266a7", "value": "T1A63118D63C917FB20696EF50B17285AD9407E5E110404E28B4DE14BADFBED48F232A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507760, "uuid": "eb6dab2b-b55c-4337-ae68-aff2ebbb7122", "value": "24:GIbZJ7Qs+qKX/+1BBqKXxXY2dcpnAbKXPezyRp/YQqKXw:jLhN9nwwI2denAbYKyb/YQqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752507760, "uuid": "f73f5215-049b-4581-8cd1-3259d7a5ea57", "value": 1652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752507760, "uuid": "cb9d3c21-0259-4df0-894c-adeb2b052bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507760, "uuid": "e9e1a098-3d8e-429a-b044-866d8baf6491", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2ab7e5-609b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752488160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752488160, "uuid": "7c462369-192c-42be-b2a2-f5a19a55540e", "comment": "Malware payload", "value": "a1e4833e42630d5179d9a8787303b0ef", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752488160, "uuid": "bf4ea86b-733d-47bd-b37e-85b6f8df702a", "comment": "Malware payload", "value": "18c35508ec0469b2fd151a09c2823a4ed0bb84479afd3472f906d49faf800c52", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752488160, "uuid": "1c4806ec-03bd-41bd-b19b-8c8c2891ffb0", "comment": "Malware payload", "value": "076f48ab2faae5625e534a713d219a26c41933bf", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752488160, "uuid": "b0096a2f-3a57-48ee-b60d-3295d3df2afb", "comment": "Malware payload", "value": "097307c4c412f29cc0692142b6cd5774c247470bfc530195d390d9594ccb1ab6f50ad8ea6a86a7dc8472c5e18cb18006", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752488160, "uuid": "4901f6f6-013a-42fc-a782-8814aa1619e7", "value": "T10018084ABB00CDD6E50651F558A7BB9033FEFC614AE1C30331D52B2DAEAE18D4EA7494", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752488160, "uuid": "cd57872e-74a6-4f96-82ca-c253f41f85f9", "value": "e27f56b7f7f6a0ba38d1b7aa3bfe53ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752488160, "uuid": "488b3f11-8d83-40da-9c72-5e2018bfbe48", "value": "393216:ToY9Z5V2RsHHmc0UurqVI2qt06+PUY4p7H0JwAr:pP5VW6m6um2C67YoH0Jtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752488160, "uuid": "135087e8-b76e-4783-ac7b-25e4250409c7", "value": 87910503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752488160, "uuid": "d1e98fe7-8d37-46a2-8f69-ef1fcf07bba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752488160, "uuid": "d23d393e-1f67-4f03-9740-bef43890fb7c", "value": "bii.736881001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8c50cc-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1752515705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515705, "uuid": "77485053-c70c-4099-a781-fc6aa0d37344", "comment": "Malware payload (Socks5Systemz)", "value": "d0cde56a7b1a6d25ef1ad3806d594be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515705, "uuid": "af3aa9a4-729d-4d8d-b412-8ccbbe5bdcd8", "comment": "Malware payload (Socks5Systemz)", "value": "18f50141e4c38550d51a76c58b1a726e4210901123f1de21a6036f70f45cd17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515705, "uuid": "70a7f4a8-6d84-484d-a091-31a18c02cba2", "comment": "Malware payload (Socks5Systemz)", "value": "ba3ea4f915aed7573d16d08b9b2d560ceb29ed66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515705, "uuid": "d0aab4fe-ce6b-4594-b239-baffcd674ea8", "comment": "Malware payload (Socks5Systemz)", "value": "f3446f45043b47658766861552765bc6dac3b367f39e9a00f4b06d218f52dc80996fcc81e5a7b863085c89c0a505b09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515705, "uuid": "63cf0656-797a-4e05-aa02-a975ba23dd9a", "value": "T106063317C61194BDE0A71BFB95C29047633F36CA09371E9F275A2ABD3B3A101B5A23D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515705, "uuid": "fadda5f3-88ec-4cac-bd6c-0139cbf3f5a4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515705, "uuid": "19d73f55-ad2f-4c43-8d62-f81bd40e84a0", "value": "98304:N5DmdfqW9B7ON9wOqwQRDXC930Wbt0D17xzg3pwxttxf1:T6xqWLKHXpQR8h+JBYefnf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515705, "uuid": "d8e7971d-fb83-4fa3-88b4-11d81be032dd", "value": 4006257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515705, "uuid": "d8ddb51a-6510-43ab-8ce8-98fd66cbd6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515705, "uuid": "45441ec9-2b08-4727-ba6c-bfffe0c914f0", "value": "m6e1EcxLtiOuhQsbv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93469924-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513086, "uuid": "e056e186-15be-4f70-b407-278eabe4a29e", "comment": "Malware payload (Mirai)", "value": "1c740729e8965e18267687febf6c00a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513086, "uuid": "1a4a74d0-1719-4b4c-81e6-6265f99627c1", "comment": "Malware payload (Mirai)", "value": "18fe9f54341466d090b233957733b73aeb9ec9f12a34353c364e8457fba8a375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513086, "uuid": "85d02c4d-86dc-440a-affc-77c8293e1091", "comment": "Malware payload (Mirai)", "value": "1378e3da5ec53667818409adf81a601e2941d848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513086, "uuid": "57f1f679-7ddf-4f89-aa6c-3dd5a2d058ee", "comment": "Malware payload (Mirai)", "value": "d5c9b6357d65f6838cf9337bbcdf35027caf9f85e07ff7f8d95000252db43ed0340d24228ce82d5f87b0955ef8be0013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513086, "uuid": "9e79b44c-2db2-4dde-9f80-478b6dd9a625", "value": "T18C03E16832D4C812CE5B447154F62F7B5C3B9E87CD6AF3512A80A18F60BF5F61834B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513086, "uuid": "e4af8d9d-65eb-4fd6-bd02-09e3234940d5", "value": "768:5/Q680S7BIYT5Wt3QfkbQxRtP2OSmC9I1o6ilXKp:W68jFbFWt3QfkbQxSOIxhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513086, "uuid": "70dc3ed3-dbb1-425f-8924-104830af0747", "value": 38852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513086, "uuid": "62f3d86f-d27a-41b4-800e-a020b992d5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513086, "uuid": "170d2e0e-b401-43b7-b600-38d3e0871703", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8861e474-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513927, "uuid": "3ab84c13-60d7-4142-9df1-4e266248cba8", "comment": "Malware payload (Mirai)", "value": "62a973d9948edc5cd56423c94b4e889f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513927, "uuid": "f17a93da-2560-4643-9be2-8a0539495aae", "comment": "Malware payload (Mirai)", "value": "19666d70443489cdd06db4e82124323cab4d3946cbe5f888175cb852d24eb6bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513927, "uuid": "1d4f74e0-7621-4407-b363-bfdc4946b515", "comment": "Malware payload (Mirai)", "value": "488be41b318913d27edb80bdd426047a2bd78f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513927, "uuid": "00b0cc13-8868-4978-b145-3294375b379c", "comment": "Malware payload (Mirai)", "value": "97911538c1fa1097806f2f775bf3a6e78637f5f26584d3af8c933ad48fb000ac5a3e986232ceffcc010baa3adcc988b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513927, "uuid": "a1b4cbc8-f763-4480-ac03-e6274ce28fe6", "value": "T16F835A22FA75092BC8C4A57762F34376F2F6438B20A8961F7D610E9DBF6460032977B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513927, "uuid": "d798eba2-f3ce-4f66-a9a7-1af0c8e822f2", "value": "1536:8PHQB/LXWKRub5RjyQmnXh5BtnsNT57q0U72GtQkm+:8wEUv9sNNrt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513927, "uuid": "8d1e4e6a-3ebc-4b36-a8ec-b1a392abf2f9", "value": 85104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513927, "uuid": "a25f0464-c210-454d-b600-dc1f92b3acf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513927, "uuid": "0c8c3d5c-8172-495c-8574-439650346ac7", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471e8b9b-607a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473874, "uuid": "8efa3f1a-9859-4b3a-855c-76650063b565", "comment": "Malware payload", "value": "93a1b3a4c84ef5c2441215109ccf3d51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473874, "uuid": "7fd8dbb7-22fb-4fba-9ac4-f7c27e339f3d", "comment": "Malware payload", "value": "199ec44a16c6b4ff55cd8cc13eb7a5450be69c8d71ef62215bcfffc824609242", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473874, "uuid": "2e974b98-e468-49a5-a8fc-525f3f2d9549", "comment": "Malware payload", "value": "c335c5521af7f8d7a2d78b484d2e0cf129342493", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473874, "uuid": "ce27695f-e5a0-49f2-9f86-3f9c8151de1e", "comment": "Malware payload", "value": "a0e3fd06f852ed27917537ac3495597713831089c6f45c02341bde918481cae8cf674b6cbdcb9ab565120744494b7eed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473874, "uuid": "52609ff2-42b2-4f89-800a-f5cfac7650aa", "value": "T15A118BCF1A62D860CC646DD936920814F08DD6E431CB8E8CA2CD5031D4DDE08B592F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473874, "uuid": "36e7d76b-1c72-4c78-bf70-68c3694340f1", "value": "24:sEUSIbK5zOt+MB0heZ1hkrjUkrspsmkrGhkrErk1:sEUXK5CEA0sZnkUkOkmkik1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473874, "uuid": "40369c71-fdab-4169-adbd-a773f0434ef1", "value": 1079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473874, "uuid": "533b03d4-a575-4770-aea4-57b2a7b48344", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473874, "uuid": "5a83ffca-dcb0-45ef-9c78-6497c2da913b", "value": "asus.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1278acb4-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505139, "uuid": "5fea87ca-c9b9-46f5-a812-7f3e9e04b076", "comment": "Malware payload", "value": "ae145cbf5d32793b15e7879aa1feb0bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505139, "uuid": "065d6220-4ab7-4d41-99fe-ef7d8c6acb2f", "comment": "Malware payload", "value": "19d3c744cc719470bff9a818ed01b7b36a0d403ccd6cceb95c20e88be674576b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505139, "uuid": "43b165e0-e0b3-49a2-b410-7d8cf139cc77", "comment": "Malware payload", "value": "0287d6d31810073b44f46e3b8a85b951be56a949", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505139, "uuid": "12514163-2497-4a70-8b1f-08001779fcf7", "comment": "Malware payload", "value": "f7903bc0952d9dee84303def6df570da710bde1c36bc4502285772c525d6c8948f9bb51e3b5d817d1af3f1584d82e89a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505139, "uuid": "c7682714-320e-4fef-8357-ed2256f24bd6", "value": "T1C621D7BF4614F8F06F82C4A1FA631F2A9D9090E70C825914E6A8E5675C9C95C7534EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505139, "uuid": "8cadf2e0-7c28-4e9a-a179-4c9dfcec4640", "value": "24:ZL19p9Jr9XO9A9l9L6soN8qSsoN8qyN8qXXpN8qWvN8q/Nr:x19p959+9A9l9L6L8qSL8qe8qnb8qWFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505139, "uuid": "1275a877-7dba-48a7-9999-120d625f9b3a", "value": 1162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505139, "uuid": "79aae543-a5ed-4d91-8acd-503d8eaebc21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505139, "uuid": "81418f7a-e94b-40cc-b827-f5c54488c1f3", "value": "toto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918be01a-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494185, "uuid": "79ba1504-aae1-442a-b9b3-3fb15068a797", "comment": "Malware payload", "value": "2b3d9e92009b226130f53cebc5822e4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494185, "uuid": "539750a8-0c6b-4ce4-9ffc-f0f2259eb00d", "comment": "Malware payload", "value": "19f84ec4abcd274f6f5f6f1c8633bee0ac68caa0b5213c9fd44b3fe8f31c02e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494185, "uuid": "e77f55b8-5056-492e-aef4-fe093778d835", "comment": "Malware payload", "value": "6339e4d6d10e33ed88184cb8aa97a96f786bdbe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494185, "uuid": "318fa54f-f05f-496f-8955-d974d6d3c883", "comment": "Malware payload", "value": "db376770e731514b98ca1bafc70088e9b84c042be9129aab05fda475a763683be9f2f31a2f200c031d44226b56c33988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494185, "uuid": "402687f7-1439-42be-9a71-1df9bf4e41b0", "value": "T164B402018F881F87C5AFCD750A2E167311AEDD9F46CAA43E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494185, "uuid": "1441da00-3cfa-4114-a48a-1aa5885f4bd9", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494185, "uuid": "593ffb51-648b-495c-9412-c62334cd6338", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494185, "uuid": "f1f258b9-43c5-41ea-81c5-4daef7ceedfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494185, "uuid": "713a936e-e8a6-44ab-accc-4f2921e31afa", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f9351a-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503935, "uuid": "db7078d1-6ef4-4fcf-9f1a-df542c202e7c", "comment": "Malware payload", "value": "6016d82e3b85ac2a719233ef3050b29e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503935, "uuid": "5153160d-d131-4692-ae22-765d7abfdcdb", "comment": "Malware payload", "value": "1b3e8ef68f05d890d4217a664489f34ef88864490c712dfbe3af7e5d86af3f2d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503935, "uuid": "8268672a-5912-4bc3-9157-58b1ce8c4544", "comment": "Malware payload", "value": "31458b3e093f5f6ed9c3353e73730e74ed0f881d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503935, "uuid": "280ac809-abd2-4daf-903d-3ce3d54b013a", "comment": "Malware payload", "value": "38939175265742f48a3187de9745476da1ed527be22368b4b6f9f0703b40ffc6e76b706e6f0b06990b54253b1567480b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503935, "uuid": "9fb2d5ba-0f2c-43fe-ac4a-2480924ad0e5", "value": "T1E2112EFDF0D53006DBFC8D91E076C749B884E9EB63604722D256A4F9ACCD2246155396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503935, "uuid": "97c17500-0ba2-4e66-b3aa-6905f57d89ed", "value": "12:3J3lTLKlTL/thlTLTNIb7lTLgUK1SlTLLNlTLISlTLxlTLVfSlTLtC5lTLelTLjR:3J3lyNzNI19K0boKj1CM2tPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503935, "uuid": "bc1a4d2f-928b-42f3-9fe2-f1aaa5cc826c", "value": 862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503935, "uuid": "2fce2021-a09c-4019-8b47-8b6e2a8f58b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503935, "uuid": "a4eabf9e-5797-4dfc-bc04-567077d1b280", "value": "cproxy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829ac769-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514776, "uuid": "7f011cf7-42fa-4b1f-91bf-4b29173b6e94", "comment": "Malware payload", "value": "014e10bf98e990fb8d69c698b53edf8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514776, "uuid": "463d7493-00d6-460b-84d8-ab96eb438a76", "comment": "Malware payload", "value": "1b42caebacbc8b37687c3fbbab3d7ac4ed31fc99d55b8d08c975e0223deeb3dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514776, "uuid": "94692416-ccb9-43e1-80a0-f1a7750076da", "comment": "Malware payload", "value": "0f0e49416b594144dd4d786a2b6bfde6251d7ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514776, "uuid": "7917a5d2-d513-4b9f-b427-b7ed767edb41", "comment": "Malware payload", "value": "0694f0fd6dfe4e9229bca8e4148f620796f80c468691d92eaafa4d65ff9b5f43e08464811134eb86510df983f36b4d1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514776, "uuid": "37b8e764-0869-4090-86a7-00e8a0d363f1", "value": "T15DB402018F881F87C5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514776, "uuid": "52b71f04-0778-423a-b3b0-cf85af971e4e", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514776, "uuid": "fc2cc1c7-8982-4bc1-a5ce-e3df1148dcd5", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514776, "uuid": "f7864519-90f2-4a4e-aa82-66a29d84687b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514776, "uuid": "9d1141a8-fc44-4a59-a42c-6020fffa62ff", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1791183d-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752517173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517173, "uuid": "af574e5a-752e-4520-9b68-751bb273da85", "comment": "Malware payload (Mirai)", "value": "5461a855a346c5c39ee8dd15a7ac811c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517173, "uuid": "cd816f7a-75c8-4e75-a61a-b24d156f0893", "comment": "Malware payload (Mirai)", "value": "1b52c0cdfd57c95a4f876f6e745d8b86e9cba903526cc5eac9f430970c3f5c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517173, "uuid": "098c9c75-1792-43c6-8328-07f67e2bb3ab", "comment": "Malware payload (Mirai)", "value": "69df2a7b6d1c11c5af1781bf5406a9dfd085ccb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517173, "uuid": "1e7c592e-a4ed-4920-90ee-3b4fc1c322be", "comment": "Malware payload (Mirai)", "value": "1c306c4aaef857f8e80b2b2ac1ea53410345bc915bb0839a5b7355943746aeb6262a4901bc1aee12e770d32c3583b926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517173, "uuid": "b04504e1-c72b-4208-9773-8cf75c45348c", "value": "T192D2D0786B0249D7CBAAA1B84EE50B262D60CFE3E1426C077558D9D7BB0986C3CA5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517173, "uuid": "44a563b8-4bde-4d33-885a-911cf218e14c", "value": "768:E4ylAtv6pqLJM0RXaxGyUbXtheU/SlKe9IJgGlzDpbuR1Jp:XMBqTRXa+Zhr/VtVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517173, "uuid": "dd234196-e45a-4b6f-97b4-6d0bced86bd2", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517173, "uuid": "f1b24b43-a2ee-4f3e-9d31-93a9399ebddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517173, "uuid": "d81368ce-c1c4-449b-85f0-5a92ff88e785", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8282a6e-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517470, "uuid": "2981a528-b993-41d6-aab9-230897904d93", "comment": "Malware payload", "value": "9ef441999d44cf68dcb070c543b07cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517470, "uuid": "fb55253e-b390-4c14-a24d-8333d0b5c54f", "comment": "Malware payload", "value": "1b5ec00bed966e0fb14965aaf6f473db7a3b847b3905956ac5214f1f88017f56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517470, "uuid": "ed22c7ca-2be8-429e-8b45-3529a76fbcc1", "comment": "Malware payload", "value": "043fd4fc8e62c66e9c3cbe210668fff2c6e5b3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517470, "uuid": "13f15483-0cf9-4e68-ace1-b10750de56e6", "comment": "Malware payload", "value": "268ed49fa90c7676be20fa8d2aebc9b27a87219af425953c0845a25cd3a8b46500d6a2d6d39e1be698bfb784f5060101", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517470, "uuid": "546ca43f-740c-4446-ae4d-c4f73534d860", "value": "T12FB41228EE4E3891F3D1E3B8DA0A4BB1B05B7DD0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517470, "uuid": "67831ee6-1239-420b-bc72-2d35bac3f259", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517470, "uuid": "1ffad79d-3401-4fa8-bfe1-eab96309cf50", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517470, "uuid": "ae626a83-43bf-451d-851e-1476a0887167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517470, "uuid": "f6cad56a-bf35-4514-80ca-32b8b2bcc006", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b3e66a-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503686, "uuid": "4eaf7595-c71c-4925-8de8-3ce3711e5de8", "comment": "Malware payload (Gafgyt)", "value": "b2713b74e90ff4f73ad680428c322acf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503686, "uuid": "cc5c07a5-3aa4-481c-bca9-9fda37785070", "comment": "Malware payload (Gafgyt)", "value": "1bd124c969cdebe728fb87a151794720c7fe59d131641bbe8a0b9bb6fcccc5f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503686, "uuid": "c09b9643-9d40-4bf3-aa66-5650d3c577fb", "comment": "Malware payload (Gafgyt)", "value": "d1a7ee1813dc7fcc245acfed2c38e0c689a24739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503686, "uuid": "d81bf96b-4965-43f1-8946-769fa83156d6", "comment": "Malware payload (Gafgyt)", "value": "24d277fb0330aa9aa2497f955662f72205bcdb34b2a529a1a4bf2b9e5d5ffe28ec3297512c238418f8d85c3b5b8ae88e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503686, "uuid": "77b7fd8c-a8e9-49eb-9c71-d387bbb4cd7e", "value": "T14B9309A2B950971AC9C3063BB70E838976D703DDD6EB7203871FDF2526865A71E7B900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503686, "uuid": "917c5495-66d2-413e-a66a-327c5b125d76", "value": "1536:OpQnAYcYBisAFY6aLkFiU1SgevWZhC4ce0yOoRvUVT3vRM:ZqY9AFJEkF/AWlzvavu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503686, "uuid": "3526be7f-7d8a-4cd5-bb8f-fd1554cfe902", "value": 91700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503686, "uuid": "d8ab3bc8-e2ba-4553-a917-1b46f0319908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503686, "uuid": "264f421b-f255-46b5-97ab-4ea13e5fe5ff", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e55aece-60f5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (FatalRAT)", "timestamp": 1752526821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526821, "uuid": "5dbd0efd-a2e3-4c3a-a0b4-5a06fd5a6ebd", "comment": "Malware payload (FatalRAT)", "value": "5009c9f812e1dc51616d958d2f950957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526821, "uuid": "33de87bb-00c6-4078-9d32-a1a1d0b5ec50", "comment": "Malware payload (FatalRAT)", "value": "1bd8c74021c24b91c13a04df4530661abffa93afdce275c496e5db9ff0554890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526821, "uuid": "27d11eaf-44b8-44da-918f-e98c6fed9a6d", "comment": "Malware payload (FatalRAT)", "value": "5be0eda7871d21a35bf39963a712c725cf4495f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526821, "uuid": "616e4007-8324-485c-bf6b-198961bb4a04", "comment": "Malware payload (FatalRAT)", "value": "efa72168e3374242b0569e48813bc970636de823c0639e67974bec6e41eca97271aa5f5b44da7494265de278cd29e1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526821, "uuid": "ebb741cc-5c57-4167-b73f-2784783bcefd", "value": "T12414AE4628964779DCCD02B1E13D9A6C119E49E0AA31F8EE572E686B47313D7F1E3307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526821, "uuid": "726e2f66-5490-4fa2-bb86-7828de3eb159", "value": "6c306e45fa9f977a2f45c8a08df084d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526821, "uuid": "9c618f8e-8716-4f9d-8fcc-d33c7b12cb73", "value": "3072:T1ltd5LZseWDzoPZ6WS6BLfvgaSlpcD+05f:NSzkPDNGEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752526821, "uuid": "9257c374-6230-4f5f-a228-015d542cfd91", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752526821, "uuid": "95e7a06a-e4ac-4099-a3d8-6882f16c7aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526821, "uuid": "aad1d980-3664-47b1-a8e8-1fcfcae957b3", "value": "5009c9f812e1dc51616d958d2f950957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4cb28f-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752477827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477827, "uuid": "c7578d25-c663-4295-864c-73afa522b56e", "comment": "Malware payload (VIPKeylogger)", "value": "81d57bd3149a390d984b014b0b4386d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477827, "uuid": "07fedaa4-fd1c-4dcd-a28a-66b035ef2d95", "comment": "Malware payload (VIPKeylogger)", "value": "1c9bc77909f0ebbeaa08f268879a9bedae04acd60cea71166294494201295c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477827, "uuid": "8e8f1e0b-2860-42b5-80ea-4fc1bf6e328a", "comment": "Malware payload (VIPKeylogger)", "value": "4e0026257bd6c5f7f05ab583825df3a8d9575ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477827, "uuid": "baf2acbd-5080-4e8e-85ca-732215fe6166", "comment": "Malware payload (VIPKeylogger)", "value": "9e2be5348083ab9c41ca7d05327d1f50cb60cf61499026b355abb6dad2e45b7354728231e487aeea88c326941f1e8408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477827, "uuid": "0537969e-72fd-4d68-a223-adca8a240947", "value": "T157D49EE2F98198AAC41721B6A87ED911215BBD8F8A31C7163347BB2FA4F33531157E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477827, "uuid": "680e2b88-414d-41c0-8c2f-ef13d6f0d5bc", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477827, "uuid": "e66db5d3-7be9-415f-9c65-4623379f8674", "value": "12288:rfVLewHbAIawpWGPjiXbwtXLzzXTmqAUUDl4z4vLJQmy7s:rfVLewHbjVnPIMJzcUtOFJy7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477827, "uuid": "8fcf2d7b-6183-4de1-b383-2ea5657d9cad", "value": 628137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477827, "uuid": "04635e95-38a4-41ae-bad6-c2c323a2ae8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477827, "uuid": "98aa7d28-5ca2-4470-86a0-e1ab024513d3", "value": "FACTURA 01_25(FNZ25070447).xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51b49f4-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517948, "uuid": "d737ff4d-954e-49ad-acc8-3f1a1b87faa6", "comment": "Malware payload", "value": "ce8351d4d0fe8cc38a5ef7a012d819e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517948, "uuid": "3b74aa19-5651-4646-8954-15aa10d8cace", "comment": "Malware payload", "value": "1cdce73001af3b75d5e7455104352a1b14c280d6e3e0d17187e467517d2d4ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517948, "uuid": "92ceffdf-aa5d-49c5-b93d-58075aac0cc1", "comment": "Malware payload", "value": "26b9fc3f83ee8d692ec1ef76a404ccb081edf39d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517948, "uuid": "a435ca45-2c7c-471c-8947-91097292ee9a", "comment": "Malware payload", "value": "c335dbba4601d991b517945e77f7f346f44a7e87119e335c524b5bc23bc55361fbef53827e9532ca9afcb2d67e1a14cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517948, "uuid": "993add53-2004-4d1c-8c27-5c4f656b5849", "value": "T11466D0217D06402BD8330273D96AE67DF23D6E741F2909CB62C8797EA67E6C13A3111B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517948, "uuid": "08379e7f-5287-4448-9040-c976e3430c25", "value": "07c58608873abb7e0ae2b8f825a25c90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517948, "uuid": "9b644195-4b86-4b3c-b75b-dfa2ace46539", "value": "196608:QdkxAntWR1/PjTgaaSPvxsuH8OojDIg9Cbk/VD7zg4s3Eu:p1XKSqVDpNQEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517948, "uuid": "66ad5724-99da-4c7a-9e65-301ed7051b57", "value": 6963384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517948, "uuid": "78451186-91d1-4fe8-8848-fd606723e984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517948, "uuid": "3df70f45-41b5-478a-b015-dc736b7211e2", "value": "Adobe Acrobat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db05dd3-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518177, "uuid": "d4d4b691-d73a-4913-b17c-e5d2ff86d479", "comment": "Malware payload (Mirai)", "value": "9886aad4511f6be25c873d9af700c1ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518177, "uuid": "452a43ad-a07f-4a60-83bd-fe082c42f565", "comment": "Malware payload (Mirai)", "value": "1d033cfbd944038b57b1a681f2bbf249a451babc18ea2588132350e2fa30c076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518177, "uuid": "6ef154f4-0d31-4a80-8b95-87cde312934e", "comment": "Malware payload (Mirai)", "value": "f095761a08f2b1f7e18a31e184d4664c87d14c02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518177, "uuid": "18250bbd-03e2-4c45-9fc3-0ab473c14112", "comment": "Malware payload (Mirai)", "value": "f9a02de8dd38d1afbc71b101cf61fc74d48ca814ab5a2723be149faa0d41d6153c664bdf58ec92f386437d50daf694a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518177, "uuid": "619a7051-95e8-416c-9274-14307b2ca918", "value": "T132A3D709BF610FB7E8ABDC3B0AE91B0128DD595721A83F757674D424F24B24B25E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518177, "uuid": "6631040d-b7ac-46bf-a907-8fbec0bb33eb", "value": "1536:n0N/1HVhW/gW/Fzl2yV8gjqDC3NHSgOTKekKBbpZ87eOkjIV7+a1UQohU:0N91h3GzNjKppsA4LBoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518177, "uuid": "e134c75a-292d-4c9e-815e-c551412a5b0f", "value": 103404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518177, "uuid": "193e7591-efd6-4d4b-9285-c259f8b7a917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518177, "uuid": "3a4576a6-d706-4435-9f0c-de2f17dcd040", "value": "top1miku.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd462e8-608a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1752480677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480677, "uuid": "2f80d2f3-a068-4193-8017-e7aaeca3e921", "comment": "Malware payload (GuLoader)", "value": "7f8da44562d7cdc0bcb9dfed1c376594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480677, "uuid": "055c471c-d291-4d24-b165-ef7748a87443", "comment": "Malware payload (GuLoader)", "value": "1df2eb5451cbca9fe862e3ef482587ee1234d13487c3443557eb1b5f8262185f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480677, "uuid": "2a600b46-7320-4be7-ada0-3eeaaff8b5be", "comment": "Malware payload (GuLoader)", "value": "88594cda8267e303cd8f6ef040da6322ef9b0b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480677, "uuid": "15aa16c9-330a-4d1f-be6d-cd63857bf11b", "comment": "Malware payload (GuLoader)", "value": "73a227a8c10c06c402c17a725915a2d39ef920bc0316e1b15f660a7f703134838478b83cdb1ff822fc3c3ab3377a95bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480677, "uuid": "36f7fd75-44c6-41df-b730-b1a7e459340c", "value": "T17D552232F3314196C47A9E7DACD7E2F82E7D9EB4896430AB1398B50A5DF32854474B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480677, "uuid": "3999f64c-195f-47f7-ba2d-13bafa4b41f1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480677, "uuid": "1e61ef02-c72b-4444-b51e-821dc2269fcb", "value": "24576:qG67M0mui6AFTSh7xrLiMAImfh8dznvVI794vH63uTJeN/gu3:NrHuNA0h4emfqafulC/X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480677, "uuid": "a2a3c5d2-7f60-42fb-afd5-9f1225bd38a8", "value": 1367648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480677, "uuid": "d20945e4-d13d-43bd-8365-20921c6157ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480677, "uuid": "3141a29f-ed1f-47cd-a8a4-da98a9b92cb0", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df17913-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505131, "uuid": "70716cdd-758b-4dfb-8560-057ade8f3007", "comment": "Malware payload", "value": "db763863b2aeae17c21ef887bf15f751", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505131, "uuid": "bc054219-08ee-4f2a-a5ba-4f38d65f0f31", "comment": "Malware payload", "value": "1ef570f1fb25c3c4a9d7ab7c65dc57cfae09ba0af93e129679286206088f100d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505131, "uuid": "a8cafbab-4dc6-4b88-b1bf-e3f218c8323a", "comment": "Malware payload", "value": "a9de3686f1b89179129bce9dc40658bebecd59ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505131, "uuid": "b666ef82-c33e-4822-9218-5eb058afca14", "comment": "Malware payload", "value": "244950ad08a4295ef29f334212e409ef1ec82b8f5e846e406a72e94f5eb1a882da628dc488f5bf722abc0f7e322d27b0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505131, "uuid": "6139f018-b35a-4a23-810c-ebd62452eb37", "value": "T186F0659296447871F8CFB0A3BA47CB4E457151D70C139830F848D57CDC84C78ACA1F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505131, "uuid": "50055fca-cab8-4035-8e6a-1731c3b96a34", "value": "6:L6FTWXtzNI5ymDoSuFXyIjOmDoSuFXyZ2fOmDoSuFXyhjI4OmDoSuFXyrTyPtOmk:wuswmMSfmMS02mMS9umMSfhmMSfcmMSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505131, "uuid": "e88ffa74-4819-4fa3-a0ce-5c3e3d977d63", "value": 447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505131, "uuid": "2fd9a239-9291-4dbe-89b7-6a8594cfb7d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505131, "uuid": "c3d0cfd4-beec-4a61-a459-cac5849d9c42", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d007f6-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493125, "uuid": "133d27e8-a196-46ec-be3d-ab2c8d9fb779", "comment": "Malware payload (Mirai)", "value": "6e5e62b5f6d3dbee6a4d0598c8eb0206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493125, "uuid": "752c15ed-b166-4a40-9de9-b8a41df9e658", "comment": "Malware payload (Mirai)", "value": "1f7072ebad1c250291f017280a187391b0d68c3794922704358f9d1be61ad5c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493125, "uuid": "80ab42df-b8b7-4a1d-a5fe-e5d32379ed37", "comment": "Malware payload (Mirai)", "value": "dca2f99d053624ac7628008ed0e45be2c3fe7a95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493125, "uuid": "787f9cd8-542e-4e39-80f9-31016eee7a5b", "comment": "Malware payload (Mirai)", "value": "70ed35b89d1166fb0ffba81d2b8cbdc976b28cff87e3b05b811492c8b2b7431d4b5622cf23241948c7620efda3147f0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493125, "uuid": "cef648d5-769a-4106-aa83-db5cacba55f1", "value": "T18B84763799159A69E1248CB213B73B519D4746FB88E222D3EA2E8954BF3041F51BFFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493125, "uuid": "35ccef39-f282-4366-b313-e5ad4cd6c5f3", "value": "6144:MZk4PLzKaDtwwjoG7uW/mrjhTJfjUHcMNb:Mrpwwjt7uW/mrjhTJfjUHcMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493125, "uuid": "e08601f5-7e9d-4749-89ff-61290b2dc2a2", "value": 390453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493125, "uuid": "8cf50f54-30fc-471f-8a2e-51c15eeb130e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493125, "uuid": "dbea9d80-aa02-4b34-b310-c99b5ce53946", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e10823-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752514775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514775, "uuid": "7d3e2690-4559-4269-a4bc-9b44377d981d", "comment": "Malware payload (Gafgyt)", "value": "133019ccec0e1cd6bd2f40f35129d475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514775, "uuid": "c2a80c7b-64e9-4e47-8614-b2d8be2bdc3e", "comment": "Malware payload (Gafgyt)", "value": "1f88c46bfabb6799f443e31d8591e443c09a5475552231fc95891eec2e4c93d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514775, "uuid": "4834caff-0b6e-48c7-9f3a-554245a9b48a", "comment": "Malware payload (Gafgyt)", "value": "8e7b2452951ac4de047f126494b4b2e32ab667f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514775, "uuid": "619cfd25-b2e1-4525-aa8e-a7947f31a8e6", "comment": "Malware payload (Gafgyt)", "value": "d9bc148188612e8ad7b7cbadc22fd4abcfdcc1b4eded16a4e9d98f825b523144e39f3fc7a03888df8bc15c52c428fe9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514775, "uuid": "cfcf31d5-713e-4e98-b9ff-046dddbc5333", "value": "T12A34D80F6D616FBCF79C863447A74E34824827911BE2C6B5D1DCD510AE2074EA85FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514775, "uuid": "42a405c3-77be-46f3-b906-8d4e30885d9a", "value": "3072:w6tTw5/tTbo2oDZL9Bn3hxA2FUXokytveZo:vk/o2oB9Bn3h24Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514775, "uuid": "c7468c0a-26e2-434c-ad8a-6a2ec1ed1b85", "value": 247524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514775, "uuid": "e2a18830-0b15-41d4-83fa-abc6ed085cbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514775, "uuid": "e9ff2e40-acd2-4b0d-988f-72424e56d1eb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1123eefc-60bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752502130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502130, "uuid": "34541e6e-0d15-48b9-b242-38539a12485b", "comment": "Malware payload (LummaStealer)", "value": "d1694f98d915c80d41f9675067696814", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502130, "uuid": "4f102fcf-5a75-48f1-a67f-079e85696aef", "comment": "Malware payload (LummaStealer)", "value": "2004d3e7f11bfb1d20ef2f5a710a1a6ee5b2fe2f3269a81beae3ad98528b50fc", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502130, "uuid": "6075b521-c63d-4b96-a8c7-df7b94ec6372", "comment": "Malware payload (LummaStealer)", "value": "9583688b8088bf1781191f9f597c6fbf3f64afc0", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502130, "uuid": "2aae3613-2443-4a36-af46-744865a17184", "comment": "Malware payload (LummaStealer)", "value": "d23d427ede75cf8031b369d261ca881eac065b361e78b89fa8d83a6fe347e4930a332d54517e0f6aeb9d5b1ef85bde2b", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502130, "uuid": "1e1381e1-5222-4f9f-ba12-4da85e66b377", "value": "T1622533D79F54181FD553BE7988FB5E327CEAB13228F51AF3134009943921BA98B89393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502130, "uuid": "f7c317db-3a84-4dd6-8428-e951c19b4237", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502130, "uuid": "886f9e78-76ae-4eae-86d4-d3ffda9ecf65", "value": "24576:90aw4VaEsoXVZ7C0CtXS3NelAVp7V5NYn0T3iv2Fl:9tsdoXVYHZ0elAVL5NaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752502130, "uuid": "599e8bea-43dd-49d1-a45f-248cb71851b5", "value": 1047979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752502130, "uuid": "c343ba02-e741-48f9-a347-77b74ab69307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502130, "uuid": "810a83a7-4958-447e-a37f-69ad6e917e98", "value": "\ud83d\udd24 \ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59a9e27-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752503695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503695, "uuid": "06a433b8-7712-436e-a90b-e515dbc94805", "comment": "Malware payload (Mirai)", "value": "b0b085441c61bac6f0322fe4efda600d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503695, "uuid": "c099488c-5907-47b2-8e7d-9d14a9ae8e76", "comment": "Malware payload (Mirai)", "value": "203bf52be02e4b3ddd196a3fcfda32e4b583cad64a397a34ef3ef4148433c887", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503695, "uuid": "3d1b510e-a815-4b84-a5e5-5c44ed0bf8ec", "comment": "Malware payload (Mirai)", "value": "39bd7cd74d3bdc2af43c00085102f1b6d14bdf4a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503695, "uuid": "e11f5ee4-75ea-42c2-9e43-7415b933970e", "comment": "Malware payload (Mirai)", "value": "a48586b0ee1551d9900ae5811363e7c7574db7aee6fdb7d360f2d4ffc55eac47bbd16ec4c090c1f892d0db6569b9e7ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503695, "uuid": "e0164063-0860-463c-8ea1-5a3dd81e6a20", "value": "T16941D1E432D985B43C95DABA72F88125F2E478E9F4C4BE28C8EDB7F46C4DD081452792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503695, "uuid": "0c22a430-95c7-4a05-a022-efa885ebc58b", "value": "24:vHrXE45UE4rJyUE4wQzE4wVvE4wKNO+E4wL7E4eI2E440dE4JE4wC7E4rmfEb:vL045j4rA4o4b4aR4d4eI4c4y4a4Vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503695, "uuid": "53f76826-a164-49d7-a5b1-387a8f75dd06", "value": 2274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503695, "uuid": "7bc1315a-c335-4c53-bf0e-adfa79184d53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503695, "uuid": "c2a20a0b-df96-4312-a194-655a5b4a15b7", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2509afd6-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494003, "uuid": "2bb660ae-bc48-4b48-8cec-f8649cd86f62", "comment": "Malware payload (Mirai)", "value": "f7d8cdb2ab9a75b5415d6606f0f0dd11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494003, "uuid": "fe53e2b5-956b-4cff-9155-61d543cf8fae", "comment": "Malware payload (Mirai)", "value": "20b016b36d9ae9708d0fd49ce013c5f32dc1b58eaef34c290f473faee2eac2da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494003, "uuid": "58ca823d-bcf4-4a2e-b039-b2563a2c6f8b", "comment": "Malware payload (Mirai)", "value": "57a43d374b69e4376c0600baa7a77b5a01328113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494003, "uuid": "cae43ba8-ca2c-49a0-a4c9-f135301b030f", "comment": "Malware payload (Mirai)", "value": "73f4b1d06f6779d3abd299a8621335266fb934715bbcab630affb4dff500b43e4b670b965807fb805e85f99580e3aed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494003, "uuid": "58df4bba-861b-410f-b8bf-ef833f7d6693", "value": "T119E32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494003, "uuid": "6f62cd1c-d70d-4e5f-82a1-416e8c3fc8fb", "value": "3072:FYvMxqixyDJAmUzdBJXu9WRtotmLFQTihvqX0clM/9h4b/kP:yvMxqixyDJAmUzUSotmLFui0X0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494003, "uuid": "15a2a7d2-7073-4232-88b5-8cffe5cc7585", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494003, "uuid": "d630e9f4-6c0c-49bc-82ef-4a49df785ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494003, "uuid": "685b5482-a344-428d-a8c8-958f00d579d6", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f91ade7-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514771, "uuid": "7bdbd5f7-881a-4c5f-801a-4c591432ed3b", "comment": "Malware payload (Mirai)", "value": "e9b94803feb7e821566acd3f27942284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514771, "uuid": "50d1945f-d735-4ec5-a85e-6ddaba5828fb", "comment": "Malware payload (Mirai)", "value": "20d495f5167c748ecb2314ce3aff26de467d61a819fb573924ebf7b63821adaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514771, "uuid": "af96b31c-88b2-4e59-8207-c30a8465cc8d", "comment": "Malware payload (Mirai)", "value": "58e2dfe09d97e8f9ee7150a397b4f01be661f7d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514771, "uuid": "f0f03518-1ac8-4cfd-926c-6f2bd79a17dd", "comment": "Malware payload (Mirai)", "value": "c5cfcbddfce77bc358999d14bc1abc8902c242c5874c2daa3bc3c95b4335a122c6980608635e964ca6c66aea6cc87a00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514771, "uuid": "3da3e335-064e-4059-bac4-5eaab57fb951", "value": "T1AE13F1A066281C15CD4754B3E47B258D653B5DFAD0FD30891120DA3877DFD913A65CCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514771, "uuid": "63051d24-46a1-417d-a9ea-e6877a129637", "value": "768:rXiLMCO5zsupmOEy8aSaHhRe9UaLxP8dxD2hpwDA5jp0XCn9q3UELOO:P5zs8q9xP8z2haDANp0XLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514771, "uuid": "365c218d-aa5f-457d-96f3-f80efaecf128", "value": 42296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514771, "uuid": "e39f56bc-dd2e-4aae-9096-14718fc818cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514771, "uuid": "4aca3dd2-a7f6-48d6-8cae-1bd82a41c3e2", "value": "top1miku.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f05f26e-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752473458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473458, "uuid": "dde705f7-b0f1-4e15-af24-3619956bb769", "comment": "Malware payload (AgentTesla)", "value": "371b0d85c0ddd11bb4eeb2858e8af24e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473458, "uuid": "7cd7aace-0f48-481d-8ddd-1c85e1a17357", "comment": "Malware payload (AgentTesla)", "value": "20dcca71c02969d6c0c964e35fbacd22af83bd73f6da14657d1bbc9b7154e147", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473458, "uuid": "3ec23053-7e5e-4f3c-86fb-006e4a8910d6", "comment": "Malware payload (AgentTesla)", "value": "3d72cc20676e09bb977c1d43f4a49d15013ee01c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473458, "uuid": "2dc75ac4-30c0-4a93-bceb-37a2d9c654e4", "comment": "Malware payload (AgentTesla)", "value": "457cccc8b5ccde2067d573fdca472cb0106836909511d06b7d0907460ff075e34c5bd7ac10fef2cdc2eda1b1675289bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473458, "uuid": "632f2279-9e46-40c2-8a67-4178bd910957", "value": "T16D11599EC43AF36585A8C30ACAA5F32ADE438F1FC511F4BF2964957850190E4C0D80CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473458, "uuid": "446d8f6f-4b01-460c-a70e-bb8a61999b05", "value": "12:M9tk0IjgDtMMyseazHlFH+qrHDZAkhUThqS36bNlHivl8kqCJ7F6M1tB3rTWO2/o:AtkayseazlhAkokSSNlHY+CFT1vf+mT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473458, "uuid": "912881c6-be61-4359-a200-2aa3813cf03f", "value": 925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473458, "uuid": "2c7e0bfd-6e70-4bc3-9de2-7f8eedc4e3e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473458, "uuid": "10e9f80b-7012-4152-90bc-0838344af87b", "value": "PO-1364-1 for ID MAT 15500 CMH -30 HP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f9d41f-6093-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752484821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484821, "uuid": "602e5847-99e0-4108-a8db-0f7cdfbec020", "comment": "Malware payload", "value": "7383c8e5f8c86984e4030e5c31cb3592", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484821, "uuid": "45f573be-818f-40ef-9fdf-3aa7a5d3f843", "comment": "Malware payload", "value": "20fac811c65a511373fa261a0863998f5ce691b02c91a15be6f8e8e8d510d3dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484821, "uuid": "7c42f870-4209-47fa-92b2-fda1019330fd", "comment": "Malware payload", "value": "3432fcaa8f42b0fe024f33f7f81aea11749b5f14", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484821, "uuid": "7fe00a7a-2f2f-47cf-8a67-2ed9ae558949", "comment": "Malware payload", "value": "ea09faf27a0e554202c47e90c56ccaf88af12a8a1a9f970d21ca93ec0e1e28be9cdbd08550789f79858a8e5ef3e6d05c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484821, "uuid": "3e76c344-5371-4f86-87bc-eed876b74be4", "value": "T1B0E2E826785582F03A8E8CE9AB49F8C62709F10E89C4B135B0BDDF0C37E167461B4F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484821, "uuid": "a40fb876-bdb0-4ab2-b7ea-a6ce29ce47e7", "value": "768:iIXIJKcfKa+9KqeV5CmHn8luvJAZ6s38VSvKY1Jt:yPfKa+9KPV5CmHn8luvJAZ6se2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752484821, "uuid": "c649ffee-ecaa-4481-9060-fd8527fe1a87", "value": 33011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752484821, "uuid": "b2db2c24-9d71-4cda-b7c6-d11a618031f0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484821, "uuid": "38c72c09-dbba-4e0c-8f8a-2d55386b7f0f", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2ffa3e-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752518359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518359, "uuid": "1b08af3d-fc5c-4924-9314-58d2f1a05b1b", "comment": "Malware payload", "value": "29f240001edc6d1c8018dcd13f0fbee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518359, "uuid": "e9ae05eb-cfa1-42b4-a8a8-b5b5a8521065", "comment": "Malware payload", "value": "211fd7cb810014bcea33770d08054df31d63cb4aa76703a5caa43aa1cfcdc4c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518359, "uuid": "f2d9ab65-a8f3-4256-b8c6-711f88ec44d9", "comment": "Malware payload", "value": "6408fb16fe71dfc2c0ab85684d7ee8091b81652d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518359, "uuid": "555b21b6-3808-42ad-af7d-0e5ac5e550b4", "comment": "Malware payload", "value": "467ddcc84dc1ef783f3347a80a583a730ecd575d0190040fefe0455db7c9c7f73c398fa363f501d8e891fb1c1b17d66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518359, "uuid": "fa100e52-a672-43f8-b5cd-ae6e82ff3921", "value": "T18BA6330E9431CA8CE85B723C9D90613E82422F4AC4E85EFAD89F957AC937FC5195BF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518359, "uuid": "9ec01164-4fc5-4af2-9059-85a25790d68d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518359, "uuid": "1910369d-8ee4-486d-a35e-ebda8178e326", "value": "196608:5clSOyNoIF9f1IhffewjFuMrBZLgsBxs08qKjqADrx:5cZyPJSpewTrBXxssvADF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518359, "uuid": "63b47781-e747-4e09-bda2-ba90f905491f", "value": 9979904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518359, "uuid": "4e211a12-fd2b-4fa0-9b63-b189d2fbca93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518359, "uuid": "d0f3891a-d980-404b-ba90-a6297ebb8acb", "value": "Installer_v539_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a3de3b-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752495695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495695, "uuid": "1f4de08f-6d04-4515-a795-76dcf8ef4de3", "comment": "Malware payload", "value": "53ca9c0252592a533b07b2096fe1f710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495695, "uuid": "9df59521-58cf-4e6a-a49b-f55df6f0c660", "comment": "Malware payload", "value": "2125c8510d50f9392fc2409952105853349aed0b2362df5ca53eec12b235e5b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495695, "uuid": "201d0c4c-f6bf-4987-9abf-2b9585cda27a", "comment": "Malware payload", "value": "9ed82dadc47df9e81854f97da18aa5ae9d4a6a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495695, "uuid": "d2bc80b5-a5e0-4788-94a9-4f03d69780de", "comment": "Malware payload", "value": "45d54c5b4149dc04383d8d770104b9915a37dff9b2b3ed582492e33976b348f7b58ae703156dbfef918c654ebec6eb81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495695, "uuid": "c5581470-5266-4454-b9bb-b18b5abfb55b", "value": "T189E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495695, "uuid": "b7d72980-0c92-47a8-b8e3-9fa63703a10b", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495695, "uuid": "623c6983-61d3-4198-b993-e05fcd1744b9", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495695, "uuid": "d14df18d-2242-4184-a2fd-5fff77fdb3eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495695, "uuid": "41933328-4cbc-4ad8-8f1b-e76fb6ef29f5", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5061f611-60b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752500518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500518, "uuid": "2bcad1a6-a76f-426a-bd0e-71fe5b0d5f17", "comment": "Malware payload", "value": "bc6785544aa4d89b82441bbcd870df76", "object_relation": "md5", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500518, "uuid": "0e889761-8d51-4dd4-b529-05b1565656aa", "comment": "Malware payload", "value": "22197b5715174c24e9657235c860721e8e6fa8c1545472c232f2a7ff1c5740bd", "object_relation": "sha256", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500518, "uuid": "0a825542-2121-459c-b5bd-5565774c5bf9", "comment": "Malware payload", "value": "678cd6d3983a415df1a05af3d1346115550b617c", "object_relation": "sha1", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500518, "uuid": "46d595f9-3d08-42ee-b6d2-0e4432e86b2d", "comment": "Malware payload", "value": "d2208cf6cca33054d5bfe02aa6141d926973ea227d5a5beea9f2884472e26f4c72c7b911c5045676c6cf8dedd6d9764b", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500518, "uuid": "d88ba43e-3391-4d63-b5d2-351cd8e158c3", "value": "T121D523944EC26EEE4F7CC728A4FB1A1D1BB0CEC6C066A58ADB13B905DF6ED01570649C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500518, "uuid": "92a0e4f3-c978-4d5f-ba70-763fa7289240", "value": "49152:tdXvsZ1ZrSrWGbW7a9ebn6qhtbJZlwQvSUMcL:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500518, "uuid": "e4349055-7289-4dea-993c-3c016ccc235b", "value": 2996959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500518, "uuid": "f291c264-4a2e-475c-acbd-0b7953caa281", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500518, "uuid": "2f8425db-c8f9-4985-bc44-046e3baa5515", "value": "bc6785544aa4d89b82441bbcd870df76.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e27d1f-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503675, "uuid": "77facd43-8d7e-41a4-adcc-7d047159212b", "comment": "Malware payload (Gafgyt)", "value": "a1831554f2125ecd6c8d10ddf8d58792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503675, "uuid": "2aa3a50d-c89f-4e1b-9fad-4d5e6c13b51c", "comment": "Malware payload (Gafgyt)", "value": "224a12fc063c7d17f8105ff8a0dd679b1ff7c4a862acaeb1a547a111fae3e88d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503675, "uuid": "86bd571f-741f-4362-8c51-24dc3f9579e8", "comment": "Malware payload (Gafgyt)", "value": "9779ccdb92a1e524e2ca2b5498c4bac150fb4735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503675, "uuid": "0154d899-c385-4132-9da9-890d67adb00a", "comment": "Malware payload (Gafgyt)", "value": "02d90dd3de2a2677ab11faed6113fe8699a600de3d2fb8791fd623087f69843d09f72eb523c18ae3f73dafae68dbdd7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503675, "uuid": "b54903fd-512f-4349-82c3-29ca5cd052d2", "value": "T1D2B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503675, "uuid": "2ebac350-f61e-4571-a080-10e98ea7a9fd", "value": "3072:R/4tNF9U4vvKKw6J73x8UmkiSFxfKxbXe:BUNFK+K8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503675, "uuid": "edd2de31-d7be-48c7-8d31-0fd18bbfd557", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503675, "uuid": "4ed90d73-b05c-41d2-b0ab-dfdf79d84eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503675, "uuid": "0d0336ec-4ad9-4250-8e3b-96473a5e946c", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced20ab8-610a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535949, "uuid": "39a5fbb6-8d34-48c9-8253-0bbb1774da6d", "comment": "Malware payload (Mirai)", "value": "cae51a767a5e2823a69b13ee188cd4b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535949, "uuid": "0eee3ba7-a79d-4a2a-ad06-e836b1e77f0c", "comment": "Malware payload (Mirai)", "value": "22590702f33722e88acdc1b234bd60a45f7b49fd16b47f87c9b725096ac890e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535949, "uuid": "fe3f6d06-6c12-4af4-90fb-976989b07360", "comment": "Malware payload (Mirai)", "value": "0260718af0dae74821c683f307ac5485f6541dfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535949, "uuid": "73c602f0-9284-4d6e-a9c6-d62b109f091c", "comment": "Malware payload (Mirai)", "value": "aba8c2177c49e3ecdd28f4c7649c76bc3a99625fa31326bcb0e1190ffc688230639d74c8f774abcc49ad499ec44d8ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535949, "uuid": "7837114f-9d71-44f1-9189-120fa3b37993", "value": "T15ED31845FC415B13CAD622BBFB5D428D3B2A17E8D2EE3203D9255F61378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535949, "uuid": "5fe8df91-bf4a-4460-8875-7412cdd8c07b", "value": "1536:8gHG9pivxE61ddEmTiA1hJl4VsN0TmMesGX+FWaZE2MnKhlu9wywJRYAxJR90smx:8gAcbTTic7480lesGuxy2mg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535949, "uuid": "45b5a23a-9d75-4674-a9ec-d2216dedaaee", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535949, "uuid": "7d24c134-cfe9-4a2a-9692-783644bf4dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535949, "uuid": "a89d6efe-3d88-49ac-900d-9561eddd82d7", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f608e0b-60c2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504731, "uuid": "7417c765-f5a6-4744-ab3d-cf32b8780147", "comment": "Malware payload (Mirai)", "value": "e3bf1904e3cc0e230ac3c08b83e94503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504731, "uuid": "a7bf05be-dbc3-41e2-a3e2-cf3e40d25373", "comment": "Malware payload (Mirai)", "value": "22747df5f28faabbac1f45691949e8fecb93d159ee799973b58687f073674838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504731, "uuid": "fa802924-22a4-4466-9e9a-479babf165ad", "comment": "Malware payload (Mirai)", "value": "d095d9fd12b265e6e2015bcb649c191cabb8e482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504731, "uuid": "4f5e1df5-403b-4ddc-ad8b-40568c7bfae7", "comment": "Malware payload (Mirai)", "value": "230b6b4ee70aedd01bc76b7eacc03eeb80e4a5bf955aba04e50738e748e0b147029788bbe494efa49ce869ae966e236d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504731, "uuid": "fcecca00-a8b2-4691-93f8-ddfa2e9c2555", "value": "T10493D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504731, "uuid": "7cf35f8a-725f-4276-8627-21f16a8407c4", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqxhK:NFjXYyCEx0MhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504731, "uuid": "154f4358-a92b-4dfe-9227-d645a2978d4f", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504731, "uuid": "6c1102fc-8706-4fe7-a951-6f08aa8f047b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504731, "uuid": "e5767fd0-367b-4c26-9616-36dd2f777ead", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c910eddd-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752517471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517471, "uuid": "07e2254c-0191-4fd9-a7aa-85d971aa342c", "comment": "Malware payload (Mirai)", "value": "649f3c90e6dc83833f49a68bc70704b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517471, "uuid": "ef7855b1-18aa-4e68-ba7e-558f0d4d4231", "comment": "Malware payload (Mirai)", "value": "2290e1b8564ad91e47f823c830daa369c8297c81e840d91fba4c319dd0b7fca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517471, "uuid": "bff6d491-3dd0-45c5-afdf-4cd5a7a3de13", "comment": "Malware payload (Mirai)", "value": "35d31561c9ca5ed1c20a9fb9e9d6d3e33007e131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517471, "uuid": "b141708e-368a-40e9-9b5a-82c05000c501", "comment": "Malware payload (Mirai)", "value": "11e39757c6715e57e6cad28b07fa520ffe4a85ac841a2fce084d2a6a97875136d72902beeb26e96d82824679ed2927a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517471, "uuid": "b5615095-b03e-480f-92fe-bcff5543e998", "value": "T1B9A3D636AF650E67C81FCDB3066D4A562C8C528322B53BBA3774C528FD5B54B09D3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517471, "uuid": "f4b1f006-be7b-4439-8e68-6c025da5b5fc", "value": "1536:h5RKuJKWB0X+U0wVCyYZ70mLqliFgheVyUfi:HRFKWBiVCZ8oFmeVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517471, "uuid": "e7c89a4c-22f9-4031-8035-1e816cd75d37", "value": 101488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517471, "uuid": "36e76cb3-1fed-49e0-8728-ba43d425b813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517471, "uuid": "033a4255-3c91-4749-9195-b0c82d26b383", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180688de-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505148, "uuid": "eff68232-827c-47a2-b39b-7b9514c2d09d", "comment": "Malware payload (Mirai)", "value": "4539ab2ce8547ecdeb814e9adaf30507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505148, "uuid": "30f29bba-6b9a-47c7-a3b0-4c51c38b2556", "comment": "Malware payload (Mirai)", "value": "22b12429a1a006046e9ca02485b53113b83b0ac7ff537d752acf24d58fc8d1df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505148, "uuid": "4ab8623c-9300-4887-a733-2bbf49ed5e23", "comment": "Malware payload (Mirai)", "value": "96f1930f6bac0011ad7b32c6c1f30cc182a0e84f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505148, "uuid": "39f8bbf3-88e0-482e-8abb-5d152531c72b", "comment": "Malware payload (Mirai)", "value": "48979b51a4d6340e2afdea26e0e472ef2f297e9b3cd8562bd0f91766dfdf299389c1282aeeb80cee1bf00b83300b113f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505148, "uuid": "1fbdba87-16f8-45e4-a44f-ff385e338949", "value": "T1AA733985B851A626C7D146B7FF1F018D331657D8E2EA3303D9291FA0778B85B0E2B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505148, "uuid": "973b7b2e-73c8-4e86-a0ad-2fc1a595256d", "value": "1536:voa49Xl0NPwbE5d7MTNV1fU2+6trCeWXXGbFOdzsa1Mlv3n1:voawCPWEwhvM2J1CeWXW+rQ3n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505148, "uuid": "e8d3dbb4-6f30-4024-9c37-b033a596fef8", "value": 76880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505148, "uuid": "47db0d3b-d62c-4e1b-a824-a8be4b879497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505148, "uuid": "0f07205f-019c-44ad-883a-939e64af84a2", "value": "harm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85973b8a-60e6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752520364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520364, "uuid": "2b917cb9-b7dc-4519-83ba-4bbc835cb733", "comment": "Malware payload (XWorm)", "value": "e63542d9fe2c9597049af09c75ac6334", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520364, "uuid": "c8b01482-a0eb-4a3d-9d12-0708e192650d", "comment": "Malware payload (XWorm)", "value": "22c04eca827e7a9a6868a2f45e9d953b012b1a363c4361a9efd04ff436c011fe", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520364, "uuid": "f11089c5-39fe-46dc-ae7d-e8556ae5ef1a", "comment": "Malware payload (XWorm)", "value": "a4342b9933a805fb54b368e3ad98e0980c6edbbb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520364, "uuid": "466f89ba-b20e-46c3-a54b-32a3d611cc85", "comment": "Malware payload (XWorm)", "value": "d4c0aa62c7e292828ccdc7c6f1e5b13d210fd6cbf984a977579450636a55c807b7f883f0ac551fb384287b06917a3247", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520364, "uuid": "8cbb2ed9-0946-430b-8a34-476f374d4447", "value": "T188F3D37DCAF1BCC0437B72D06A1D3B0A204E4FA7AABA5B2CF5C154A56810696DF37248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520364, "uuid": "f55d713e-ddae-4783-9c24-14ec04f0b695", "value": "3072:vUahmDcNEU9BDi/DLF5hKBbptGQZvhzg+5jod3lbylNVTGWimZAR:MaRNEU9BDi/DLF5hKBbpU6qF1byn1RiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752520364, "uuid": "964a6f42-13e5-4eb8-a59d-ef657d37ab4d", "value": 171521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752520364, "uuid": "a297f775-cb0c-4fcd-a56f-db2e57a9ca7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520364, "uuid": "36a0e948-6b3d-4b80-8337-4970861b738c", "value": "DOTC98765456700008765HG.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303b9ac9-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513349, "uuid": "95619bbe-081b-4d2a-865e-00455ffb7ace", "comment": "Malware payload (Mirai)", "value": "ac7835fca711ef1efe1b0c582fd3fb94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513349, "uuid": "b120439c-8bd7-44d2-b555-1d19db755c65", "comment": "Malware payload (Mirai)", "value": "23025fc421a87e44ff1d885e19e4d8124e4434b8af394302873064b2b5885818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513349, "uuid": "fac5ec5e-da06-4176-bd97-08286a945e5f", "comment": "Malware payload (Mirai)", "value": "fb894909443e937abe9c94e38122a39e87a5d34c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513349, "uuid": "54d7048b-e7ca-40e2-85db-84a1f8327daf", "comment": "Malware payload (Mirai)", "value": "1b5d0b5b0721cf3ee09412267cd337233aea832cd8527b82f6cafcf7555d6e7f712e76737224b05e495ef3ec6dfc8ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513349, "uuid": "42468cb9-923e-4f93-b031-4efcc3ed1107", "value": "T1E4932BF2F800CE76F40997F6446389177D31E3E31AA21AB263672456DC761D609B2F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513349, "uuid": "72014e89-cad7-470c-ab1f-57a6f7659b82", "value": "1536:PBO+x6fpVgNot8FwxuqK4i/78s6xXBRER0XUU+7y9FNtm:B6B2Nozx4bzVtMUU+7y9FNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513349, "uuid": "7b09af0b-1e20-45d8-9ffa-5149803433ba", "value": 89284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513349, "uuid": "ed118dc6-af65-4224-a771-0df830cf8ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513349, "uuid": "2ef19541-4a4e-483c-a052-f22ecd7ce6be", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e5619c-6070-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752469731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469731, "uuid": "c39f2932-dbf5-4a39-86c4-cd48023d6061", "comment": "Malware payload", "value": "fe8d02094f7d4efc132b50ecca0a5716", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469731, "uuid": "fb8b090c-5a8c-49b8-8257-5d477a81b448", "comment": "Malware payload", "value": "23170bf9437430ca0b79c4f275c7b5f6758c47f969120c975b6496011eacf407", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469731, "uuid": "0f5a8351-568c-4529-b4b2-d4cc0e4e83d7", "comment": "Malware payload", "value": "55f9e33fc07dd6abbec19b0b16854276a5bd2b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469731, "uuid": "aad68c6b-7afe-49b8-ab37-76da141f6107", "comment": "Malware payload", "value": "09a71aac509c5646c66de9cce84adbdabdcbb6a0c0134d514ffb2fbf4cd0de1056fd6a96dbd77c99efbf46ada58a6d2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469731, "uuid": "ac7f3b43-5e3b-4cf7-9af3-e1ff2a45f725", "value": "T1D5A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469731, "uuid": "2004f2c5-0e7e-4caf-9fbf-6d1cb46ae386", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752469731, "uuid": "f86aea2d-2c8c-4151-996d-c1eb4b3636cf", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752469731, "uuid": "105c465a-8316-4bdd-b030-ce94ae508ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469731, "uuid": "f799f0e7-00e5-4430-ae28-efd6cafa6377", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e50a69-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493973, "uuid": "f7d18512-8bf3-4104-951b-6051eccc7194", "comment": "Malware payload (Mirai)", "value": "80fd3fb5c0eaa4c957e6de56cd66e909", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493973, "uuid": "f57a0401-a5c5-4365-8576-fc0331defaa7", "comment": "Malware payload (Mirai)", "value": "23496089fa20f9f016686e0915159a074172efb296438f12e6dc3a094a0791de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493973, "uuid": "99c1b890-20cb-4571-b13e-2da19abe4d48", "comment": "Malware payload (Mirai)", "value": "52f962b8fecec007d227eedee54c77e190fd4005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493973, "uuid": "a02b7fab-3517-4b20-8959-531f05e3941a", "comment": "Malware payload (Mirai)", "value": "4c3851b2f1bdd9d42ac7cedc176383e6bf3f071940c9b9425e80f2b1c590bde5a651242cb49547fe49269c36b907b5d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493973, "uuid": "980de2f6-69e6-4d0f-b27f-4839464a43ff", "value": "T16EF2E13982FDEC7CC03E75790C5D5A49F982F5112B69372A0529A2BA6FF78843E01BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493973, "uuid": "98898097-73ef-4032-9a1a-b3ecf6de1194", "value": "768:WwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTUU5Ux0nZu:JOX80VqVi2otGtzXBMZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493973, "uuid": "845f4384-4535-4410-8cc1-1768ace16555", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493973, "uuid": "726e4534-e31f-496c-9d8d-72d53e93465b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493973, "uuid": "276f6ffe-f2ff-4e26-93d0-5177854fee07", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3440d27-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504657, "uuid": "9311f14a-800e-4bb2-8c62-f033ca525140", "comment": "Malware payload (Mirai)", "value": "7f1271ae6de57a70ef07ff623c2a5158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504657, "uuid": "a08e233b-76b5-4ef0-8ca8-2ce5406df885", "comment": "Malware payload (Mirai)", "value": "2361e522346618b5bf9f8b00a0cb7b4d07d536d55402675fb6544f9e86c047ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504657, "uuid": "35078646-cbac-42a3-80f5-151cc4869c70", "comment": "Malware payload (Mirai)", "value": "269828159589ffd78efacc95b5e56b06610cb332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504657, "uuid": "d123f462-dce2-4010-8472-0f3ce052aa9d", "comment": "Malware payload (Mirai)", "value": "ff63f5de1b718f9a5b070edf993d6b7c38e2e5d35a822278d318afb541a022a41fcf69887ea7211e12b4b8d95074485a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504657, "uuid": "3b34058d-97c7-49e9-b2d8-1574b764c474", "value": "T142D2D0AEE5B542C6FD4D5C3E809C3FA10E1AD681231BDB9267118C4D5B33C5BF26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504657, "uuid": "cb8bf89e-0d84-4d11-83b3-8b4b337c5606", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjjXt9RWGVCz0NvY:jMYHb62x4ahQ3CfdwLjgtWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504657, "uuid": "1a5ff2b3-8a0d-49de-81e6-9642af27e7d9", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504657, "uuid": "0f8c0237-e3e9-49fb-8f66-5fb8c894206e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504657, "uuid": "501a5b69-3522-4609-976e-b2beada1b395", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fc2ea8-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504658, "uuid": "44cadcf7-4ca7-4eec-b6d8-3573bc804d7d", "comment": "Malware payload (Mirai)", "value": "73ce05c9d95cf47aa46361d36b7e3ec0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504658, "uuid": "a8bcbb33-4864-4cc5-b0bc-7db8a3964b75", "comment": "Malware payload (Mirai)", "value": "2398d0ce116af0f8dc0c6edfa2029508f6514f074e033096bb8b386de626d5e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504658, "uuid": "97b002f3-ff70-4c4b-b136-a602bd3fa386", "comment": "Malware payload (Mirai)", "value": "94eb5478a7c460423f8182f5b36531dae6014f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504658, "uuid": "6bee94da-0800-452c-a7af-e4627bc8f430", "comment": "Malware payload (Mirai)", "value": "6323e67481423f39d503355c9c997ab2d417aa7b8f114cae70b19149212827252f54b95f4b836963b46678dd94a7ddde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504658, "uuid": "8a369e65-58b9-4132-bcaa-3ad007c3a9ae", "value": "T1B8B2E0AD16C2A4B1CD70A43CE629C142E36E067DC0F97732229796681E4B989687D3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504658, "uuid": "42a80586-a180-4801-8dfd-702cbbc2f694", "value": "384:oeoBE5aNSS75BOI+ypZ5vTlYIwcvsdwU2LdUfy1oH7M9pGBl2VOSs8/V6hymdGU4:oaaNSq5sOHpTqncvsdwTR+XWEBItt6sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504658, "uuid": "6e9d97d1-e1b3-4c3c-a489-92bb19c6b6ba", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504658, "uuid": "5d38afbb-e0db-41b9-8049-c1ade617668b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504658, "uuid": "b6cf436d-7a70-44f7-b7ff-6c8e10d0cc28", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6805e1c-6109-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535452, "uuid": "608ec0db-cf20-47bf-8294-e6b051b2a43e", "comment": "Malware payload (Mirai)", "value": "8095cea752d652c2cddd091692fa40cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535452, "uuid": "3688956a-2794-4d22-a09e-a0a88bb3c0df", "comment": "Malware payload (Mirai)", "value": "23adf733c9444376638d81b2033909829ae6e1002b25365a2e5e9a0c1de00ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535452, "uuid": "8aa1d728-2197-48f4-b2dd-c7adcf748c10", "comment": "Malware payload (Mirai)", "value": "bb9d0cd327597d79731e2ce28d707f057b642760", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535452, "uuid": "c39e62bb-238a-4dac-89d7-2918943e4e15", "comment": "Malware payload (Mirai)", "value": "58a8a611bdc9522b646f75bd7a13377bdbdbe50901045bd83d22374ad02a174dcace9938a601ac6ee6188fac8d8389a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535452, "uuid": "0addd9dc-9b31-4b4f-82f6-e8942a62b171", "value": "T1FBE34B1A75C084FDC8DAC1788FEAB53BD972F15E1134B22B27D4AE261F5DE205B2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535452, "uuid": "ab07a3ee-e2fa-4bcf-acea-e4da4d328f8e", "value": "1536:N2beJa8ZbtU6K9xc9JZFLD7GdVWZQVG2s/bFYKdETQRnQ1YfRXrM3aR995j09993:ge9dt0gj8VWZJ2s/bFYKGQRQ1Yf+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535452, "uuid": "16939c08-125a-472e-95fa-5a9acf7eacd7", "value": 143736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535452, "uuid": "329127ac-d8c0-4b53-af38-807ff3c1cc22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535452, "uuid": "c493e8f4-0763-43ec-8a71-536b2e116c2c", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d16b5f4-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752477830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477830, "uuid": "b5602915-10ab-407d-849f-2914d5a71370", "comment": "Malware payload (XWorm)", "value": "a8b634799b93dbb87be1c52d5eda0274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477830, "uuid": "3aefc4cb-3ce9-4d05-8a87-b10f26175103", "comment": "Malware payload (XWorm)", "value": "242177c913c55df467bf3543635e3f926d0965286adb65951644058cdafee152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477830, "uuid": "5d0c4464-eab1-4a34-836f-d670634980a8", "comment": "Malware payload (XWorm)", "value": "b2031332a639e7430abcee7194b179654d995cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477830, "uuid": "8855a66d-9202-4f1d-93aa-d6ebff59b493", "comment": "Malware payload (XWorm)", "value": "cb6dc19cbcb48a0563dca1665916b5746b6692c8489cc4f8ca4a9880ce99d0246a80b1412a8dae98fd6fe3eeab2d5184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477830, "uuid": "49556b29-60ab-4664-8141-5051fa834ec3", "value": "T1AC25BF1373DE8365C3B25273BA257741AEBF782506A1F96B2FD4093DF920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477830, "uuid": "3f386b85-3870-466f-a3d5-51364b3d9997", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477830, "uuid": "f61262a5-1076-4dd6-96f9-5464ca979b47", "value": "24576:ttb20pkaCqT5TBWgNQ7aN7vd43dvKJJD1c6A:eVg5tQ7aN7d40K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477830, "uuid": "07e008ce-3ec2-497e-b488-c2daddbbca5d", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477830, "uuid": "888fae69-277f-4d82-bf41-837d96606d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477830, "uuid": "00c010ab-3c61-4886-912e-c3078847a11f", "value": "FACTURA0-9876789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a093e1-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485095, "uuid": "ad6d5ada-c1c3-40b4-bb48-4ff390da059f", "comment": "Malware payload (Mirai)", "value": "9a926477f3f16ae002a45b099d559f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485095, "uuid": "354616c6-a67e-4f91-986c-a474fb3c1c58", "comment": "Malware payload (Mirai)", "value": "245a514e7f92a890269803af3cd69574d15ff4dbed49389b815d91b4067eb71d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485095, "uuid": "59884a63-1e0d-458a-8e32-baae792ad452", "comment": "Malware payload (Mirai)", "value": "92e2cd4c5b70d44705bf060ce7316c864faf575b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485095, "uuid": "20756cc2-4864-4cfc-b629-34e9f1b24de2", "comment": "Malware payload (Mirai)", "value": "c6d5b798fbc6c9569e063f147967c6f3984247cf10dffd0562f8482ee7d41745beb501211ac8aa412f4301889c56338f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485095, "uuid": "be15a841-2f11-4790-988d-3644440121b9", "value": "T1F9734C23BA760C2BC4D4553562F30722F1F7878A24BC472B3DA50E8CBF6565036577AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485095, "uuid": "9704dc08-0d02-4424-8abe-6bf47319d3e4", "value": "768:Peb7cuoS8lxcJv1KaY9U3uL7hDtAJWFbO+NHG5VuNB0nMIv6X4Q7/ElmMtHKrkzg:PevcuoDxsYTRDtGgNm54Yk4QTEjtO4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485095, "uuid": "a0ee1ac1-d4eb-4db1-b7da-34609cdab6aa", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485095, "uuid": "7dd77265-d848-47d2-bfd2-32ce84f6bc3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485095, "uuid": "178a72eb-bfba-43ae-bb02-6b5d8c344683", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6571358d-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528471, "uuid": "c9a1f71c-a591-418d-a8a5-32fce2919b0a", "comment": "Malware payload (Mirai)", "value": "9a056da5934ae5992876d70547200f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528471, "uuid": "93c6a681-0bbb-4843-a070-d8d90f732ca4", "comment": "Malware payload (Mirai)", "value": "2484dace838c357187505b57415580650f7e3aa8edc47350af454042f354d19c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528471, "uuid": "f44268a8-97c8-45d9-8f73-d13e6d3d7b57", "comment": "Malware payload (Mirai)", "value": "380708edf3ff14d1a1878b50ba2e55ee84ad0bf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528471, "uuid": "8c1ae61a-d461-4a9b-a968-d95ad25b8ed8", "comment": "Malware payload (Mirai)", "value": "67eb01498e055c4c3db4d9febc3bf849f89001ebaaacbf8cbbc3286d740ceb512bdef4bd85d8682173105f455516a677", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528471, "uuid": "e4e095ee-3b7d-4d18-8d28-63ef1749dc3a", "value": "T1E103E1BB72AAD57BD0B529B7D80C0780F8D0A155B44B879F1DB463BF8D636252902FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528471, "uuid": "05dc627a-f99a-4476-8232-0c424027be26", "value": "768:byLl8B3qYi/oADng+PI4Q0EVId6VX5HkeURkx05M:uLk65/omfI46a6htkeNAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528471, "uuid": "554a2f6c-2c33-470f-b76a-53aba98a39f8", "value": 38148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528471, "uuid": "0606340a-d886-4622-97a4-bb6d147c795e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528471, "uuid": "cbd38354-1ae1-4147-b04c-cab07461ecec", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaae571-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503685, "uuid": "cd224bc7-e1f1-4831-8586-d68ac1af73b5", "comment": "Malware payload (Gafgyt)", "value": "c931f4e660b2953dd9a215415c6a5339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503685, "uuid": "a3001e89-7068-46b3-b224-2d64c8f5a171", "comment": "Malware payload (Gafgyt)", "value": "257ee54bb842e9d146c34c60f508e19894159d73c03967558600fa28b92cd0c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503685, "uuid": "d186d52a-1990-47bb-bb24-f51db146edce", "comment": "Malware payload (Gafgyt)", "value": "d03f163f3ea54e61e1f30faf5d0fab527e23a7c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503685, "uuid": "cd39d871-d258-40fe-a4d0-3e0cc7d835bb", "comment": "Malware payload (Gafgyt)", "value": "3e51960e7dbfeae6d9078ab72d6ca244fc6a44efeb1f637b2f206c18d65aa5652064f22f82da001b0be0179b3a2382c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503685, "uuid": "045efa9f-8cf6-4485-9958-3bc1913d710d", "value": "T142836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503685, "uuid": "334edf73-d663-45c0-acd5-bdb42c35d420", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XzuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XzuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503685, "uuid": "6b81a70b-2da4-4409-901f-c01d7aee4e03", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503685, "uuid": "275df7a0-ff75-489c-8f91-211d9d4abd8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503685, "uuid": "13028978-cfe3-4311-b0f2-1ef86e9e4a71", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3f2a5c-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752502045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502045, "uuid": "a5500782-4c44-4f01-afd5-534c06835983", "comment": "Malware payload (LummaStealer)", "value": "55d5cc79ee36a04309c9ee469a19b96c", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502045, "uuid": "763ae9e3-3fc3-4c13-a305-479fce77c99a", "comment": "Malware payload (LummaStealer)", "value": "25b125781fa63e0b4f2ee768d1ef3e0e2b895502c2a782524c9b37c6b0a6c522", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502045, "uuid": "96494438-083e-424e-97c4-7c4c2fe1d5e3", "comment": "Malware payload (LummaStealer)", "value": "54d568950edb7e19a6c24ebeb3f1f104e59f7a7c", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502045, "uuid": "1539ebcf-6670-405c-9fe3-238f5d843981", "comment": "Malware payload (LummaStealer)", "value": "14251268de3af73ef9c9288abc7a9a48d98de0fbae157265f26347205d03221725f58ccf9445a062f3a7cf101e5a6c57", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502045, "uuid": "fc460fe7-f28f-42b1-bd75-f266ecbeb071", "value": "T12435231E2134C463C88347B22197F02BD377A2163479599BA6A8CD057D12FFE998E3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502045, "uuid": "b23ba19e-d017-404f-9b8c-171adeee9dcc", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502045, "uuid": "597a45b1-aac3-408a-b79f-389dd9d4dca6", "value": "24576:W0aWMkw1IfcEvwbIJYRVyFcGjBYJ1YrWEeGSy4gYkbTq5H0X:WcCIEEtNOGa7MiMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752502045, "uuid": "a0b8e9d9-c244-425e-a5d6-58fe6b90470a", "value": 1066994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752502045, "uuid": "19337a5e-8250-426a-a6dc-6d7461e98302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502045, "uuid": "6284f5c1-0cee-4d0b-bbb8-7152726da3cb", "value": "\ud835\udde6\ud835\uddd8\ud835\udde7\ud835\udde8\ud835\udde3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dc921b-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513654, "uuid": "2b7ea33e-f980-488e-9d9f-8dfcdd950dda", "comment": "Malware payload (Mirai)", "value": "1c1062f23733f7fdf2b7dd99c581555e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513654, "uuid": "7d966177-0466-4762-bb96-5d6356407d74", "comment": "Malware payload (Mirai)", "value": "260e23795c0f6ebb4b5a555b31b4e3cf1eaa0b4193f0968590c50b0d10133254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513654, "uuid": "63b8b19b-def7-46e8-9617-6c7a64b5834d", "comment": "Malware payload (Mirai)", "value": "0c56590205f207beb5ee00a9195290935a666d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513654, "uuid": "73504dad-43b1-4b82-8e87-a9bdd4971cee", "comment": "Malware payload (Mirai)", "value": "923ba154ffd556241b5ac37d872a4400176f03653bc164258767564de970f88e522d546823893854af7a5770f386a42f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513654, "uuid": "fe6c472f-234d-4e7a-a33f-9910ec20c406", "value": "T1C603D0EAD0197DD5CC3F2EF51B90E29327B64FE6A2A2DED333950F5243529039A84D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513654, "uuid": "55b4e4ec-811b-4b66-a0b1-685da0d4ea3e", "value": "768:+Tkmm7sZoMsRqZWSCtFp2Ce9g/lmed67Sc/4zwbCwkNMz4uVcqgw0Ir:+KLMsRqZWSCZy9CU2zwd4u+qgw0Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513654, "uuid": "ca510acc-8caf-4c5b-9a58-7b69385af669", "value": 38212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513654, "uuid": "c332ef1f-6589-4dd1-b678-e92b3a7cabc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513654, "uuid": "76d3e635-1cf2-4302-8d13-cb3deffd941c", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cd49e6-60b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752499393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499393, "uuid": "d60b7512-7317-4a21-8466-26507839a5ee", "comment": "Malware payload (NetSupport)", "value": "60714ada60f7c35b0e56def3b240fb80", "object_relation": "md5", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499393, "uuid": "dafc70f2-0b7c-4ae9-bfeb-8f666a10eecf", "comment": "Malware payload (NetSupport)", "value": "261d5b49e28b6ebdae6b3c0b617401e18bbf25e2cb79b3f2301e3cc2538ff6eb", "object_relation": "sha256", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499393, "uuid": "0f5af650-4027-4b20-bc55-5e37bed882f9", "comment": "Malware payload (NetSupport)", "value": "6b8227a05eb6c78e7c46bb8e474c9ad05d3118b8", "object_relation": "sha1", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499393, "uuid": "b7fef70e-9954-40b9-9413-d60e8eb82bc4", "comment": "Malware payload (NetSupport)", "value": "b2858aa19a39befdf4b3a59c83e6f2a2704fd17d58d8fb307a155f1058cf5e1f6a2eb05a7a83ffe19f82553aede3cd74", "object_relation": "sha3-384", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499393, "uuid": "3a285bdf-3f2a-416f-812e-1361be859320", "value": "T1A312D036C1C16CF4D713E9B1128A32674EB4270E0CDF266C8E7D3F5708878A0601B86B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499393, "uuid": "f17abddb-d439-41ac-a893-e908b662676c", "value": "192:EQ3Ayma28ET1iMHC07yu7By3/aYFW1qqQ/WXPjCoqthhQIR68Bd+72b:FtGUMH/f7w3/NF6qqQKJIRzBA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752499393, "uuid": "15ff1bc8-f48a-4d7c-a90e-fc7c09dea70c", "value": 9161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752499393, "uuid": "0951146d-c373-4fcc-9ea4-def02e522718", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499393, "uuid": "9846eecd-18fa-4601-b122-a5e7f6cb1e21", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41197a3-60bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752502377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502377, "uuid": "cf624257-c675-4718-bfb9-2f9f115f3eb4", "comment": "Malware payload (Formbook)", "value": "e4a2b4679d56e1023c8c41393efc2b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502377, "uuid": "215cb02c-327b-4099-ad44-746379e5e25c", "comment": "Malware payload (Formbook)", "value": "263c4d83be7c20f55ab9353ce27796b48755fad1bc1c72e7b539f099ee20217c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502377, "uuid": "c1c09684-c3f8-4af0-ba67-a2601fc95458", "comment": "Malware payload (Formbook)", "value": "344f7a6c72c2d21f7e727139590a2aaabf69abd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502377, "uuid": "8a8f2df0-f2e5-41e5-974c-633e26b0a5ba", "comment": "Malware payload (Formbook)", "value": "ff55a6ac68f7d5100213bcdc00f3e1abc60bc27bdd90c59827c324753818ac36e4ffb6cfb74cbb7456ed5a80e077ce61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502377, "uuid": "94c6d9dc-be43-477b-8e9b-d7ee3640e20a", "value": "T1F845CF2373DE8360C3B25273BA2577016EBF782506A5F56B2FD8093DF920162525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502377, "uuid": "c4637db4-5bbd-4574-94e9-55f0da915ee7", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502377, "uuid": "c1f92830-3ab8-4d79-a1a6-b9454b12ccd0", "value": "24576:ltb20pkaCqT5TBWgNQ7ao4/tLgzjnnT27M5/f6A:WVg5tQ7ao45gvK7Ml5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752502377, "uuid": "f41ef214-27f9-4770-8d5a-11b318f57961", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752502377, "uuid": "bcb09cbc-38b0-4f5a-94c6-c33891dc3335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502377, "uuid": "75828361-4cc0-4730-9dca-7739ebd21a24", "value": "Techno-Commercial Budgetary Enquiry for Chemical Dosing Packages - SAU VCM PVC EXPANSION PROJECT Indonesia -NBELOUCDP-12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac75ea3-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528480, "uuid": "f455da14-4176-4b37-bb5e-958fed1d70f1", "comment": "Malware payload (Mirai)", "value": "e39944f90470e5dd3d6a66a6cbe7731d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528480, "uuid": "1586b7a3-5bec-4691-b84b-803db8474c9e", "comment": "Malware payload (Mirai)", "value": "26f76121b763af3dac78df402f54b21bb6f707761ef250cf134262f0df17468e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528480, "uuid": "b62ebfe8-3090-4060-a6d5-f5fcce12650b", "comment": "Malware payload (Mirai)", "value": "58da90fafccc89eff6f19c39e350d54d626950a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528480, "uuid": "9e0dc933-d521-4332-9cb7-ea1b5fef8043", "comment": "Malware payload (Mirai)", "value": "148ad35e301e0dba1f95992294d6a2ff19dfe142db3025e62670b0ffa7ccfd58aae7109b23f380384400199cc8927759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528480, "uuid": "87be70f5-0206-4693-a851-ff2cb6a61824", "value": "T14A639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528480, "uuid": "f87bc4f5-e1d7-487a-ba91-9a371a194ee6", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udN:DYkwfCFlugsz9xznsxrdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528480, "uuid": "7b7f9239-468d-4107-a6d7-1b4d17a6b1e7", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528480, "uuid": "2157561d-10b5-4882-835d-9e63903969e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528480, "uuid": "a7d05f2c-ff8f-4329-bb46-652b25403ccd", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144cad65-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493975, "uuid": "958a9d68-9c2c-46ae-9b05-b6851c2bdb73", "comment": "Malware payload (Mirai)", "value": "4494f6e0bd7dab1a669be6ac6e0ab641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493975, "uuid": "2a80d050-8acb-40ab-a7f2-6d539dcfae8c", "comment": "Malware payload (Mirai)", "value": "274248c4f48048cfa7adbb98ca1cc5e6e0261bcfe93eb47a335205ea6b059d27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493975, "uuid": "ee02448d-5a37-494b-83d1-ecd319e4e889", "comment": "Malware payload (Mirai)", "value": "0affad2389ffe72ac4943ba7b14d20474d9915f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493975, "uuid": "5db3555c-d586-4b01-8e6a-503e6c930b0c", "comment": "Malware payload (Mirai)", "value": "5ba773ba89e4bdfc966db6ca8d2d61146959cb359d9c4e2857318ff534edc8618c7330a594c506ca13d753ad307e9ca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493975, "uuid": "ac1b96a9-032f-438f-9deb-5e58663557c7", "value": "T12933F1B642AB9D72C17056BB1639649E64552338E3F6F00366614470EACB1F38AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493975, "uuid": "a782011d-997f-4d8a-a9db-359ab2215ce6", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JP5PL9VE8amFZP7R33:Soqs2Twh6P8JPhLJ9ZP7R33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493975, "uuid": "70b354e8-d2ec-4923-abdd-3288232e65f3", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493975, "uuid": "a352b34e-2c8a-4694-b37b-b6c44544ee99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493975, "uuid": "3c9c5a2f-44b6-4e8c-9745-303dfe0c612b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0c1170-6072-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752470450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470450, "uuid": "822da6aa-0a14-47c9-942c-36301eddc0cf", "comment": "Malware payload (Mirai)", "value": "80a707f94a66b86ce2e29ae03de472f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470450, "uuid": "3c5737ed-9268-4b28-9646-fc6772f211b4", "comment": "Malware payload (Mirai)", "value": "2772d850426c8022dcb8a536cc94ac9a5835ca7845a5a44f7cb490e6c594019e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470450, "uuid": "0f26a527-c753-4097-b7dd-ac3baa34be27", "comment": "Malware payload (Mirai)", "value": "7c2b5d4efbb0d780563551c15a2a83fd5f3e6ee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470450, "uuid": "92143212-76b9-46d7-87cf-f59b6ea1a155", "comment": "Malware payload (Mirai)", "value": "da57e1068e61f4486f63d76353bbb38269fa86a83f99c8d1e18bc28bb93ae2e7ec12a4f6e0363659fbfd1b1f17843a06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470450, "uuid": "e969e806-ed18-4d97-b4d3-80493a17f8f6", "value": "T144C36B76D8252F58E668D1B0B0748F782B638990918B4FFA29B7C2794443DCDF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470450, "uuid": "63ef8e72-2b0c-42fc-b46a-a995b8fac5b5", "value": "1536:8isWa5b83MEKyJoa+oGRlsR9uCUSKOVp9zJNG6FWmW+Sm7IzDQ:8fReqa+oMlsQhVOTNGJmWTm7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470450, "uuid": "de52c7b4-1a74-4536-a53a-bfe5362a1ce8", "value": 121824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470450, "uuid": "0e1d8352-82e9-4a3b-beae-3f64c51e16f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470450, "uuid": "f3691658-9f16-4662-91c0-37dc9bfee0c5", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b333c1a-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503946, "uuid": "b6d0af25-d4a3-4398-ac79-ef4efceb32b4", "comment": "Malware payload", "value": "cb66256c34d546d989f9e979f410ae86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503946, "uuid": "3703c6e2-abbc-4aa7-911f-6b2181686b11", "comment": "Malware payload", "value": "27ddd7cdedd67cbcfb30233bccbe6436b6cb2a7de32177326686770565f621e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503946, "uuid": "50bb7035-01e0-4f44-9f86-6f66c96b8f8d", "comment": "Malware payload", "value": "8f0bbdd949f7c775669ee4f39bf508bd419b5382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503946, "uuid": "fd9b72c4-47da-41ab-8013-fa04df080996", "comment": "Malware payload", "value": "c2395785afd79dac4441afc4677c3e5f289a4058721cf9bec619864aa0f9e7f0f3b2718ac9e045e4501741ec2db87239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503946, "uuid": "68ce5aea-5e7d-4f50-bc24-79f2600de712", "value": "T11D233995FD409B12C6C26177FF5F4288BB1B0368E2FA33079A2A9F2037875560E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503946, "uuid": "9da50879-14de-4f33-bfc2-36879d082521", "value": "768:q6o2Xgm8bjY7M6FwkHdzlO9zMh8W3/72ZkY6CVEaiyTyelaHkhjEG631vjI:9zQ/76l9zlO9zGDTNzCCyxSKgRvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503946, "uuid": "0fe580ed-6d59-4b57-a3dc-3db91d69287e", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503946, "uuid": "cf2f8104-00f8-4034-9524-cc2fea63b9ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503946, "uuid": "d63f6682-b0c2-477c-ae69-789759f89ad9", "value": "proxy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9308355b-605d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1752461546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752461546, "uuid": "b49f6e31-6784-4941-8f51-123f10b43b6c", "comment": "Malware payload (GuLoader)", "value": "bca6f176e31fea834d048a8e31a998bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752461546, "uuid": "a9242b42-d914-4419-a832-ffa054148eff", "comment": "Malware payload (GuLoader)", "value": "280d13772382139c02d91da197c4734a5aa71d2b2fd86292fa8410bf44b75bc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752461546, "uuid": "802b0b6e-a72f-4df9-88b8-dd7508d2fa6a", "comment": "Malware payload (GuLoader)", "value": "b842458f8635b5645057ced5685148f3da0b52e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752461546, "uuid": "05d467ad-030d-45ca-a9c7-ac5b4ea1ac37", "comment": "Malware payload (GuLoader)", "value": "c6727fc3942e889541a9e2ad6aa11c405b2f4e4636d63c3713b45e1a0322562cbf7ce07501f17f13e83c15d2dd97e3c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752461546, "uuid": "7ed5d784-0e4d-4a90-a15b-3e2ac7577d85", "value": "T11DE4E01BFA92C0F7CE7D13F3F9C3E6FF1DEDA56AAC54889966969AC22000D31160D524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752461546, "uuid": "4f7c5998-2fa9-401e-9576-1b553d997d76", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752461546, "uuid": "812565d1-1806-40cd-a585-5a4a41791f6a", "value": "12288:UYO8MP5/f9V4mRdnxu1cRxpsQmvQPUfg80Nr3J9E0ihC3wVY:UYCPZ1S+dnQcuQm8Nr3T7V3wVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752461546, "uuid": "a696b8d1-c65f-4b65-9a1f-993f7d7c16c9", "value": 721872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752461546, "uuid": "76e7aa82-bae6-4f04-a2c2-ccce5d2c30f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752461546, "uuid": "5e2ae20a-4613-4df5-97fb-f48b44ab9edd", "value": "TT -PAYMENT- JUL 25-63535355353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68e1f1b-6045-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752451405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451405, "uuid": "8fc32cba-da49-407c-a1de-767ec255137a", "comment": "Malware payload", "value": "e963ab9b50679afbc3d6c4b89f717965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451405, "uuid": "19a2b241-3183-404a-a245-e768ca69a69e", "comment": "Malware payload", "value": "28c30d153d074d69e45bdc8add909cf14b29fa117219a49a99a7c792d9bf1b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451405, "uuid": "0aad5ad2-0650-49cf-b224-77364b4dc58c", "comment": "Malware payload", "value": "21c70029b7c9969be90831dceb8333fee5c04c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451405, "uuid": "4c2a40ee-374d-415e-b0f2-2d8fb6377536", "comment": "Malware payload", "value": "c26ad3a06610c52b2521d69f486dedfa890935a809a6d88e6f3ba9066ba9790086d9e41c8d545a779d591d963879fb8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451405, "uuid": "9f51f84f-9ac5-4cee-8b5f-f1159413ce58", "value": "T130B401CE9520D295C4B02D33C57BA2F282EB6D3609596E1CDDD8FF6B2CB67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451405, "uuid": "43cb2881-9b62-434c-9cdb-63f1a1d6456b", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451405, "uuid": "80014430-2f22-42be-8a14-9370bb4b65c3", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451405, "uuid": "109baa39-f190-4f9b-8b0f-5ed9d7df674e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451405, "uuid": "deec3b4d-7dbe-4b67-8dba-5f1a22a3b192", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990d2778-6089-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752480454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480454, "uuid": "1de0a549-ba15-482a-b5dc-5276d0a1398e", "comment": "Malware payload (Formbook)", "value": "6faebc731b3f26f52538e43d1330f3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480454, "uuid": "9ee1915a-d2cf-4cbe-a4c9-b534ff15aec5", "comment": "Malware payload (Formbook)", "value": "28dd00c9360fc7d7359113ee5599e0d902fdab71305d9f8ac52e97ccdfb1858b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480454, "uuid": "b859da94-bff3-41e3-8b3a-f1acbeceb4f8", "comment": "Malware payload (Formbook)", "value": "41b68db65747a6896021398291f50c7ad60d0dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480454, "uuid": "37a9caa1-f420-45cb-8d2d-7ff311b69521", "comment": "Malware payload (Formbook)", "value": "10ad4edc51b79c986c5bf8603115c3181a33d87797b9dfe2aff578698081caf6c08317793ee8efaa9d624cc80107c52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480454, "uuid": "1742fe78-01f5-49e2-8437-30c251a3b423", "value": "T12CF40105A435DE02C0A60BB4AB21DCB0537BAD8CB425E7135DEABCDBB37B78150C1A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480454, "uuid": "9f98ace1-4d79-4752-99fd-7669b77e5021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480454, "uuid": "2b31bdd4-05fc-47b3-b28c-f316a2510161", "value": "12288:iV1/3plPNpoMVOLB1GDOdNsK16cVIgFbjZHiq15JKTvBMdGp4Tw1D3UOvtftw3M:KF5lPNO9LB0DSNZAcVIg9jt4P4w7BtqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480454, "uuid": "aec0d7cf-600b-4fe6-ba71-a6155bda3cb3", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480454, "uuid": "aad6700d-8e47-4a06-adec-ccf0cd5062d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480454, "uuid": "9b44ce2f-23fa-4498-821f-4dbc9514b276", "value": "1EHaw5ugQs8Ia5z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69acc5b2-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485099, "uuid": "524452a7-2533-4418-ac47-c7e34c9e1030", "comment": "Malware payload (Mirai)", "value": "64b4c1497839114dc1cda2d0a818b076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485099, "uuid": "9795d689-056d-4cd5-9100-d06b2c1cb168", "comment": "Malware payload (Mirai)", "value": "28f523e17427305ca9412bf157e38e54b2f98c87e4eb25201baf223ad5ee0f3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485099, "uuid": "45318c58-534a-4473-98e3-a827630bae9a", "comment": "Malware payload (Mirai)", "value": "1c230bf6efe4944beb2b7e4931d6b63c8e445567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485099, "uuid": "1d9cafd1-f038-400f-a893-90dcc12e1527", "comment": "Malware payload (Mirai)", "value": "2363d96cc7d2bab24905dd916240e8fc026cbd7d44a227b31b609188e56395c10ca5d3a25353a7b91bded71b6a0def73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485099, "uuid": "ac2f4680-772f-4c3f-ab0d-dcd6e8906b94", "value": "T19EF2F1A9014304D6EB0BD1F85B6743863D300FB6684F9E2F1F9D745EBEE50A11487AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485099, "uuid": "f1541511-25fe-4c31-a978-c94c20b62634", "value": "768:nTcnnv+toRrTOMSnbkbY9jyP5HADVhj3YLIYubX5JNDShFbbtJgGlzDpbuR1JG:Qnv+8rTOMSbkbY9FVhjaubpzaFbbHVJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485099, "uuid": "bda7d53c-736e-443e-b061-5ba14646b7e2", "value": 35160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485099, "uuid": "7c076753-0730-4c07-a127-9854847f249a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485099, "uuid": "91394c5b-da29-46c6-b8af-c8188bb67546", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab39dc2-6071-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752470095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470095, "uuid": "a4e384ce-d51f-4f24-9b8d-66292b4362c7", "comment": "Malware payload", "value": "d1617dc7eab5735f76e9949d56025cf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470095, "uuid": "63ce2fc8-133a-45c8-979a-280ddb5c4433", "comment": "Malware payload", "value": "2998d1f19a25f1719b61ec2f44158913dad4f3a5c1a2581d34f29f4f88622f2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470095, "uuid": "7381317e-7fc3-4fbd-bf70-8191496b58f9", "comment": "Malware payload", "value": "f47f9dc3b8a520d54a552886bb9454cb43b73415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470095, "uuid": "e72e135e-e348-431a-b573-6f40f5902830", "comment": "Malware payload", "value": "30b2466e28ba1aee84bcb0cd431d1ef5787cf81c428f9b0ae917bf10f69c04d4b4c43d1749b6a1d4878880645881500c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470095, "uuid": "f13b3689-5367-4939-a879-9a41c2fdadcd", "value": "T193B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470095, "uuid": "87241a0e-7e85-414b-87d1-61ece367ad0a", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470095, "uuid": "3a75d8df-27bd-4ee4-9d58-814b7bed7933", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470095, "uuid": "7967c151-887d-417d-8c54-cd488d6c33cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470095, "uuid": "435b7ad7-3cf3-4f03-b110-7014f69014d9", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7771dfa2-6071-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752470090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470090, "uuid": "6be7a59d-3a6a-45ef-9a12-2152641eeee1", "comment": "Malware payload", "value": "e31f1577148daef6af4340955f2f544e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injiect", "colour": "#E5E591", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vmware", "colour": "#6EC69F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470090, "uuid": "4c3192bf-3702-48c1-8477-8b09483940e9", "comment": "Malware payload", "value": "2a50678441b4a22d9cc88baeeec0c26a8217845ef4dfc3ee8695443ba5de5ca0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injiect", "colour": "#E5E591", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vmware", "colour": "#6EC69F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470090, "uuid": "930b02bd-0be0-4675-a22f-708f5fbe1d3e", "comment": "Malware payload", "value": "828eece266dce890faab4ae56f157a0e292ab62e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injiect", "colour": "#E5E591", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vmware", "colour": "#6EC69F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470090, "uuid": "6e572161-e2dc-40dd-b5a6-f5c74394d9d8", "comment": "Malware payload", "value": "34fab5ab54780f4c14ca2f9e833b9929ab970c0b2e9d3572ce8f0be057a4e7f0d8757acde75ca7b3b8b22049866850f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injiect", "colour": "#E5E591", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vmware", "colour": "#6EC69F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470090, "uuid": "57f08b2e-8a55-44df-9bba-ea6445acb095", "value": "T1EF532903B76A00BCD5AAE238C7876E13E6757848036197CF47C19A662F523D1EE7AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470090, "uuid": "884c60d0-5c1f-4c51-97ad-01ad49520019", "value": "47e7cfed26cff52cf9d8e618da530681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470090, "uuid": "4dd05d0d-1c2e-4d84-956d-1ec59431e56c", "value": "768:xOD9bvqHcZkTemSMDOfjrsBgV47UYwuvVw+O9OoVQqFIkiTcwJSz:xOD9zqvTXTOLrsB1F5vu+9thk/wJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470090, "uuid": "2e68a1a3-3a63-4bd6-87e3-c1e0d16859f2", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470090, "uuid": "d73a4a1a-8448-4a55-b5d0-4f884a2ca46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470090, "uuid": "46b33649-eff9-4575-96b7-1dd4f4608535", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95111b08-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752536711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536711, "uuid": "4f967c4c-01a6-48fb-bf7c-05aff1cc81f8", "comment": "Malware payload", "value": "ed33bbb4a1cba007cf2b42453cd4f382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536711, "uuid": "b504732f-cd09-485f-91ef-eafd0d1acef4", "comment": "Malware payload", "value": "2a52ff86556dd7437e335cf5c1d663945f884cf4f7bd9f6e1c692600a207372f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536711, "uuid": "6c369a44-e42e-471b-a5a4-c23908aecd87", "comment": "Malware payload", "value": "1403c7145676773a28c03ffab52c1dc01b60db98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536711, "uuid": "10ce281e-2ce3-40c1-b3e9-ad947d16704f", "comment": "Malware payload", "value": "87fbe13ed38a45f7b272d6fe2f1cc2d2fa6d7a4a4a04426cec143fb31c0191764fa55401102eeb4bc8baedbd3e0578dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536711, "uuid": "ac9136bf-c252-459d-8c5c-b1b4e2b3170e", "value": "T1F78533D622FDBD653D098B02B89C5A0FACB4AE6CBDC66A08404F79E0BD8D975D80513D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536711, "uuid": "938f6b1d-9842-4566-9cc4-f07ed273a751", "value": "24576:JVwhEnDuW6qVL6uWSqFxtUAjSwmtPQP7ENVx8ao9yiO6yQ5DVraAalewm:+8DeC+uWSqFSePie91O6yhAalewm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536711, "uuid": "8302fa27-f8c9-4508-b7f9-599ad0408930", "value": 1837180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536711, "uuid": "0332333c-3e3d-4cbd-9ea9-311391494091", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536711, "uuid": "eb362d98-e4ac-4bd5-a8e6-e1717b495ef5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeeda01-607a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752474050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474050, "uuid": "4ed19df9-d156-429d-89b2-5d0a1e409070", "comment": "Malware payload", "value": "cb7935b1da2d3994feb71b13369cf1ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474050, "uuid": "8d11b7a8-88ca-471b-a7fe-cd30528a9346", "comment": "Malware payload", "value": "2b1da41a2958c45f5bae45b506855b4e12c66e1b66927d063d1744e7c23854be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474050, "uuid": "e4e0ef11-26e1-4d93-897a-2574664968c8", "comment": "Malware payload", "value": "8167785bd8bfd66747698ede7c6808f2ca4b7e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474050, "uuid": "41ee1493-3841-4eb1-969c-0fa2e8f2666a", "comment": "Malware payload", "value": "fe9d4f8c034445ae89ba058dadd656089502ce19f36e9f09f4f948712c65708adbcc0283f2e99a4fa1240cee139fc11b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474050, "uuid": "3fd220f6-7764-47c1-b7d4-ffa943e82e2f", "value": "T1A0B402118F881F87C5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474050, "uuid": "c683f3a7-5ea4-4c9c-a1b4-151f48ab5324", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474050, "uuid": "6986d0a7-3104-4704-8d39-a7785934c28a", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474050, "uuid": "363e90b8-0467-4c85-8ac9-e934a7046bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474050, "uuid": "3ee0ca6e-7e2e-4e33-b65b-e6137a213c6b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a14f24-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752493974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493974, "uuid": "6b71e1b1-29eb-4d63-b0d5-56503c49a879", "comment": "Malware payload", "value": "2de040c28b1440dbbc8209007251eda3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493974, "uuid": "317cc227-a1db-47b6-bff5-378251ecf0ad", "comment": "Malware payload", "value": "2b3e99c3bf60b7cab49d9d8bc719aff06c7370d6672b7030cf8f09f05b85337b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493974, "uuid": "be94b289-01d0-49f5-9219-d65bee717a9c", "comment": "Malware payload", "value": "5ee078152958fa51d2217cc0cf5f0a85da7d3371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493974, "uuid": "ce62b891-860f-4c02-ad04-c6c20156fbfc", "comment": "Malware payload", "value": "f7c6d3596ade896d8207e0d47b15ed1e487ebe41fe7e902dd8919e2af8177378ccd528e881287ef9c99a1aa2c997fc60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493974, "uuid": "d5bbba96-9aa5-43ef-9ad4-e148b6d36cfb", "value": "T1A2E401037308A756DF4BA83A82CBFD31B7C2799113D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493974, "uuid": "d3bd9bea-f2b6-4daa-8d98-07db33aee017", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493974, "uuid": "78275b47-eef1-4d55-a996-cc3153fe5460", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493974, "uuid": "e6f61ce6-82ad-41ba-b930-9a49c79f0224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493974, "uuid": "e95824e9-7439-4aed-a507-70a0097bdcea", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64070fa5-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485089, "uuid": "53e0b617-4b67-47a0-a633-e961f7e57b7d", "comment": "Malware payload (Mirai)", "value": "d9451ef7aebcd6321c1896291099be2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485089, "uuid": "578ec6d8-e44c-44a8-965a-9e9098afbeda", "comment": "Malware payload (Mirai)", "value": "2bfde41977ba2bfa711606d114cdfc8b71dc69e1fb86270734e330e848aab715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485089, "uuid": "ea2cfd13-2201-4708-b837-9059c119eeb2", "comment": "Malware payload (Mirai)", "value": "a4b865bcab53f4153c74a3eb4d7f45a85ddc0745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485089, "uuid": "df7fb06f-f5f3-45ee-8cab-d35555e4ad24", "comment": "Malware payload (Mirai)", "value": "e95f84262c7a17b6294b9d74506cb583ae5eb9a32e152a303f55d1297339507cc4c65969208948beb6c47cfe74227630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485089, "uuid": "653b31dd-e5f3-4fb6-a218-d934627fbfcf", "value": "T13233F1B642ABAD62C17055F7152D949D64052338E3F5F10356264470EACB2F24AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485089, "uuid": "df9799e3-3541-449b-a44c-787d875806e7", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JK2L9VE8amFZP7R3m:Soqs2Twh6P8JK2LJ9ZP7R3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485089, "uuid": "f72da73b-78b6-4c35-a11f-7043ca54e373", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485089, "uuid": "7a885a6b-c6ba-420c-9661-a5fbbdcc6cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485089, "uuid": "6a784320-3615-4c3c-911e-d142623bdc7b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaa75b1-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513154, "uuid": "6d243299-4972-4df4-b660-6ef7223d08b0", "comment": "Malware payload (Mirai)", "value": "c5058c974f714c50007a694ee78435b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513154, "uuid": "95752fcc-2d69-42f3-937f-dd85403a8a92", "comment": "Malware payload (Mirai)", "value": "2cc4778422de956ecca542c598ce14f65b7db14a5665d75fca776d247883b44e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513154, "uuid": "27619a64-d230-4137-aeda-0961a9859da8", "comment": "Malware payload (Mirai)", "value": "e057010b5113c6260d85a2c342ea40db8d865443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513154, "uuid": "152ef8dc-9a89-4d58-b56d-6c5814c945b3", "comment": "Malware payload (Mirai)", "value": "bc2d22cd4f9fbf81f7aea4b97956b05c2ffd0ff4cf94be3398361a84e75c284161add2528bee667f9e54cabce65b33a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513154, "uuid": "ed837b29-e543-4ad8-9c1d-3d56c1822435", "value": "T10CA3B74E6F218FBDF768863047B34B25A35823D63AE1D6C5E2ADD6101F6024E245FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513154, "uuid": "1e849a70-068f-4ea5-8faf-a9dc5338c2e7", "value": "1536:O3JMGh8fDuxnq2Y4ThQJpRsq/lsYXmih+e0jWSjusBcr:DS8fOHY4SJpRsq/ZXZij/cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513154, "uuid": "e628091d-313f-4472-996a-64fddb620ebb", "value": 105976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513154, "uuid": "d14755ab-2b92-4cbc-a4c7-b27dbb52ea8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513154, "uuid": "9223a4e5-9ff4-4f62-810c-e01131d9430d", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d29031-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1752477850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477850, "uuid": "e5eef303-c47b-4009-8d2f-247993b05d9b", "comment": "Malware payload (SnakeKeylogger)", "value": "e350975821f4081aeb67d957477bdac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477850, "uuid": "fe1f1aa7-3ddc-4778-9f71-b3dbff08f083", "comment": "Malware payload (SnakeKeylogger)", "value": "2d8dd1c17b2241ea324e5abd1ec3c889a3bdf414e2bc0898b62956473bddf27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477850, "uuid": "6fb3cf5c-9ed2-4cf2-9c34-473c216cee53", "comment": "Malware payload (SnakeKeylogger)", "value": "cdd68ebfa9fb6adce5c3ddaa1c964e7abdf22d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477850, "uuid": "d292e5a5-f7a4-4c06-a2bc-c6b8f0cbadc8", "comment": "Malware payload (SnakeKeylogger)", "value": "25c432af07b2f871de262389a2e3191185f5f684cbd5ade6e0817d53b68b5874d6938b7b048f3ae6a085b73dbf22331d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477850, "uuid": "2e7fc5a8-20c0-40b2-b418-52e5d4538ad9", "value": "T1FA15E01CFEB29EA5C69D1F7AC013015445E7D067E262F2279CD828F16F29768C88F993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477850, "uuid": "ff9339fa-181d-4f9b-be8f-4e0da84b1f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477850, "uuid": "4cfa176a-db13-4323-bc98-305fdacefc83", "value": "24576:lks5P5QMbDa8f6iiQ47UuE3cbzWFV++q:lvei5dobiFzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477850, "uuid": "5e7c17c7-8772-449c-be11-a47726a005a1", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477850, "uuid": "eda7d926-4135-42cf-9013-b5e0a2216e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477850, "uuid": "03ef494e-cff9-4276-a407-871e89e534b6", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c08a12-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503690, "uuid": "d42447a3-ef2a-423c-9343-3bdf3f866962", "comment": "Malware payload (Gafgyt)", "value": "5ed0a7124f1e1ee02b7720db957c7894", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503690, "uuid": "8bf94958-c6b2-4893-aa97-93ddbce7fc7b", "comment": "Malware payload (Gafgyt)", "value": "2dba14e3643424d11a8bc9c0c22033c762cfc0d229213ccd0a97a6bb62ccecd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503690, "uuid": "bd58614a-6a4f-4d2d-8ec5-3d4e79505618", "comment": "Malware payload (Gafgyt)", "value": "39bfb649d67a93199aea62af31b78d527730a7e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503690, "uuid": "0abe3b05-b538-4007-a265-d66e431a7d2c", "comment": "Malware payload (Gafgyt)", "value": "c119c1791fda8040baf28e6af9af2e7176091bdcdd9f92d860c06251a8b23189d2f84484b620934d57d873376e0ffcd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503690, "uuid": "9b1afe5a-775d-416e-88fd-5c6f59b19acf", "value": "T1DB932B12AF041A4BE0D70FF06E2767F143E986DBB5AA9D85E60FFD045530432A25FDA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503690, "uuid": "4113e9f1-ccb2-459e-8977-827f262bd39d", "value": "1536:1umAf7MELxHl0pp/ju8NhokfhuJ2/05NFdM8JVT38Rmhi:1ufMEZouihnIg/05N38Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503690, "uuid": "910801f8-3db4-4edd-95fc-f3130623c1fe", "value": 91796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503690, "uuid": "6c83dd51-b7bd-47ef-b5f5-93919028cfb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503690, "uuid": "a9f62e6b-1ca8-4336-8405-c5e82e7cbe20", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b0a160-6082-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752477569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477569, "uuid": "394a945a-5a09-4cf2-8338-a15ede3d607d", "comment": "Malware payload (NetSupport)", "value": "698739c6e32e2ea5b80dc9c7140a8d14", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477569, "uuid": "905c4ecc-82b4-44d8-8a25-6f7dfb07a58d", "comment": "Malware payload (NetSupport)", "value": "2f5bb9cc54e27098a4294cb1f1e6d769b5be5671b0707a591e9e644520dcccea", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477569, "uuid": "8b8c74b2-71a6-415e-a3fc-4eab7e5a6c2f", "comment": "Malware payload (NetSupport)", "value": "ada8b367cf57f2d91e4b3f3487d35350dfc66a91", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477569, "uuid": "5036b3a8-cf11-4cf5-8528-b2109611b258", "comment": "Malware payload (NetSupport)", "value": "6eb49cef63af73ae68090832af07699111ec6cae75d6d6ecc5f0ea3039c4bbeb723a87518d8990b7bf53f68b9c7f760d", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477569, "uuid": "76b17437-50bf-43de-9901-db08159b57b4", "value": "T1D4A2D016769C7062FF749AB5248286004FB3B84F53EB2090F6D0E9E9BCB12745BC3856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477569, "uuid": "bac27084-b2d5-4ee1-8e9b-af30d8e3b46e", "value": "384:Q2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSf7gz37G:Q2+x6TLKQXK1myQCSr2VS4jTXaRnPDgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477569, "uuid": "d0f966b1-d64f-41b9-9c8b-4c6f2e3c5372", "value": 22170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477569, "uuid": "fbf83cec-d8c4-4a3d-b7a9-4769d37192e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477569, "uuid": "375d65ec-8d2b-479e-9498-b9dcd8db437a", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e9e9e6-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494801, "uuid": "ec85fe67-66bd-441d-943c-52b2fbeae902", "comment": "Malware payload", "value": "cdcc0abcfc80930d109568d9378fb7fd", "object_relation": "md5", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494801, "uuid": "2b5e5bbb-0ccb-47b6-8798-2dab8681e9f8", "comment": "Malware payload", "value": "2fc1b12d071c2879b133f3fe3f9a07dc5682b674ad2edb5efa1e7215bf1bdd45", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494801, "uuid": "31f84993-afa4-4fb5-93f6-73428a64f917", "comment": "Malware payload", "value": "ecb7e840616cba717f746856a176b594d1a295c8", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494801, "uuid": "8ef7f93e-61f0-4a1e-9698-b6d861d2ec61", "comment": "Malware payload", "value": "d3a666ce122e59e2ec7c0918afb9e4853a0ed2c529142c72130500a762956eb15e9340319ad4c0c1c5d463aafec90280", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494801, "uuid": "43d0620e-90ce-4bb5-947a-da9b7d075804", "value": "T169513BC84CD8EF5DF906CABDB5648C01CA1D704C875BD381BE9B41583538152938BAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494801, "uuid": "9467aa2d-e6b3-49cb-a2c7-3e92b00829b7", "value": "48:99tjMQypwjR2+x2mN128cZ4CjPMLoR7J5mTJCEOrOAZ+jwmvRY7adxjje:DK1r+x2m+4CjP7iT4y++jPRAadxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494801, "uuid": "c665e5f4-d5bf-4e8e-9770-6b0c97308c90", "value": 2825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494801, "uuid": "2175c488-3e49-42b2-a142-e59f93c20cb7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494801, "uuid": "dc3b6dee-ef41-413e-80be-e84fe04c1c21", "value": "GJxOgMJArWiDnFVS7UAoq.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b59008-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752503936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503936, "uuid": "6007a5cf-53d1-4d68-8df8-d0af0ca93f56", "comment": "Malware payload (Mirai)", "value": "4f72e3ae2a06c2ddb920ecac4881608f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503936, "uuid": "29f3a1a0-b1ba-4bda-b7e5-63e794093ec1", "comment": "Malware payload (Mirai)", "value": "2fc2fac9c5fe6700a4b583514c2eadf867091d24104de85020d32c14cfddf62b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503936, "uuid": "e823d53a-79dd-431f-8426-e9589aaee63a", "comment": "Malware payload (Mirai)", "value": "0fe5d19ca9d67a0e8646448f541c116077ef678d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503936, "uuid": "8e65cf78-bcfa-4fbb-8943-29862766baef", "comment": "Malware payload (Mirai)", "value": "5fc08523a2c8e693bb31a8f6d486d5237c40a691063d6b8fc26d69689e2f823784d6616412783932537f687692164cf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503936, "uuid": "a184d95d-dad2-4924-837b-fa1eb5303463", "value": "T1B6C32A56E7408B03C0D62B79FBDF435133239B64D7AB630A9628BBF43B827994E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503936, "uuid": "feeabce5-8b90-4158-b41a-8b1df6961917", "value": "3072:yuBa/rIZo48TPpsXXCBV9IHIFzIz2uM/97mDQfkhcgP:LBa/rIZoFpsXXWV9IoFzafM/97mDQfaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503936, "uuid": "b542adc3-251a-41d4-bde6-e93af2b0ea76", "value": 129500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503936, "uuid": "f173fde7-6fd4-4209-bb11-f19303cbf4ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503936, "uuid": "dec7ff3b-3f8b-441a-b389-35bdb636c451", "value": "proxy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a6dbdf-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503700, "uuid": "66db4ed9-d93a-49c7-90e9-431b7db8b9c6", "comment": "Malware payload (Gafgyt)", "value": "075633e1950ed123717eb4e35f9661af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503700, "uuid": "7c6ef78a-f399-47ed-ac4d-bd1b4f95cd8d", "comment": "Malware payload (Gafgyt)", "value": "30500cb3036ddb3b86c497a7bd9aa510834706f5f4bf28814319eeb6bce6d0fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503700, "uuid": "dbac2deb-9582-48b4-a0bd-17de34c92a6c", "comment": "Malware payload (Gafgyt)", "value": "b9c75ba4a5cf5d8c83c6786feb894d70a6928a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503700, "uuid": "2f09bc7a-112a-4ce4-bc3d-2419332243cf", "comment": "Malware payload (Gafgyt)", "value": "30a00b4884178ec854941963e4ac2f8ad441c7e59f98be156e5a2cf9bab1200362d63781d27cd5f72bdc1afe46c15901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503700, "uuid": "4b7f1272-89c4-4e5d-8d46-551a72b720f5", "value": "T1706342AA5591EE1CE473E2FDA10797B109C29FBC29DE41C36B0BB4318734A012F5DE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503700, "uuid": "97a9f0b3-371c-40d6-b037-3bba5861d43a", "value": "768:z78bij2/yDx6BjQdmYCGyA0URbGHmudH/dTEq6Kc3kVDgXU:z78ONkxymtGy86eq6j3kVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503700, "uuid": "ded89b91-11f6-4906-89f3-8ef4df7709d3", "value": 67220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503700, "uuid": "b47827b5-1871-4c2a-b019-2eaca2dc7304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503700, "uuid": "6565334b-6498-4939-9061-c244d7048365", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5317475-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752513653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513653, "uuid": "1ef8c162-81aa-4dcf-b4eb-ef9b99905460", "comment": "Malware payload", "value": "0b1a8e7c852b8036a9b857a2de74974a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513653, "uuid": "a5c1708d-e389-4601-a098-ba73fa476655", "comment": "Malware payload", "value": "30e77ea7498b3fd532fe3d50293da03622d8b1c12fe47581052d37cceff1eabe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513653, "uuid": "a694be31-f877-4bcc-952d-fc7382f8b249", "comment": "Malware payload", "value": "9c1d5cba2e686529d8f3fb34021e66c31f7d9219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513653, "uuid": "d568e647-3af3-4ced-a55a-1d3dee27c328", "comment": "Malware payload", "value": "65061c08d9ad292ad33ac6071ff5cdd0ea4df276509231c09808676c671fbc6146e4803011b1c8a56a10181524ed6bcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513653, "uuid": "86a3834c-bf23-4d1b-a8b3-d9d42596e871", "value": "T19CE4F1037308A756DF4BA83A82CBFD31B7C2799113D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513653, "uuid": "e2db0ffc-4062-4351-afe8-ace0feedf6b8", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513653, "uuid": "c9dc3850-4965-4de8-bade-8acb6aab64ab", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513653, "uuid": "f2a44346-778f-43b0-944d-c8533f99b27a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513653, "uuid": "553fc056-8b67-4ca2-afa2-e6f847fb3d86", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a93b351-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752477853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477853, "uuid": "f09ed42f-3aaf-470d-a8cf-3cdeaf42b58f", "comment": "Malware payload (NetSupport)", "value": "39bbec7d139bc77a8e25d21c4daca2b8", "object_relation": "md5", "Tag": [ { "name": "185-163-47-72", "colour": "#FE7D78", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477853, "uuid": "5541b48c-dcd4-4b61-8b80-b04f296a9707", "comment": "Malware payload (NetSupport)", "value": "30e9853cc6efd32ffd9ea523418bf3c8bfdb7357661e4b117b9281afb7fa457a", "object_relation": "sha256", "Tag": [ { "name": "185-163-47-72", "colour": "#FE7D78", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477853, "uuid": "530975eb-9183-400e-b884-642445ba79a3", "comment": "Malware payload (NetSupport)", "value": "5ed787dee15c1eb0d723feaf276724b28db7b44f", "object_relation": "sha1", "Tag": [ { "name": "185-163-47-72", "colour": "#FE7D78", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477853, "uuid": "878158e1-9ba5-4333-bdf7-8494371a4166", "comment": "Malware payload (NetSupport)", "value": "5ce8f404acfb60dedd01e43ff5dc237b14e0b1872ea73299f30cae570c84712d3af312b5f14d5279b47e8042563e524c", "object_relation": "sha3-384", "Tag": [ { "name": "185-163-47-72", "colour": "#FE7D78", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477853, "uuid": "46349c6f-b3f7-4a36-9f7b-01dff5db0145", "value": "T10C56338D8C7916053608F6E11DBC7F88AC93851F3E49D63DE62C952FB1E89DCA3601A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477853, "uuid": "9c6d6019-16ae-4535-839d-63f2dfe2796d", "value": "98304:/srKfaWGPd1BYAVq3G6sp3Zp5u4fIp554f8p5h4fpp5u4f8:Ur6GPDBYpsp3NrfGCfKKfdrf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477853, "uuid": "ee67794d-a9d0-41a0-be3a-51c0dc63662b", "value": 5920313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477853, "uuid": "8e75ebc2-61e3-4736-919a-aa7e4dbddef6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477853, "uuid": "026889bf-8aa1-4a2e-b468-8934395b0e9c", "value": "30e9853cc6efd32ffd9ea523418bf3c8bfdb7357661e4b117b9281afb7fa457a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa4ee6f-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501779, "uuid": "016fa3e5-6c0e-4b51-9bf1-bcd36e70d4d9", "comment": "Malware payload", "value": "702b54b87974f3d40dcbd7ba1ae06a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501779, "uuid": "22e7e6c9-6b3e-4d98-976c-1eef9e5a6716", "comment": "Malware payload", "value": "30f9b61ba8dccf834caf0f9e3d11b8ea688f674196ce675b3d7d1b3b4fa5f3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501779, "uuid": "2b11b241-1684-49bd-8abe-06bddba13adb", "comment": "Malware payload", "value": "9b9d2f7d6e76b92ff90f80948cacd953f66f194c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501779, "uuid": "c32e1d3c-3558-4f09-b8f3-7febc95de337", "comment": "Malware payload", "value": "2a4a4dcc90f89d9e4af1995729c3ba828385fee78004bf5149023f52c6680454682ff53f7012fe7c217994a08fc3b838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501779, "uuid": "2e700043-6e5d-492d-98ca-978c769325ab", "value": "T105B633654A53CE43FC08A33AEE76450A035E9C5D45A7C728A9DFFEBFA060944268721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501779, "uuid": "2b6ecce1-5a94-48a0-a27e-e57b84b77d60", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501779, "uuid": "a3c0da13-04f4-4848-b652-b339279032e9", "value": "196608:LSYrLoFmRor5uwsXMTEHtPW+BKir88gWBUtPpKAjPhtj+aumePyWqKM8P10mwwV:4FmOkwsXMTae+oCkxxKuZtdWFAuFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501779, "uuid": "54a1a3c1-2d42-4a5e-aa6a-7cb4cd7765b0", "value": 10675200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501779, "uuid": "29e8bc63-1cb9-4bc3-9710-b644fa557974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501779, "uuid": "fe086892-bc30-47cb-af2c-56dc1f87732c", "value": "Installer_v409_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0280238e-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536465, "uuid": "03afdc04-2806-4aa2-b741-39b3952cbfa5", "comment": "Malware payload (Mirai)", "value": "4cc9ea06b37e948236eccb416c870fb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536465, "uuid": "b05f8cc9-a24f-4c77-9508-5d2a24784491", "comment": "Malware payload (Mirai)", "value": "31347db50bd0e95359d022f093da508c3dc17420c30273cf44850aafba57e661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536465, "uuid": "45ccc6a2-dd82-40bb-91cb-6ac40e347fda", "comment": "Malware payload (Mirai)", "value": "88136939f12e36ced691ebf992b410a419d6eabf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536465, "uuid": "35556efa-6fc5-4ab1-aa3a-e23f3a4b72a3", "comment": "Malware payload (Mirai)", "value": "4d02b75b083d9738ed8ace01f85b28e70e4ed0fde2e4e50a29f0db8dfccb6ab925f30a890cbf877e00e9504b2a7a1df2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536465, "uuid": "fb524459-c115-48ea-881b-981b4afeb86f", "value": "T113735B82E28BD4B6F52100BD31767B71DE73D1FB54369A87E3688861AC264419327FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536465, "uuid": "6091717c-fd98-4a4d-ba89-9c7586fdfda7", "value": "768:mW9SFiyxSxHGz+YKRK8GF4XIUStGv3JnaNhfTv/YCWcYjiQoMjBMc68p1Ahh82l4:MFiyVKRK8PRhaNhe+HIucFA02lLoWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536465, "uuid": "64e9e36b-2f89-4e90-84af-6dd04ce50fcf", "value": 79084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536465, "uuid": "e737ae0e-4faa-4872-8715-2964fa310d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536465, "uuid": "785a8aca-2091-4cf2-88df-48231b28a92e", "value": "getty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba55da24-60b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752500696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500696, "uuid": "a57c754b-9c36-478a-ae6c-da52cf2af37c", "comment": "Malware payload", "value": "54d7a9106510d7e9043a065ce6ec9055", "object_relation": "md5", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500696, "uuid": "58bf9170-2eb0-4c28-b9ed-e52af0d83f96", "comment": "Malware payload", "value": "31a53c1139e4b1121cde97d6d4b0611899293c4e7bd4f93a698677e110a0efce", "object_relation": "sha256", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500696, "uuid": "86fd95fb-679f-4f35-b208-d27415c6efe8", "comment": "Malware payload", "value": "3b5d22af9790503bcd83066987cf7d750f41d01d", "object_relation": "sha1", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500696, "uuid": "8b43adc8-1dd6-4d43-9417-993746cbe7d6", "comment": "Malware payload", "value": "75858d8633c2be3d4d37c5c0a25f122cda87369fdc4bf851571378e6f7b376c30f9c45f0076c2758062ccfa51d9c81b0", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500696, "uuid": "d9bac3b4-5883-41bf-9063-e64806fb63cf", "value": "T19BE23B2FD7E288B5C0709EB1441DC21CE2BB2D31346134AE46AF5C1BDEDAD45156FA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500696, "uuid": "771d2508-db22-43da-b875-d488694333cd", "value": "768:LgmQp/ija+1IGGr6qBwdqMUIJwhf8fPuVddIo:LgmZGr6q2Jq8fPWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500696, "uuid": "a606cb96-b3dc-44f0-8ce7-76c35689f53f", "value": 32767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500696, "uuid": "7be616b5-cd2c-4f4a-b4c1-9cabe287f285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500696, "uuid": "2d40e01b-b9b8-4538-9cd6-678b61a63d2a", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80483b17-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514772, "uuid": "417fbdab-3f48-4d98-a281-3b5c0339b3f4", "comment": "Malware payload", "value": "9041ea7e22b1863c1232ae9ea75de8a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514772, "uuid": "0c120f8e-39fa-40e1-96b2-1850917018de", "comment": "Malware payload", "value": "32226e45de5fc5f6edd584fc05c716bd0e4ba34bf9ae28d1e9e5b01e92189af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514772, "uuid": "a1972479-8768-4998-85fc-d4457fa602c0", "comment": "Malware payload", "value": "894def8926755cadc99b0bcff9c3f90b76140af7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514772, "uuid": "bfd88a8c-0085-4d2e-b4a5-6ae03f8e0558", "comment": "Malware payload", "value": "d3a24dcca7ee4f2ee87446f0d9e0cebe609f2d70de273c9be51fa144a2c6e872e0f4c2c0299e432396372a70e0ecc65e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514772, "uuid": "8c89d7ef-16e8-4a67-8c01-781ac1d72df7", "value": "T105C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514772, "uuid": "4819b30e-60a1-40a5-b185-bd1f42f047fb", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zm:W7v+mrY2xzf03yvZ/YIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514772, "uuid": "4db5e1ae-7695-4565-947a-d6d8d48a703b", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514772, "uuid": "7500714d-9f9e-40c5-961b-f95491258ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514772, "uuid": "b3dfb784-d2f5-466c-9a3c-195d66a3de5d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d29bdff-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485078, "uuid": "5fbfa465-807b-4afd-a79f-e70816369cb8", "comment": "Malware payload (Mirai)", "value": "b947c774323f9ded9af027f7c58e8d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485078, "uuid": "7c6b3806-636a-4772-ad29-a4a8f3102b7e", "comment": "Malware payload (Mirai)", "value": "32376283c220a31178fa3aca5159a4b945bb775d6038cfa889f92ff69c66af06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485078, "uuid": "313001ef-e417-4189-bd0d-278607355f72", "comment": "Malware payload (Mirai)", "value": "b8e437f6b91a3746db49682e7f5458b7f9dc3175", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485078, "uuid": "3677639c-b0d0-4d7d-9122-2a8511307447", "comment": "Malware payload (Mirai)", "value": "d9accad7a76fcd188a8436ad0ca6eaa50f4e32f50f1e121c0e972a01251aa55b14579e33c48da149f4f420bd706b5ed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485078, "uuid": "8d1464a8-4457-4354-a784-f4c0c75ab166", "value": "T190B2D0A1515279B3CB24563EA979C1400BE7AAFDB4BF72372F24927C6B51806187818F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485078, "uuid": "a8893837-63b4-4219-8fdc-44d3fc3285dd", "value": "384:MZUX11S49enZh57fYONQ/yQVQbFU228dXSdjPeL0/817WhkU1hymdGUop5hKT:nX1De9kONQG5UASlPE1ins3UozYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485078, "uuid": "24373797-9cfd-4c9a-b08a-73539102f9ec", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485078, "uuid": "5559e37d-0014-401e-8e22-0327ad41c420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485078, "uuid": "a3a0d32c-7005-4d70-95d4-b24833bc765b", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65ba2b1-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473738, "uuid": "ef7dd3b7-40a8-47f8-9485-0caa28786dac", "comment": "Malware payload", "value": "4e22e997802f5f82630c11410da66cdb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473738, "uuid": "9639b75b-cd9f-4c03-a935-fc977b5cf93f", "comment": "Malware payload", "value": "325578eba7152974db1b7fac8751f0a0f994c095a1f6220f9aca428eca901944", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473738, "uuid": "5e3cad17-8aa9-447a-b8d7-ea56bde3c43a", "comment": "Malware payload", "value": "8e7e90899a6e0d26112aaa4dbb609746a77260e4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473738, "uuid": "04e7d502-4c76-4d10-a7aa-e22ed2a27e96", "comment": "Malware payload", "value": "fcd80e43e0fb3392024f81b8ff9b32948bb9794bd6d5d7c68e94c5526f2fbc1e96c559869e1ebe0040ed817eb87f20da", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473738, "uuid": "fcb0c0db-2246-440c-8471-50e61b792508", "value": "T162762346FB29A90FC8F3E3321935123A1036DE16CB07E757A61477B964B7AF80B066D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473738, "uuid": "54349b83-5903-4dd8-809d-674a2044125d", "value": "196608:cuLjeW8Giks+HvV8um8iqfJCYEfTjMzR94+XnKHOvKzfcz6UH3x7zLpHaxJ:cuj7nftbh0vbjKR94+zKO6UBmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473738, "uuid": "b039b1f5-af34-4376-849b-7bd2e279120c", "value": 7674477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473738, "uuid": "927f9a3a-a522-4813-82a9-857ac63496a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473738, "uuid": "3a53f157-5475-42e0-82eb-b457988a8453", "value": "app (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc2b582-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496888, "uuid": "dd86fa99-332d-4ddd-8fb8-0882cdeddefc", "comment": "Malware payload (Mirai)", "value": "7fbef94065bbda03d2cf648e84c7507c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496888, "uuid": "3481873a-d5f4-4c73-9894-c432fd7648b2", "comment": "Malware payload (Mirai)", "value": "32716ce19d3720927dfb6f5e21381de1daa48a41f323b3bd9ed8314e135a8f61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496888, "uuid": "0bb3d569-042d-478b-87c4-d8094c0ef239", "comment": "Malware payload (Mirai)", "value": "bb70d0b1e7b0e341e73e807254cb1bbcee9e01f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496888, "uuid": "8fee38b1-9b54-41a4-800b-a8bec3eeae80", "comment": "Malware payload (Mirai)", "value": "2d0f6b65644d88b4c98549a4a110e1ef118ed09fb84185011d8e163ccd95d92dfcb8a92617e54b33bc675ba05013c653", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496888, "uuid": "2b682ec9-0be6-44e2-b04f-af780a8471eb", "value": "T1B81112FA406460191088AB50705B8A796EDBF7C0703A1BF5957FE4E798CB9907714F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496888, "uuid": "251da375-2d8f-4c3b-b9b9-e659266a8c60", "value": "12:2TL2+DTL0aL+DTLqNIQQA+DTLXvK2H+DTLhKA+DTL5+DTLJ+DTLU5+DTL8H+DTLU:236KNIT/KL8V0E0UceUysV9dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496888, "uuid": "aebf5092-6f42-43a1-b6e1-e317f463377e", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496888, "uuid": "56768ae2-602e-44a5-85fc-7d784b64ebdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496888, "uuid": "b4ffb656-46ca-4c57-af78-122f281f491a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f07855-60c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752507498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507498, "uuid": "97ac1ff5-fe53-4562-95d9-5bb8f924fdb8", "comment": "Malware payload (Mirai)", "value": "0d222a13fb587d278d2b98093f9ad2f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507498, "uuid": "1e8ff478-2315-4533-9805-a2c0d85e5798", "comment": "Malware payload (Mirai)", "value": "32ee9608c05bd0b9e569a4be873e4c82bcb1ad7c63e408c2c43cd3e9859bf4f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507498, "uuid": "104637cd-165c-402b-a3d1-985929a61a39", "comment": "Malware payload (Mirai)", "value": "67a5e6f6c0ef0d81f5df695a60ded597af47ee47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507498, "uuid": "a3c76fff-9363-4afb-bdee-763084c3aa57", "comment": "Malware payload (Mirai)", "value": "e75e0bfc8ad9791978450207d3d47dc7c5a4ba1ff5bea31071ad3660f932c4774de5ef7458f87972824c2aaf8a0c015c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507498, "uuid": "c89ccbba-15b6-4b52-baa5-087c5cc74979", "value": "T1DB730856B8818A12D5D502BAFE1E118E33131B7CE3DEB3129D206F24778B96F0E77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507498, "uuid": "73d55a25-fa65-49dd-89f0-ab049288daf5", "value": "1536:lNnZDsb0sZjGCsG7UMM2Ta2aS1kQSMain9N+lC3DcE5CY0:1sQstGRG7RZTau/9klC3DcEET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752507498, "uuid": "15a5922e-ac91-4a13-980a-662c7ec65e53", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752507498, "uuid": "7ff8f6a5-85bd-4cdf-b588-a74f64a8adee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507498, "uuid": "13d587fa-a4fa-4e18-97da-db53546c2cd2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfe475c-6073-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752471173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471173, "uuid": "e2999e09-7d87-4a7d-98dc-dd69b129e29f", "comment": "Malware payload (Mirai)", "value": "0640b451bed04e1b9482c03f3079e819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471173, "uuid": "03dedd4a-c493-4025-8c35-6e24521481ad", "comment": "Malware payload (Mirai)", "value": "32f18f7a507bbe300d537a491b6c9ad12a7d35f6c968d8255d8bf65eacd7fe86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471173, "uuid": "598f391f-3162-4218-9bff-47476b1690ab", "comment": "Malware payload (Mirai)", "value": "4923367cdb9257d822c53bfa68424a89897ae5aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471173, "uuid": "fe1d4ff7-f8c5-4866-9b54-6b12edecd933", "comment": "Malware payload (Mirai)", "value": "57d658ebd9812dd29b58f80a2ff3c98810c1e0cfa926668a9582eb481c2e1314a3912dc9c8b0db1fce4c65b79b5101ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471173, "uuid": "ef45cf1b-74f8-457a-89b3-166726f9b852", "value": "T13DD31945FC419B17C6C622BBFB5E428D3B2A17D8D2EE3203D9255F61378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471173, "uuid": "9a97bda2-673e-4ea4-ae30-90cd536e3cce", "value": "1536:Wwo39hQu3IQfVktrmTYA1hPj4VkyZTTMqTHZuF/FZE2MVKQluywywJR274JRRdef:Wweh5OyTYc74rZsqTHQvy28Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471173, "uuid": "4baa251d-0736-423e-b9a5-9f5cf50b2a6b", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471173, "uuid": "ff165917-2a83-41a7-b1ad-05ce5f7c250e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471173, "uuid": "db56dcb5-f4b3-46a1-9743-8c38ab5fd211", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63731aee-610b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536198, "uuid": "a2f3cca2-0c3b-4fa0-a109-85cf791a0d0b", "comment": "Malware payload (Mirai)", "value": "d0abd6fc0d838e5d307e9f2d971a2362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536198, "uuid": "7b8fd264-ab32-46d9-af28-ddc46757d6f5", "comment": "Malware payload (Mirai)", "value": "32f3660ac065b6c008edb8ab5cdbcb967b302475fa443964d986b13a57b479c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536198, "uuid": "15d3153d-e7cd-47d5-b44a-2093179af536", "comment": "Malware payload (Mirai)", "value": "bb39f3dc3387c65efdfaca795a16d065315c457c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536198, "uuid": "a9befea1-8716-440a-8d09-2439296a2de7", "comment": "Malware payload (Mirai)", "value": "dc836ad478395713509ded75b2bae1cf7b398d89f64841bebbd1b294ea8d57f8a840ede3316e329876260d4451082301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536198, "uuid": "06a623b8-3a13-4dcf-a286-697c803a5aa5", "value": "T11C63975A7E214FEDF26E863447B74E22675823C623E1D785E29CE5101F6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536198, "uuid": "d59c5f26-5ba7-4b74-845f-edc974e8bcb4", "value": "768:X1kMOOfmtdFKq9+PY+G4KTH2au8sukqOJqpFVk2QkbxA5jyglledVIcBCGw9Idl:X1ZxmFKq9aYsmlOaFVU+KreQcBCf9Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536198, "uuid": "eb2308bd-4756-4949-b481-a2526076f680", "value": 68260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536198, "uuid": "72124603-63fe-4f7d-a08a-cfc20b655199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536198, "uuid": "34e0b0bf-791c-49f0-a256-5a3a5f191576", "value": "fsociety.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcd3743-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485186, "uuid": "170379c9-8014-4d22-a240-1a84bb62d477", "comment": "Malware payload (Mirai)", "value": "67e4c6bd243f08d4d3f19fcb468f9953", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485186, "uuid": "861af81b-94b6-4cad-ad6b-65434d4759de", "comment": "Malware payload (Mirai)", "value": "33ba45d9f54e71a93f92485106d5321c9a642a935452a8ae53871ceca6f13a50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485186, "uuid": "c8c918c5-c4ac-4d5a-ab11-ae2831de13a0", "comment": "Malware payload (Mirai)", "value": "b50cd40aeef43af52c2856a2338e32ec508812e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485186, "uuid": "91bbd265-4117-4063-abb5-0fc2ab911245", "comment": "Malware payload (Mirai)", "value": "dfaa7ec405e9147417953884d8fb4fd280441bfd8306959594a34a6ab667c27cdbd22ad36235a7630f9affbabf6d9217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485186, "uuid": "d4c873d9-3386-41e5-a9d5-4656af4be666", "value": "T13C83B6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485186, "uuid": "401e6eea-1883-4ff8-9cba-ecc527fd5dfc", "value": "1536:E6/iw/0w8HoQ5uy8NxQlcJ0vXxh11xYqcn6BZOpkMoAsgR:x/8RHTgOcJ0fmqJZOpkM/TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485186, "uuid": "4cecaf99-2cb5-40d3-8bc9-518ae8ff33ad", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485186, "uuid": "9a9b1755-77a5-4abd-9a06-e275d6a2047c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485186, "uuid": "56263aca-4f20-43be-b747-1e624b61d495", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d954bc-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752495694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495694, "uuid": "194d1613-31ab-43cb-bd6d-111bd4db199a", "comment": "Malware payload (Mirai)", "value": "3107f1a81b41747cecee6f1865720d68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495694, "uuid": "6a38e93c-3c8c-49e7-bfba-7f55ec8c3d31", "comment": "Malware payload (Mirai)", "value": "3405bcf84e88b758d9f3975771c5f89a6528e4411cf01f44b18dc2fcef37a047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495694, "uuid": "24f63952-d897-443a-986e-569b28ad3ef8", "comment": "Malware payload (Mirai)", "value": "336b191526e1b794642a328a2cef83fe0bbf78c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495694, "uuid": "d09055a1-e2df-4d55-866c-d684799f0042", "comment": "Malware payload (Mirai)", "value": "61bba8da740a6333ecdab0e18588593c032afda6656067e7890357fc0e9a1b805f37259a3c5ccf38c3050423b701b170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495694, "uuid": "9f1abf81-a76d-4015-813c-19612ed614ea", "value": "T10803E1B5E9A0B1D05E62FE764C7F580ABC485ABEB29F61103675361B612310F5DF0983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495694, "uuid": "b2c0a8c6-fa83-44a9-9736-a8fb207d84a1", "value": "768:KVu4Phdaa0ehjgASifot8w/X5vgEhtVlvBTRFDRkT4rRUmoIyFJlj19q3UELRt:KgQhUoq1GEhLl59TkTq/tLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495694, "uuid": "e9544074-7adf-4c88-87ec-2b43b2fb434b", "value": 38736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495694, "uuid": "45037d85-e8c4-4839-8ea4-807d45af808b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495694, "uuid": "c1f3c67c-3741-41a7-91df-dc066ebcab6b", "value": "top1miku.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8447e42d-60c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752506189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506189, "uuid": "64aaf629-db21-4a45-8b95-42b0f8022d77", "comment": "Malware payload", "value": "0718e7f0357d55109b283fb6e826982a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506189, "uuid": "4cd5bab8-0ff7-484f-aff8-a568ac761a7d", "comment": "Malware payload", "value": "340d8ba2b395e25ecfe6137b266ad0021ba4e2dc6ea960c5f867e9582a6390f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506189, "uuid": "aef3210c-4e4d-4f68-be67-ba914fea42d5", "comment": "Malware payload", "value": "b5053a8d55670fffb4dc6e7b5797023fbef7f6ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506189, "uuid": "7ccbbbfd-8118-4452-9c4f-e3056cb029af", "comment": "Malware payload", "value": "badc4d83f20356eb8effd9330996d102f811387c0357af883fca3ccae5417797d33ce03186481677414a0657a28c6e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506189, "uuid": "5d973f49-ed3c-432b-b1d7-2a593d9b89c8", "value": "T1D7759362BF98AE2FE695303593B7C13033CA7A1581E074358A57D70D2F8E279991BDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506189, "uuid": "cc439563-fdae-4392-8a79-bf8db4578abb", "value": "24576:kYc8hbuA60SjA4JPr3+wSkmAUd4TJcTzSN5A+FJW1I9OBL4AB61jTw5UMb5Ud4C9:XralN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752506189, "uuid": "19cee6c5-a4a5-4f1c-ae98-f7d6eecd5a17", "value": 1574488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752506189, "uuid": "4b1d51aa-4d2f-4cbd-b596-ca887ace3fb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506189, "uuid": "e94a3708-5d56-4478-b65e-6484855c5a10", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a39597a-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485153, "uuid": "8b1c472f-a2c7-416e-b5ba-588c36876d91", "comment": "Malware payload (Mirai)", "value": "de9e542179413e668ff4ec9bd9354931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485153, "uuid": "00f13cb7-c579-4135-9247-2de71dbef48e", "comment": "Malware payload (Mirai)", "value": "3424ae9a99400cc514f83197c770875827e24697282860f5e22d9e341e1c4d55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485153, "uuid": "795a7f3b-7b95-4aff-bde3-ee4c400e945f", "comment": "Malware payload (Mirai)", "value": "8d2b60db30f733d78993c02282e19cdbd25a1094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485153, "uuid": "f8233249-2713-44e4-9dc2-2d494ef7b420", "comment": "Malware payload (Mirai)", "value": "eee18eed650939084f5714b13c1cb94a7574feff5da09af3fef29dcf5ad24651c230d08568c26dae9cdefd2c59b8c649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485153, "uuid": "975b548c-7a95-4d33-8013-228313732d0a", "value": "T19983C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485153, "uuid": "be116df8-3ce3-4f4f-9256-911e85b8d4bc", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAWgR:x/8RHTgMcJ0fmqJZOpkM/FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485153, "uuid": "f423109a-23e3-413f-bd19-4f21f17cf9fc", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485153, "uuid": "35a59dbb-31fc-4361-a419-bb66e7900dbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485153, "uuid": "3bfbfa1d-29d5-4727-8e53-084a59b6f998", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e029bf28-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496894, "uuid": "0eb533d0-00c2-494f-aa8e-2652f3071a88", "comment": "Malware payload (Mirai)", "value": "e75ce761a510ac3710394f090aa1ef14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496894, "uuid": "20e231a7-db1d-41c6-a85a-f47ee138b6e7", "comment": "Malware payload (Mirai)", "value": "3468ad241091613b02fd27019a596b9b15f9fad16e40b0225e5a51bec81bd376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496894, "uuid": "64ee107a-b35d-4599-9a18-e7bcee334ffe", "comment": "Malware payload (Mirai)", "value": "017bf81abe261c5ecef8b833d737e2152d2478e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496894, "uuid": "2ac5b6d8-898a-40e7-8789-ae814839837f", "comment": "Malware payload (Mirai)", "value": "58c76371394287ee22c1aebb642c4e190238ce5a2591f048d274154677c9b1a72aedbecabf5bf48a3257cd2b4bcf677d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496894, "uuid": "64d0509b-444d-4a3f-ad77-fbdd9df33983", "value": "T15D53E9627C926A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496894, "uuid": "bd522df3-b43f-4706-a786-dd84d8911fb5", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496894, "uuid": "e7cc70d1-475a-408f-a8d9-1d5b28145047", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496894, "uuid": "1613780d-9172-4475-85b2-6cc0eb862b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496894, "uuid": "bc02dd2a-c71e-4b44-b2a0-bb74976b11c3", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db2d357-60a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492917, "uuid": "cc3dd0bd-afb7-4c63-8aa4-9500ad6d1865", "comment": "Malware payload (Mirai)", "value": "07a98ad912c285ba2db652619ea80481", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492917, "uuid": "1c9c2f76-9786-4c42-a111-4e8cc2e91fa5", "comment": "Malware payload (Mirai)", "value": "346f51e24b0f495fec267a3819ab75c82b3b78f767cf70ad1434d621adf6ce81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492917, "uuid": "0b0a4062-29ff-43e6-85cb-e15ca3d21098", "comment": "Malware payload (Mirai)", "value": "f6e657a4cae8997fd3fd583bc1d476d50377e24d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492917, "uuid": "1b962c27-5a38-4c50-a8b7-c0407f02e704", "comment": "Malware payload (Mirai)", "value": "f18cb375454a0d1327dcdf38e58fb89adb7d3fbfac1e09d6daf7cf0deabc4e6a57919db3ddd929f2d8dbc1bc70577480", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492917, "uuid": "12a21f64-e447-4d1b-92d7-d6d679b156de", "value": "T12094D723C8154995D0615CF222673389BD0787BF8AE732D3DE2A5AB0BF6051F52BADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492917, "uuid": "6c4871e5-afcc-4062-9892-95ae0bbe3dc4", "value": "12288:NsayGhG6QM8zwj4pT/6tpBjmvtkG7X0Nu:irTCZmvtkG7X0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492917, "uuid": "c9ffdf8b-e63d-4ffe-8a4e-741545642d4c", "value": 408290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492917, "uuid": "63b980ab-6667-4c54-8ed3-b9500ebdabc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492917, "uuid": "5d0aa5c7-9c9e-4bc7-8359-5c4c2c9317a6", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842cd5ec-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479989, "uuid": "f630e557-0e63-4a69-b580-16efa3a4b776", "comment": "Malware payload (Mirai)", "value": "f57e5e16d20c5c8a1f5bee5349903f4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479989, "uuid": "08df19d6-7bac-4a6b-ae32-1b94d82ba50f", "comment": "Malware payload (Mirai)", "value": "34bfdd2d6844472e5b697e212743926f8b40fd2b127bd4d513ef4f6226e11019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479989, "uuid": "71000cec-6aaf-48f6-861f-1ccb2cc699f9", "comment": "Malware payload (Mirai)", "value": "0866f829bf728714749b03fac8dd67db060c5187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479989, "uuid": "b943bf06-3d07-4ae7-adb3-cc6d5de8f404", "comment": "Malware payload (Mirai)", "value": "35c1467b148a57858d04a99ac24231d9aab0997cde9ae04e2833f9ebf594593737971af788d0ec72e8679c979c5ba8cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479989, "uuid": "58c4959b-7539-4dd4-bdb5-14ddd32a5687", "value": "T147130129186FFAB2DF25643BFD2806A917750E70E09B34C9A73ECB1CB85E4447AD4642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479989, "uuid": "923d480e-a711-4151-9f8f-072a89a4f72d", "value": "768:vliHGR7RcLbwxPGcA9DpuCb4bVxQ8jTti2uC0B9HuQ2hBJlLsW0099q3UELhQ:vlimYLoG/DUNBCBluQ2hzlLX00QLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479989, "uuid": "853d8786-8bf8-487c-b25f-3c735c5c604e", "value": 43140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479989, "uuid": "7cf81640-c58c-4e0a-8ca7-a8af42759d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479989, "uuid": "211c6f6e-6386-4a6f-a276-3dd2b6cc7db8", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55132b39-6107-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752534456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534456, "uuid": "66c75796-b66e-43f2-b9a9-247c1d0b5aea", "comment": "Malware payload (Mirai)", "value": "3fd0edbb8949c1a9283332b4fb4de1b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534456, "uuid": "6622df26-c5ae-4144-a598-e3434c35d0f6", "comment": "Malware payload (Mirai)", "value": "35d92d86bb127a9f1f7462d838f6d0d7d91b6a16576701279e24d73021a03a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534456, "uuid": "52760a37-8de0-4cce-836a-d8270c237576", "comment": "Malware payload (Mirai)", "value": "09cf8782043878df5ab173e749951412b7b15587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534456, "uuid": "a52fe377-b490-4a06-87bd-484f96a53d8b", "comment": "Malware payload (Mirai)", "value": "985b55cbd2376d632498fba017689bdfd116940bb170860ab22cc68ee47cdea75af176dc6404bbaebbd1cecdf24a2551", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534456, "uuid": "af46da25-4c44-44b7-900a-066557592ca6", "value": "T197332AA7748181BDC596C2704B6EAF26DD33F1FD1364B61523E4BA327D9ED221E09C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534456, "uuid": "46a2aff8-6e24-40c1-aaa5-7d11e393eaa3", "value": "768:bYq/tQ1j7GWyhFj3OdI5W4zvYnXHyrM3+hSQwpCW3VkvEGJIf:DVQR7AhFj3XBzQnXSrbSQwIvBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752534456, "uuid": "53e69ac9-f300-4326-9657-3d5c0d0e1212", "value": 50240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752534456, "uuid": "a869abdd-9af2-4a60-b85a-c6d445872325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534456, "uuid": "cebf16e5-5de0-4c75-b5e0-f7d78fc68c23", "value": "fsociety.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d169160d-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752504171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504171, "uuid": "94f32e3a-ebf4-48ef-b557-e9c2489cc47a", "comment": "Malware payload (Gafgyt)", "value": "33d468f80e25afd1e3192608c987bb47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504171, "uuid": "4cfca5ca-ffd3-47e2-8e19-0d40717646aa", "comment": "Malware payload (Gafgyt)", "value": "35efd7edf73394055b16106e431a4a1d9ee7f0133c5d15a8e46e71c32260203c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504171, "uuid": "2400371d-6168-4d69-bc19-44602f3ec4a7", "comment": "Malware payload (Gafgyt)", "value": "d1ba8ab0a0278f924e747155dc60ebbe626b58b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504171, "uuid": "087ed1b6-c9d6-4323-91c5-4e5d31cc6764", "comment": "Malware payload (Gafgyt)", "value": "594741433ce9e8aa218876512265c00501b3ba9d1c26d8ea4491bbea598484086226fde683661e184a67422e398e4441", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504171, "uuid": "d8ab649b-2044-4f18-8038-36a1623c6b0e", "value": "T1E1036CA3CD252E28C25AD9B4B0309F755773E45492871FBE256BC6788093D8CF2863F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504171, "uuid": "c4156739-e560-411e-8be4-f8674842db31", "value": "768:GMUQwLgKXfFn7ianfYRVO40kdIifKyOt/VP9oKC6RVc0yJCoI:mv8KXfFn7FnfYDqVPyT6RVICo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504171, "uuid": "c46104e5-5add-4458-9a3a-242929b7e242", "value": 39160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504171, "uuid": "ac1e8016-f5c5-4904-bb3c-bf8e088624ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504171, "uuid": "a0e3dc65-500d-4baa-a6d5-a24d3813d5ac", "value": "proxy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aad1fd7-6055-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752457988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752457988, "uuid": "67049be6-d9c1-4361-aa54-868e71219e98", "comment": "Malware payload (LummaStealer)", "value": "5f3ecb02d022ff555b1ceca078c8ed2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752457988, "uuid": "b81ae6e5-67c2-4224-b8e6-229ef6140424", "comment": "Malware payload (LummaStealer)", "value": "35f21e96a5cffc814afa28a705f749eb720b3c8032f36906f92ad3ce69bff55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752457988, "uuid": "1271db5e-b9e2-409b-a383-3ebdd3d2b7a5", "comment": "Malware payload (LummaStealer)", "value": "254f94ec433465990e9deeb93a7459142be90020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752457988, "uuid": "2578183e-6e35-40b5-8c5b-f1ed57dd2ec1", "comment": "Malware payload (LummaStealer)", "value": "694c1ea4b8bf9c154ae58632c16932c9f7b1396b522b5242c1e2bc901d89a125d8b34fc96d0186fa1e26e4f6f9316a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752457988, "uuid": "4417fb37-ac4b-4f87-80d8-447cd6e2bfaf", "value": "T11A75CF75A0D6A0DFFE7995B285A62191F022B123C53D0FFB11E8E3727B17AD01E69324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752457988, "uuid": "0ee5a093-b892-47c3-93c3-07aa1290e64e", "value": "dadf1ffb48205f6697443fb8a59edc6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752457988, "uuid": "2cfda139-ba8e-48c2-b6c1-9bfcb32f1590", "value": "24576:YYiVvGuJZgcG0VISOJ/TrhKXyLw1i5eQxcgYQXZ8wtv+/JHcgYQXZ8wtv+/Jg:YeuJZ9G01OJrFk2eQmgjq7/J8gjq7/Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752457988, "uuid": "ffd25760-b555-496f-806a-0a906389e6dc", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752457988, "uuid": "fb7fb55a-de44-4109-8af6-e11e4c5157aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752457988, "uuid": "724d18b4-2a3e-4944-8a41-e2fd754c08dc", "value": "Vertan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f458de6e-6107-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752534724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534724, "uuid": "a47ab677-61e9-456f-bc1b-5a9c5e2436d5", "comment": "Malware payload (Mirai)", "value": "3b896feca056e71687361b6d5c92db42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534724, "uuid": "bd58dc44-bba9-42a5-8c74-ccdf90959464", "comment": "Malware payload (Mirai)", "value": "3620739640642e789ac447312c61f1cedce3ce029c1912a172e201f7eb4bbc4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534724, "uuid": "b3f0fdac-1811-4748-8cf3-74cb123d9e5a", "comment": "Malware payload (Mirai)", "value": "dbaa2a0aee89f84cdf68a8e7c78e624ea7adb047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534724, "uuid": "9133feb5-69fc-4a76-aa00-f7031f4fd86e", "comment": "Malware payload (Mirai)", "value": "867dd809d42d72638b1e69e23be93cf97f7ec16e62019077b89c448fa0ef86302fcf43c52ff2a7cecc8a544cfbb12f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534724, "uuid": "1d5faa09-1a48-4c90-9034-f85d4162c8b3", "value": "T12A837D43D25BE4F1E80104F51016BB36D9329AF34520DA9BFB64FD62ED37A126126FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534724, "uuid": "6d8e7070-b45f-448c-8e2b-a9b7beb08329", "value": "1536:kE+Djh/T98HFVxq7t8tR6mmrSQXF9s8rwoOUgUo31ZegVW6Xr:+Xh/C1q7u8dOQXDpGrE6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752534724, "uuid": "a3e38d38-4022-4e22-b7f4-e9c3bdc92586", "value": 87968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752534724, "uuid": "2824fbd4-32f6-4077-819b-6137286f5f36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534724, "uuid": "948ead44-4b8f-4a4c-8088-c0f2bdc852f0", "value": "rsyslogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e486f2-6092-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752484232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484232, "uuid": "b3ff06e9-5a26-447a-8cd2-8d75168d970c", "comment": "Malware payload (XWorm)", "value": "b02018168a7d19c39c0ee09da01b5769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484232, "uuid": "1cbe243b-1fa2-4a35-9495-4a1f8c78ca0d", "comment": "Malware payload (XWorm)", "value": "363f7d61f292f21911a8307c2f655f534b4d0955615a07dfb53480d02473000c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484232, "uuid": "67dc683d-2f3f-444c-9067-0d78739e1113", "comment": "Malware payload (XWorm)", "value": "4d01abed41e6005b6b3c339fea493729ef8dc2e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484232, "uuid": "663b08b4-ba76-4afd-b5b9-83f8106cadbb", "comment": "Malware payload (XWorm)", "value": "0e35366d06897111bb8c64cd4906e93822e0b48909cd43b2e6be75b5330cd36f0ea15ced08a6d493d0421300bdfcf820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484232, "uuid": "900bb588-f28e-4327-ba5b-b1c21cd19e27", "value": "T119E23A4877D44312DAFEAFB12DF362061670951BE813EF6E0CE485EA2B67AC047417E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484232, "uuid": "d149e88f-9509-419e-ab0e-cebc47883ff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484232, "uuid": "acca7a69-a2b6-4b73-8347-1dae90e80281", "value": "768:EVa+vNtg+PBoQ3Tw49FzVFE9jb3OjhtbI:WvNtgwn3U49HFE9jzOjHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752484232, "uuid": "c122bdca-5b37-447a-9b09-91b9fb37234b", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752484232, "uuid": "0a2ec3d6-f6bb-4df0-b82d-2dc21df0a4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484232, "uuid": "2ae30835-1d69-4f67-8069-7656217ea5b5", "value": "b02018168a7d19c39c0ee09da01b5769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc919c5-60f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752527919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527919, "uuid": "4e12fbbc-e190-4d5a-b5ca-a99e8a85d0a5", "comment": "Malware payload (Mirai)", "value": "1b52ec0cce81c306b0e443cf91f4a6a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527919, "uuid": "ebce8c7e-a2e7-476b-aa55-1df9c2c9b4a1", "comment": "Malware payload (Mirai)", "value": "3656015b14ce861ebe1ae19cc2ffa2339d4099c1d642f574e3ea8e714c0cfa00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527919, "uuid": "f124d902-15be-4741-b12a-23eb7a319d12", "comment": "Malware payload (Mirai)", "value": "6d1fc7ff7276184fbb3c05581d3c763d74fda0dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527919, "uuid": "21dfd067-9343-48eb-88ed-d9b947fb57fd", "comment": "Malware payload (Mirai)", "value": "6c755e38a6ef8eb864fc83500b4c8fbadb5e411a45d02ffed3afe40d2037738fe20312648d5ea41dcfa0df58d62371e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527919, "uuid": "85c3395a-f94a-4c6a-8a32-b1760be44403", "value": "T166732995B8815A13C6D1127BFB5E42CD372613A8E3EB3203DA256F21778781B0E7B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527919, "uuid": "9b2ee55a-5296-494d-a255-0b3479da90fc", "value": "1536:lWco87HlotwV2eqDBHPElO7Wugn/+/ZrsHbOsIvmzKq9cvk0:gcoK+wUeqNPISWugn/+/eDoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752527919, "uuid": "b9758330-5b63-4b6f-832c-44d226d7e363", "value": 75068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752527919, "uuid": "99c07c23-605b-4241-b254-d433473cf07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527919, "uuid": "6d1024c4-9808-4345-bfc6-db478f34ec37", "value": "SecuriteInfo.com.Linux.Siggen.9999.26675.7296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b57b0a-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478277, "uuid": "d1d1b835-090e-46e6-9e97-61b60e5a609a", "comment": "Malware payload (Mirai)", "value": "6b67ae2665b8028167c731038634af78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478277, "uuid": "c9d76802-6ffc-4a1f-a169-050390481606", "comment": "Malware payload (Mirai)", "value": "36808de0ffe48ff242d0d957a28f729646214820106acecae4e2679bf7b8896d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478277, "uuid": "ff3fcd0b-351a-46b4-9b02-0e78ac697ba4", "comment": "Malware payload (Mirai)", "value": "f92b7b83e80d4b31ee3c2f0188a67976892359e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478277, "uuid": "3c8b8f7b-9e09-4939-b259-65213820e23d", "comment": "Malware payload (Mirai)", "value": "2be18005fe067d4741564f3435d3f79a03c6322f7354579b286c0eb9dcba03f9845269ffe8dade5d548f1e63d3db6750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478277, "uuid": "8ed83665-78fe-4369-a9ef-0f900730264e", "value": "T180E30B46F8818B12D5D112BAFE1E128E33131B78E3DE72129D246F647B8A97F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478277, "uuid": "c3917eb8-2100-4c68-bf8d-bfd9a3adec0b", "value": "3072:msuEX1hG9ZThOjXKzz3fazGGBZu9KNsZJ8:JVFhyZ8X+zvaFsKNsZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478277, "uuid": "542c9b66-d65d-48b6-bf17-c1bcdef0444a", "value": 153020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478277, "uuid": "f24f1f12-c28e-47d9-a821-beb8db0fc642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478277, "uuid": "9774e512-8e3e-480e-9d27-d6199d323802", "value": "bolubotnetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3106cbe8-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752536973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536973, "uuid": "235fb74d-319a-4a27-ad9c-d291d98a6149", "comment": "Malware payload", "value": "b049aa044fd3683ba155530ca2f3b9ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536973, "uuid": "68134d1e-5c42-49aa-86d3-e90e548d2c48", "comment": "Malware payload", "value": "368a79f429b4926ff2b42d68f4d521bb43dc264b73184e8c55d4f7a99446fe64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536973, "uuid": "89e51468-06c4-42e7-ac54-152c5788ee7a", "comment": "Malware payload", "value": "da1c85676fb12f97eef9184f7ae68c4f08e9bc38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536973, "uuid": "95d74254-e2f9-4249-b450-d57067702af5", "comment": "Malware payload", "value": "4f41c162006d7becf4af311c9be3d803b6aeb8f444c3ccdff9fef1faf1ce0d35f93cf43fadc52d116ed19e8eb30cf958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536973, "uuid": "b44be395-83d6-4a30-8e95-6d91d360c523", "value": "T1C0A41294E9819B62C2C811BFFF0F41BC77A31F69E1EA71068D16EB2662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536973, "uuid": "576f774c-c80c-42eb-9d51-f3fb9b787348", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536973, "uuid": "9ea8bd39-ba7d-4790-9fb4-16131851f87d", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536973, "uuid": "f103cd73-32a7-4f34-bf58-0341b5bdb347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536973, "uuid": "f552c3c0-d9dc-47f2-a6a7-34331ee2d173", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e611c4da-6071-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752470275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470275, "uuid": "3b37b7f1-3f5f-4d22-9e7b-4054d9c81ed7", "comment": "Malware payload (Mirai)", "value": "5489b9b4f27a23de317d7e70bc7ea081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470275, "uuid": "73cf412d-c861-46dd-88ee-96026268626e", "comment": "Malware payload (Mirai)", "value": "369782b7c089aa1c606f8f659f7f21181606556cf4b32fc3c752a434bfe8f2e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470275, "uuid": "df6fe2a4-96de-44bd-8216-fccc35f43725", "comment": "Malware payload (Mirai)", "value": "046bf3c1c78a0fac84097477688386df46fa0011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470275, "uuid": "a4c354b7-1179-4891-b62e-8bfc1bacf2f6", "comment": "Malware payload (Mirai)", "value": "8aecb11ff3d27d43ff3d15859763044908c2f2012400117d6b085b31ff7996b123706066a0aea5dac30a36073674ba83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470275, "uuid": "8af01903-8597-4811-adba-8349116bc6f1", "value": "T1A6F23C26B7691A17C1E0537F20EF4F16A8A51BC86590C66F7E720E3A6E727001D16EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470275, "uuid": "7fa9bd5f-3473-45b5-b013-4775127995fb", "value": "768:WpG2NoRm2+VCXKIvSFFIx0GzDB/EuBDEljoTm97TBzWUf:WpG2NXCXKIKF2ik1/xFUjlTyUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470275, "uuid": "40b99644-1ae6-4fe0-9d5f-99e276625b73", "value": 37016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470275, "uuid": "eae20677-310c-4eab-966c-903569e977a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470275, "uuid": "313c928f-7be5-4316-8244-6576c4f407ab", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95af5692-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752477871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477871, "uuid": "504f7166-29a9-457f-815d-2b231b805154", "comment": "Malware payload (Mirai)", "value": "3c1ae8bd1946211caea3d4d7a65064f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477871, "uuid": "6d7a3f22-43a0-4b6b-b774-c2816df7c7d5", "comment": "Malware payload (Mirai)", "value": "36b117d5659cb41244469b70b41653a8edd54894a5289e087f611375b151e8d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477871, "uuid": "47271b1d-f2a8-4e66-aa6a-5e2c6c64867e", "comment": "Malware payload (Mirai)", "value": "12012945a4f2ab8e9675326ea8e741253e85e2f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477871, "uuid": "258b6c64-6aa9-4b49-8f5b-d296e72179c7", "comment": "Malware payload (Mirai)", "value": "dcec638a60c0bd8fd7a3f5312e1e48ddca9506fbdde8ac881c4bbfcca102782c6f76fdc8ad7459c3fff9b728064a16d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477871, "uuid": "8208bf58-2ca1-492a-803f-a90754c86b36", "value": "T1963121C660910A393DF1D96F35AD4884B5B8908A70DB6F14DCEC75FB409FE64BC40A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477871, "uuid": "0dd7a5f9-1be2-455f-b074-dff527c7d791", "value": "48:vWjgJWV6LWdOBJWXxEW1sWd8WJbgWR4Wxu4eWHOWlH:vWjgJWV6LWd8WXxEW1sWd8WFgWR4Wxu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477871, "uuid": "247eaace-fb3c-49bb-8e40-8d95e0b62ad1", "value": 1565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477871, "uuid": "7eca1555-b644-443e-80eb-6852d9f1c996", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477871, "uuid": "6dbad0b8-2671-48b1-be5d-06421ed8d876", "value": "sh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46ecf1d-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1752492499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492499, "uuid": "aad4ae09-f41e-4ca0-b6c7-029b731a28f5", "comment": "Malware payload (Xorbot)", "value": "7d346fd272c0607ce1b75f8ea732b0f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492499, "uuid": "03f7d459-8691-4af2-9a8e-3392b9674748", "comment": "Malware payload (Xorbot)", "value": "36f15621a8fd27ab661b0b17e368ef03f956c6374391822871237e44b622bd4e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492499, "uuid": "b4023bd8-dad9-4e97-8004-120dd9c73c1f", "comment": "Malware payload (Xorbot)", "value": "2c0ba3d9838fe7dc9097e6b6d418f82fc3e49ec5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492499, "uuid": "83539f24-93d7-4787-ac19-1b97c962974a", "comment": "Malware payload (Xorbot)", "value": "0f859b471153db11e10254cef98bcf3a40abc2cfe25f0ad3dbe73cd55251cc70ca742b6f88017e880367ba9b93495f91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492499, "uuid": "3b42a15e-7139-471f-9164-ade6550e7be8", "value": "T17E22C0CB22887974968BAE4A3B6151C29151C2D6B5D67BDCDACC3C7F01C6E6BF08C931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492499, "uuid": "ee12c39a-7780-47a8-b720-061d0f98d72c", "value": "96:KMLVplU5xL6mrqyz//1dsZdXVMg58xGuOl0124l0HQMg58xG4Om6mrqy//fj1dso:KMLGH1dsZdXE/Ol7kw/1dsZdpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492499, "uuid": "6a1a93fa-e4ae-4385-ac06-8aa7fe4f28ca", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492499, "uuid": "c649545f-c8fc-4a31-a6dd-37fee14c7140", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492499, "uuid": "32b2ae5f-fcba-4729-a6bb-2e6064a168ff", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3daa70-60c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752506580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506580, "uuid": "986c5599-e93e-43cb-a3c6-42a7a6b29ead", "comment": "Malware payload (XWorm)", "value": "ab7c53d44b3e4575f766423fd28e3316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506580, "uuid": "a202e794-9456-4f84-883e-4e27f7b976f4", "comment": "Malware payload (XWorm)", "value": "371ce3ed4c5ed62f682fdcca743a56f26534c9d9047c69616ad69b48e4688b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506580, "uuid": "49e911b3-905c-45ff-a991-9861046c1e6d", "comment": "Malware payload (XWorm)", "value": "016d75773b93f78d2b0b873ca2e543ac70633df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506580, "uuid": "7bc0d9e9-203a-4db9-9b0b-135cc8a66d8e", "comment": "Malware payload (XWorm)", "value": "8a97b0da3d82f080208aef3998cb46f47b1e22550627e345aa58a0d07424276e305e59aac9652a695fe6dcf32ce4b3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506580, "uuid": "4c5b0d0e-6a98-436b-b855-1c3922609889", "value": "T1BC763319E3E404F5D4F791BCD9BA0D01E7B63C0E0B71DB9E03A866666F132519E3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506580, "uuid": "c133f962-83a2-4ce7-8fa1-41fbb2e4081d", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506580, "uuid": "056af721-5082-4084-921a-288373805e3c", "value": "196608:80vDvxzZ/pBLlcz9ltz6mT4XVuizIwZ7zaGqq9U/1Ty:VDvJRpktDYIU7hqqi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752506580, "uuid": "7c311c3e-853b-4336-acf0-74ffcf41e2cf", "value": 7230289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752506580, "uuid": "ab29570c-9643-48c9-9e83-99ae2bcc6de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506580, "uuid": "fc35bfb8-fa5b-400b-8b91-be8e24e0f521", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.67.5292.1230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3f5547-6082-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752477293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477293, "uuid": "4bb5b6a6-d8e9-4631-905d-d9abc800de5b", "comment": "Malware payload (VIPKeylogger)", "value": "b6352fbd12fece1f752420e01ddd60bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477293, "uuid": "09fc12c7-867f-48f5-914a-e4d8e4683ad6", "comment": "Malware payload (VIPKeylogger)", "value": "371f1cb8f80e05125b0673ba6bcb23237cdfa3c66f2954561ee476b8d6f89e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477293, "uuid": "ddd5f72d-3f7f-4ed1-a66b-6e599fe1dd48", "comment": "Malware payload (VIPKeylogger)", "value": "9e764ce6deaacbfa9db1188d05dee7dffe91ecbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477293, "uuid": "e0e6795f-77c2-4bfa-8cc5-342d6880d2ae", "comment": "Malware payload (VIPKeylogger)", "value": "50f2ed4b26fab4b549831266ec2c6744be59f082ff9b07332e272f464918b4760235c2193c30baa38ffc004827bec1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477293, "uuid": "89d9d4ee-fe3f-4f4d-a6e7-586d1027eb96", "value": "T14CF40106A93ADD11C0A20B746B21EDB0137BAC4CB424D7179EEABDCBB73774115C1A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477293, "uuid": "00433006-df6b-4dab-8202-c66610c330eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477293, "uuid": "722fd244-81db-49cb-9ae1-6aae3f6362f2", "value": "12288:VU1/3plPNyF4dkQXcY56ipwISPcBjMpHJJ+FY3hRjAU5+dkDrIYFb2c4q48WG7:OF5lPNIWkIcWpwRPcgpwchRDzD1fX4c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477293, "uuid": "c5da93be-9c97-4fa9-9e1c-c688fcba0314", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477293, "uuid": "b3a70543-70c2-48d0-97dd-ed070c0f6061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477293, "uuid": "f5919ec0-3715-4478-a180-0592d5ab0129", "value": "SecuriteInfo.com.Trojan.PackedNET.3367.1023.18676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a087080-607d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752475140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475140, "uuid": "5a51293d-4698-4093-81fe-7dd5c04dfc75", "comment": "Malware payload", "value": "8451348ca9ea1e97a337d381a606094d", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475140, "uuid": "878aea02-e030-4ca6-a79c-91c1615685a2", "comment": "Malware payload", "value": "378f93a356e5065f32f0cab12b10816b372b98a1ce179b692759f0d4029a1636", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475140, "uuid": "8fbc3c13-3934-488c-8762-d68059ca76ab", "comment": "Malware payload", "value": "67bb7e757a094674828639c28408e8612c0723d5", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475140, "uuid": "a8de7bfd-2f65-4b88-85d3-7e767355e2f6", "comment": "Malware payload", "value": "813177e1a0c1abe64855a4c1870ffb7721fde3b2f93a4087b5226a491de9b9dae9a15a3cdda9fb4864289a861eff6545", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475140, "uuid": "3fe15a52-ba9e-4bdb-b9e3-798c0654269f", "value": "T13DC2E1D86D48AD61AB878D5EA0D48C7DA3AD44BE3E4301BC7D29B8CACBC303D4D35165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475140, "uuid": "4bbd0a76-9c73-420d-9f76-2faa7dfe9fed", "value": "768:Thao987SV6k1Z7NOUEAeuv6fjZRt9Dt+qr:N8zAv6fjTfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752475140, "uuid": "5f227e1f-1271-4f15-b55e-698cab335e99", "value": 28243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752475140, "uuid": "8f937f78-67db-42e5-8bb3-e3b5849bc52d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475140, "uuid": "5b99d155-4ee4-46dd-b1e1-a848e23813ee", "value": "RFQ KUSGROUP_Materials-Specification-ASTM700-BOQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91444eff-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752513082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513082, "uuid": "dd5d2818-56fc-4ba4-8ac2-bfac5a842217", "comment": "Malware payload", "value": "10950ba34c60e9c5417710eb26d9274d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513082, "uuid": "ea22b7bf-0968-4148-ab72-f77d20bf1f54", "comment": "Malware payload", "value": "38337acc60155d9cfcd14e8cef1fb18cdaa0dae232d3ea64b2c0073bf2e79e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513082, "uuid": "5645b256-1ee7-4aba-b909-749f3912c7c1", "comment": "Malware payload", "value": "389de821e89034815a90bd630d2add78602788ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513082, "uuid": "678c3b0e-8cbe-4a01-90c5-f5790114cfbb", "comment": "Malware payload", "value": "898e4d5cfd5ef82439b1337069c324664ab65fc3a91606672462788e2f48281596b42a88c3fef75e058ddded1b355045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513082, "uuid": "16cd3c01-bbf3-4eea-a8b1-9c29c823236e", "value": "T137A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513082, "uuid": "fe5631cb-ad59-4f70-b328-a4be15b6cf2f", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYs5:FOuhPHCKsqZ9YfM6g23ZJLYs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513082, "uuid": "09a2dd02-2f15-4463-a027-8fe590fd8c94", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513082, "uuid": "03fcdf6d-d263-46dc-bb21-4fc599027de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513082, "uuid": "6f396a7e-f65e-48b0-863d-1b0835814c6a", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a41ba23-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515997, "uuid": "27ac6507-4fa9-4a85-b0e2-f95b71154b7c", "comment": "Malware payload (Mirai)", "value": "00ab4e8fdd81054f41d618b29f626b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515997, "uuid": "72dbfcb9-0cd1-4fbe-b44e-2992571068c4", "comment": "Malware payload (Mirai)", "value": "38d1e707cc4c4c9d4bdda3cee62004a8c74b91f62e1d052107f6da08d2ad7cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515997, "uuid": "fbedb329-07d1-4813-a921-1dd49fbd24a1", "comment": "Malware payload (Mirai)", "value": "da6d7595844539f2e48a425a5a09b9c59a1821f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515997, "uuid": "d6f825a3-d810-4777-9347-37841b5a582f", "comment": "Malware payload (Mirai)", "value": "50aa43010f8ff28eec556739655955a0676e19c20c90a091e51a17afcdc472f4e9a3f38a62a55cf0cd25ad7a8af36791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515997, "uuid": "ebb6a28e-f190-49e2-bfed-eb05796ed8d6", "value": "T158732831B60C0D53C1120AF02A3FABF69F6696D311A5A5C5271E8E05C8739731AE7EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515997, "uuid": "0cad04d5-fc5b-4b3a-b81b-b1457912204f", "value": "1536:s86cahbJbHjsHDNTyILYPMg6UKOXYijQR1:scJxg6UQf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515997, "uuid": "36f64f60-06df-4301-81fe-c882cb84ed38", "value": 80224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515997, "uuid": "7edb89c4-83c2-42e4-a35c-3fdfb0b663db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515997, "uuid": "78d7400e-1555-444f-bc59-7e90df56a2df", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97750d13-60a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493766, "uuid": "8a85f796-6616-4235-8afb-3c12dbf4be20", "comment": "Malware payload (Mirai)", "value": "5a662fa3fe7bd87c25ffae3c34f3a906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493766, "uuid": "ad835f9a-50b7-4ec4-b33b-db57328b5586", "comment": "Malware payload (Mirai)", "value": "38e64206e6869c1de6e1e8ad3cb3fe61708d7679bd05b83d5f0bfc40f71aa44e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493766, "uuid": "1e6d7377-57ca-48e2-a24f-5def0f2e278e", "comment": "Malware payload (Mirai)", "value": "e2b544ee24cb3dab4270b7d57b1457306af9eb87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493766, "uuid": "c6890e8a-9451-45c6-8a2c-cfdfab827fe7", "comment": "Malware payload (Mirai)", "value": "512c49be24a5105bf47c5982f169855721f5b9ecb6d61e3315c39c57ab13cca0b8d9a64e6a97e47c251df15f8fa3ceba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493766, "uuid": "735f56e8-97b2-464b-97c0-4515b161f259", "value": "T16CF2E18B9EAA5999C92D087590EF03D33C04B1D07F6243E96B3494DC43BA9CA69CC4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493766, "uuid": "cd1f1803-f2a9-47ba-b090-d365a250effb", "value": "768:04P43YL9qCPN3cqgvR8zjNiVDQpZqWr/W8:04PXR9PtovezpPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493766, "uuid": "b6ac7567-b0a6-4309-82ff-2dc146e2875c", "value": 37140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493766, "uuid": "1a4e42bd-4e12-447e-88f5-84674ee6584d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493766, "uuid": "18f7133c-878d-4220-8b7a-176854683d57", "value": "top1miku.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a05a65d-6046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1752451464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451464, "uuid": "2ba140a9-39c4-4ea5-b31b-d2dbb823d956", "comment": "Malware payload (DarkVisionRAT)", "value": "3272b2d533226beedfea6ee17c7637d6", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451464, "uuid": "7a989b26-1467-4cb4-8d42-e979c8329299", "comment": "Malware payload (DarkVisionRAT)", "value": "395929b073568f4e40b6ef2a0a0092f8b872469fbd0660354cd2fb49e5d393eb", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451464, "uuid": "57b26348-079f-4ab7-b0a9-6d62fe7e51bc", "comment": "Malware payload (DarkVisionRAT)", "value": "c8c84c69b13ae56ceb9f328ea8fbe5817233354b", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451464, "uuid": "3e593a7d-d42e-4059-bce7-244e9a8967b1", "comment": "Malware payload (DarkVisionRAT)", "value": "9624262cb4e343a6ff4ddb0a9750a440eb88ec77190fa9da1eb2853d3db8dfdfc1c3e86332d46e0dd8c079113207a520", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451464, "uuid": "b8d1c615-4960-4b00-ab93-63a2776e3a46", "value": "T1F806F9E320C266DDC89AC57B8753FD7F898F70360B26D5E391989216DC25CC43AB6E09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451464, "uuid": "9064d6dd-a613-40c8-9c5b-42395f389d4f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451464, "uuid": "76586f60-0c2e-4606-84be-6294c396d027", "value": "49152:2LveOuVcOR5LKoZDXlYVMTTNKPxJDKFKW1U8V:2LD8U8DXDTNKPxAFxU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451464, "uuid": "f99a99da-597d-4cff-9534-efc3b5b49f25", "value": 3954688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451464, "uuid": "9aed2c4a-a0f6-41f8-b154-1e22b1f72002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451464, "uuid": "49b3b0e8-c301-467b-af54-62787e9b52a5", "value": "SecuriteInfo.com.Variant.Mikey.179838.21758.23799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5e86a5-6099-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752487224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487224, "uuid": "579d416d-604e-4470-9201-857b6690a75b", "comment": "Malware payload", "value": "0fe14d1425772674c20c0cce66c0d31e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487224, "uuid": "a904641f-b337-431e-aba0-c4be49e6a445", "comment": "Malware payload", "value": "39b8110d74a222f4bfdced542bf56e24cf9f7090824667f5689178ac94bd3e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487224, "uuid": "c6085fb7-cff7-49bf-99fd-9c1b35783c65", "comment": "Malware payload", "value": "25552bea0eb7b2eda2f36ce08464159c11ac1eaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487224, "uuid": "4bf89848-54dc-46bd-aa13-58de854e9012", "comment": "Malware payload", "value": "fc75ff9d60debb66a25fa3b89af8a34a973f078b93862b22ebbdfc0992f0dc06109310427d56b8ef437f04ea400dec11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487224, "uuid": "cecebc4c-1de6-414f-b0ed-1dfa553f3f8e", "value": "T11FA41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487224, "uuid": "33b22446-4666-4a63-aa12-38a8eecca93e", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752487224, "uuid": "911e3247-c1f8-4a2d-bd8a-87e2e4ed45ec", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752487224, "uuid": "142299f0-0ab2-429f-93ad-5a48406cab35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487224, "uuid": "f2307d3b-10a8-4bce-a0b6-25798e978073", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220dbf41-6095-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752485408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485408, "uuid": "586bef77-efd2-4d87-8225-96c8bf3b6f44", "comment": "Malware payload (Formbook)", "value": "ed292b4bbf7807225aae1a455d58c6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485408, "uuid": "7a94768a-b0ff-465c-8ec9-99ea738d72fa", "comment": "Malware payload (Formbook)", "value": "39c8fa3e6dde8345397151b7ee46001a317d05a93bb731ee872c7f8407c24ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485408, "uuid": "aca8240a-9b58-4566-bbf8-dff21554e508", "comment": "Malware payload (Formbook)", "value": "78d1dfa9771ea5ca17dfa23c47a1adc5e84a606d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485408, "uuid": "42e928ca-cb4c-4050-b2f0-aa4c1d1f9091", "comment": "Malware payload (Formbook)", "value": "92638aa6b9994bdf16fcee0d9c00364eb2fb02b5dbb2344061303a1e6e075cf5a25ed6b8740649d94c91aa5ca3c57973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485408, "uuid": "eab7b93c-ed8e-4707-9a2c-affa4ac1343e", "value": "T1ADE5AEDB1987F2178781145961181BEA28DFD23AE65B4938B4486FCF8E42DFFCB1D902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485408, "uuid": "c4f7e1d4-e15d-4955-b7a4-91f1d952aeb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485408, "uuid": "05d8af2e-3f32-480c-a6a0-61ce29e385a2", "value": "98304:2Fp/FrRWeZ93HqXgUgToZd8XgUv383i5P:8Jvj5Hqwgr0gUv32C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485408, "uuid": "3286405f-bd78-4d20-a41b-5068c3870f34", "value": 3237376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485408, "uuid": "35cbda07-1a58-40bd-910e-aedcdbd56ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485408, "uuid": "f10a5dd2-c3c4-4437-8e2e-ce7991aaa0f1", "value": "rADCB007142025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e181c4db-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496896, "uuid": "a1fe1c59-48dc-44a0-9326-17d8310c96ec", "comment": "Malware payload (Mirai)", "value": "e543ffcc2e95506b457e0f284ebfefdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496896, "uuid": "3a8e0bc8-3cd7-460f-93b0-c7dd200d5ec5", "comment": "Malware payload (Mirai)", "value": "39e5a9fd506f2b5ff8dc8e94d90f4a973f0ba338cd7a21019a464d9552928859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496896, "uuid": "2e3cda2b-8f18-451f-a1ff-4e623121ea0a", "comment": "Malware payload (Mirai)", "value": "d26ee616e1f3d1c0938b2a4a12c97febd45afce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496896, "uuid": "c0c89e60-0f37-4c38-8594-c2c0e15ea2f6", "comment": "Malware payload (Mirai)", "value": "e7575bc6609f2b633bcbe4a3e86f8df4677808b373e869941f9616a4b482e99cc1f917c0aa0c35d37e7e8b1e69f87b55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496896, "uuid": "53f1302d-e0c2-4d5b-9799-b419a5ce2491", "value": "T189A3C71E6E158F7CF79D873447B78F259688338B2AE2D141E14CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496896, "uuid": "56c1d29d-3d40-4fce-8335-3ace0fa911a6", "value": "3072:pqunD7x7p9V7Ebcr/kq6dH3faIfaazOBC7M:pqunHtp/V693S8aazLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496896, "uuid": "3556f5fe-bde8-4e05-9640-e53244d7895d", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496896, "uuid": "d05b6c37-63bf-4e59-9fea-94bc5b371f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496896, "uuid": "7c65f45f-39ea-43c8-87b1-20111d2011d4", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbee7b3-60ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501343, "uuid": "ecd5cc56-46b7-49ae-b892-df200701c930", "comment": "Malware payload", "value": "bc5b6fd093000ff038c276609b956f79", "object_relation": "md5", "Tag": [ { "name": "45-95-232-57", "colour": "#990EEA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501343, "uuid": "d3b0382d-ff91-4d8d-836f-32ab9f1ce41c", "comment": "Malware payload", "value": "3a153b9c49cabd05d1287442a90588e777804a06cd68e666baa4f6a3f19b37c5", "object_relation": "sha256", "Tag": [ { "name": "45-95-232-57", "colour": "#990EEA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501343, "uuid": "29526472-4337-4c4d-a065-0385efcbd069", "comment": "Malware payload", "value": "8f2476eb9fd8ae6fe2536831ef6d8e7a8e2bcdd5", "object_relation": "sha1", "Tag": [ { "name": "45-95-232-57", "colour": "#990EEA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501343, "uuid": "497cebc8-15bb-4fc1-a711-7a377906b739", "comment": "Malware payload", "value": "b0171d83922faf987850175696274c5dcd5483a030686d3a4c0dd3c4e54857e090458de90f89b1b65719f1d4e1fda8ba", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-232-57", "colour": "#990EEA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501343, "uuid": "89a1cc3f-17e1-43de-bb93-3f679f034c22", "value": "T137F633E6FBD0EDC67D3F11291A69B918ECE5F00AB9940A027AF41C769DAD7CD113B801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501343, "uuid": "b6c91c4a-855a-4bcc-a260-622c5b4f8c9b", "value": "393216:2WS5roxovv4coMbKj9T9wgIQ2FlJe9AdJ12NV83g3K9:2WiMo4LOKj194Q2Je96D48w3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501343, "uuid": "ccf19bcc-a6c5-4760-8542-d14baeb0c47b", "value": 16544109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501343, "uuid": "fd8d5f3d-7ce7-4043-a722-6796e1cb5021", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501343, "uuid": "0c5cf96a-7f38-4528-adca-7aa8be348f1f", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3187d2b9-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518076, "uuid": "3d7f16e5-cb37-4362-aaea-3282b50014f1", "comment": "Malware payload (Mirai)", "value": "3be6428e0be1643a09cc8a9588d980ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518076, "uuid": "d6f21d38-0705-4d2b-83f5-26449fd3fbfa", "comment": "Malware payload (Mirai)", "value": "3a43a1e5d912bc724aac78d765ba766357001201d819f925c7a59f9343376618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518076, "uuid": "3eff70f9-4086-4676-b191-505119836dda", "comment": "Malware payload (Mirai)", "value": "036a719189d36889b4800efade9032f0efe4692e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518076, "uuid": "0576b247-6198-4ff0-ac33-3435e94cc324", "comment": "Malware payload (Mirai)", "value": "8a27d001bb2812147504663a7c01c504b30beeeb08d28b6844b33c2729512ee38fdf730c2cd2cf5360476889e965f98f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518076, "uuid": "468a1b6a-0860-476a-bf2f-5d21de2655eb", "value": "T18BD30945FC515B13C6C622BBFB4E428D3B2A17E8D2EE7203DD255B61378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518076, "uuid": "7aa20bc6-b59c-4657-983b-64962d2f1d28", "value": "1536:kXF0RvpER11bSD/TdYeIHvUrwA+xUi4VdzZlT6PqO+HMGoirpPodRJl3Ywyw5Rzk:kVeW1YuD8rwbZ4PvuqO+RrJk+7WHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518076, "uuid": "b84069be-e17b-4863-beed-2238fe82d73c", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518076, "uuid": "8cb737b2-99f3-4fa2-9f67-6b7cde2934b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518076, "uuid": "62637e0a-4b22-49f3-b63b-ad6b3be1d5d4", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1319194a-607f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752475934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475934, "uuid": "2f4d17c8-99ee-4227-8c28-4c506db1a701", "comment": "Malware payload (NetSupport)", "value": "42f7b2bb0ad8da9b070ba793b622310e", "object_relation": "md5", "Tag": [ { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-lordx1555", "colour": "#CE7C9D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475934, "uuid": "05206dfe-d44f-45ec-aefd-6e26af27d476", "comment": "Malware payload (NetSupport)", "value": "3a84c3a278a2e2bdb03387032c06a1d12c1dae2ac21b5cbc624ea431282ba7f5", "object_relation": "sha256", "Tag": [ { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-lordx1555", "colour": "#CE7C9D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475934, "uuid": "7b12f703-09cf-4759-8789-033f0b1a5d15", "comment": "Malware payload (NetSupport)", "value": "8aab54885f48ba998feea6e33e8424e55d34417b", "object_relation": "sha1", "Tag": [ { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-lordx1555", "colour": "#CE7C9D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475934, "uuid": "f2003de3-0b0a-4ada-b8bf-d0c5cbcbd9c4", "comment": "Malware payload (NetSupport)", "value": "aeef03c7b4f685706772216846a129c6f56648154dee584fe1751b605868beb681e08a609da6b2ec6fe0f242b0b047ff", "object_relation": "sha3-384", "Tag": [ { "name": "deviltopfox-org", "colour": "#478E28", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-lordx1555", "colour": "#CE7C9D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475934, "uuid": "467bab1b-2e6d-4fd8-b73b-422fbcb9d443", "value": "T15EC69D21B64AC53AEA6E41B1596CDB6B61797FB20B7144CB73DC39AE0F704C21232E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475934, "uuid": "50c2af41-b224-444e-94e0-e868a6332838", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475934, "uuid": "cbe13da4-b1bc-4484-8ce1-e203994230c1", "value": "196608:P9upko8Rr6rLOc3Loy3oWXD68xJpWnBAXmSaqgTzOkI4Ky:P9/o88OcboKh6EJKSaRTzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752475934, "uuid": "598ac7bb-83d7-4e3f-8afc-cadd321fd75d", "value": 11500044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752475934, "uuid": "43cba6e7-c1ca-41f5-9c47-529024f43bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475934, "uuid": "11490d49-cc99-4a4b-9e95-eaead49c26dd", "value": "silovik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb2ee2f-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503678, "uuid": "1424669c-fbb2-4bdd-9585-17f62e1e150c", "comment": "Malware payload (Gafgyt)", "value": "6143bf3f45d792b833c341053893b00a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503678, "uuid": "6616bd26-98f8-4563-a6ea-0d105cd11a84", "comment": "Malware payload (Gafgyt)", "value": "3ada6d557b05638880fd1ce3f4b8be0b1579f8d02f80db6a8ebeeb7aea1193db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503678, "uuid": "a69c77f3-89c6-4945-aa27-d164b02f08d9", "comment": "Malware payload (Gafgyt)", "value": "0af70d51d7f6145df6a5c8968c24018dd563d86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503678, "uuid": "0cfdee54-62fd-426b-ba17-ee6882459b59", "comment": "Malware payload (Gafgyt)", "value": "481e1953d4fce1a1d68d85727b06aeaa8afbbac49d976fd8a63b15d7eabb988df0292a82e7ff3a443d1880e83207ed0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503678, "uuid": "581d76dd-05fa-49f9-9810-a7a023a3ef05", "value": "T1BF930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503678, "uuid": "6f466735-fa33-4710-8329-9cac257cd18d", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxXePczYrmREqQ4b/X7XSee:OQ2HYBv1WTiePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503678, "uuid": "26c30b20-6def-472e-b4af-e95907a37130", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503678, "uuid": "922f82a7-1b6d-48b1-8732-9674539bb466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503678, "uuid": "8b60dbe1-761a-40a8-bd02-5f07dd998a49", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b565566b-604c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752454302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454302, "uuid": "a82cc616-0fec-44f8-b707-97cf6801c034", "comment": "Malware payload", "value": "063ea883f8c67d3bb22e0a465136ca4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454302, "uuid": "8a98fb37-94b7-49a7-9f64-54f17ed526cc", "comment": "Malware payload", "value": "3b64ce283febf3207dd20c99fc53de65b07044231eb544c4c41de374a2571c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454302, "uuid": "b994186f-4e41-447b-b6c4-9bcc062457e8", "comment": "Malware payload", "value": "3a168a9153ee32b86d9a5411b0af13846c55ee1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454302, "uuid": "13aa32dc-8b9d-44b8-be17-8535a08f82a8", "comment": "Malware payload", "value": "b96e6c976b88f9da5bedc77ccba0db57e7c4c76f1d48f61206c8aa055f9fb001ae497ff9349ddfd54c17a50f79eb493c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-rated1337-group", "colour": "#5C1602", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454302, "uuid": "7442e3dc-d05d-46a0-ab96-8ddf32ad494e", "value": "T11DD72253D002CA29E9990B7289D17A1B1A74BC1CBA2B971EF90CFF55F57330D3889369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454302, "uuid": "ccd71f70-3887-46c9-bc41-2cd1c7b2681b", "value": "97d03663bf726a58471f76577c847daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454302, "uuid": "21e549ec-d466-439e-9042-026e598d4637", "value": "1572864:aj6L5PLk/mBCSyKOYl39GFoFEujFMm+B997DaNHN1oS72fnD9hRzZ01tO0DpvrvI:i6cSzV9GCFEujFMm+B997DaNHN1oS72X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752454302, "uuid": "c8013942-d143-4954-a6a2-de13930074cf", "value": 60737536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752454302, "uuid": "113a02e5-3edd-4b91-8d5d-37883aa243ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454302, "uuid": "f8c94ce2-a0c3-4631-beb8-3fa487ea1876", "value": "InjectorMediaCreated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344b9297-6049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752452797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452797, "uuid": "d508cd8c-4113-43e5-835b-c43bcbb3d4e3", "comment": "Malware payload (Mirai)", "value": "3e56dcab42361c5e4897e6cf0e34df36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452797, "uuid": "b82b3a59-cb23-45c5-b1c6-3ef6bbe06d79", "comment": "Malware payload (Mirai)", "value": "3b8830c094be7a83a2ffbf230c52483074c35fb7d9fd2d3d80f11dd9c7f4a2bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452797, "uuid": "9693eea5-01bb-4299-bcd1-2ae23ab1c67a", "comment": "Malware payload (Mirai)", "value": "f412647b4f9afe21b183fe113d725b9f988d9789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452797, "uuid": "63580e87-a46c-4863-a6bd-7ca1482dc9f8", "comment": "Malware payload (Mirai)", "value": "c12eeb2b26e0bdf6076827fdf25f436720642ef330bf9322e1bdd3afa2b048664910043971b141a7c8489d4d49c46700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452797, "uuid": "fb9bf6eb-52f0-4b5a-a726-2b3d04beb501", "value": "T176738C62C62D0D68D21849B070A4EE31CB5381E68A572EF7F231C769A943DDDB225FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452797, "uuid": "9f243e10-c732-472a-9aba-15e01791ef75", "value": "1536:kvrKhWYj8aZBFp96qob6S5HdfcRA6DKUsjsWMQI4CEORibs4WA:kTaWYjftob6S5yRKUoMp4ZuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452797, "uuid": "b4fbe3cf-7592-4503-88a4-13d259ce125c", "value": 79920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452797, "uuid": "5484cf3c-0cb6-477e-ac83-3c33fe4cb312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452797, "uuid": "003e90e9-055e-4d37-ae8f-a747132da87c", "value": "system", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1355e543-60a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752493544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493544, "uuid": "0acd4335-34a7-4614-9c20-7106b0d54c17", "comment": "Malware payload", "value": "0b5457345e8b45930fba104a16762079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493544, "uuid": "1b577f58-caa4-4fd1-b97c-1440c9707419", "comment": "Malware payload", "value": "3b98b165825c83ad0df342ea880374d90393cdd2d24703eee10bb252c6837ef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493544, "uuid": "a9542fd0-49bc-45a6-baac-d0c187c7949c", "comment": "Malware payload", "value": "910a52927c0004081eca6f50a8922f99df77ce28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493544, "uuid": "5210c762-03e9-4565-935a-e3cd83d685e3", "comment": "Malware payload", "value": "d046d2ba8668838f74fa953b6642ed8f2524ef8719f804edaa8b62026f38a6e7e31dcfe8f1e2c27e4b2d4e8c885be408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493544, "uuid": "e428bde0-88c2-4951-9c8a-4c9d64436b4f", "value": "T184C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493544, "uuid": "4a1539f4-4240-4d9f-8825-ee2ff7797999", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493544, "uuid": "3f34a5de-4013-42a6-98b2-9695b29fd825", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493544, "uuid": "72361b30-23fe-4b84-8a15-5446df2cc249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493544, "uuid": "1ba91388-e88d-46fe-997c-f65016df40fe", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ad94d4-60c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752507211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507211, "uuid": "d83a4f71-84ea-4731-88d1-be6d070e332b", "comment": "Malware payload (Mirai)", "value": "6917450dd422fa713a47da60b067c819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507211, "uuid": "038e06cb-e878-458b-b74b-63edf9821577", "comment": "Malware payload (Mirai)", "value": "3bcaad03c792032a7e1b4125fecd40a69eedab1eaf71febb8a15cc662668c69c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507211, "uuid": "e6eb3d54-c015-49cd-acf0-8203db8cd759", "comment": "Malware payload (Mirai)", "value": "f13a30e6ae45d6cd43b8a2244c452f0baf019ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507211, "uuid": "763f33d5-6066-409c-9c7c-fa505e0f150b", "comment": "Malware payload (Mirai)", "value": "91400db57dc9407c1a6c9d891d9b45f4dad698d7f3b61507a5339a45de52e53c4d5a9cae8bba00bfc46c5551a67b37fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507211, "uuid": "9a3298f4-5d47-4310-82db-2b39be30d832", "value": "T11715BFC9FBC350F2CC5202F20926A36B5F76D9284134D9C6E7DE2C7AAC92B515A2F351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507211, "uuid": "31e61143-f571-47ed-9f41-4bbe06b18c0a", "value": "24576:/1iJvH/T1aS5dGhTNnsMelrKFtPHrBphlhkbFOf:UfT1zGhxnsveLBphlhkb0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752507211, "uuid": "3daa615a-93aa-425e-8b6d-ffa8eea9cc77", "value": 877328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752507211, "uuid": "5910caed-1de1-49f3-b673-be6b32b890e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507211, "uuid": "a7f48ce0-a6e2-48a3-86f2-c43c64ea2328", "value": "busybox-i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ab2f9a-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514857, "uuid": "db05984b-ee78-4880-a5b2-fe4fc2022596", "comment": "Malware payload (Mirai)", "value": "750bf3b96aff68c58b32222ff03de2d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514857, "uuid": "5a538aa4-91bf-4533-8470-d4d149fd5db5", "comment": "Malware payload (Mirai)", "value": "3beb3b65d153b51c68a2453009f04e0360dce584eed324375a7f7bf9f9d869f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514857, "uuid": "98e5dbd5-a00a-43be-8f3d-34fda7c5ca8d", "comment": "Malware payload (Mirai)", "value": "a9e0cc5b6f8c9fd255bf0fad0ef93770698fce5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514857, "uuid": "1b34f144-d2b5-421e-ae5f-1cd895bf6354", "comment": "Malware payload (Mirai)", "value": "e7328e11484e094d11a534f6e6dcdd2d9298a91c723b4f810b849d328b717b37dac7bcbc4260e67ac6dcfef2ca02e851", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514857, "uuid": "2b845d7c-890f-4732-86d9-107d81669fda", "value": "T135932896F8818B12D5C5027AFA1D164E372357E8E3DE72139E246F2173CA56B0E3BC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514857, "uuid": "5e36c144-def1-4a9c-b925-1749406e8e22", "value": "1536:92n5YELsuFjsRPOUjt+0rr/o+YMsDNs4aI9FtXSDBRiiKD7r5GYs+a1UQZr:SYEjjMt+zwKNs4aIYKD7r0RLBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514857, "uuid": "a49d1587-7648-425a-985a-6e1e3042eb66", "value": 89668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514857, "uuid": "dee72500-b517-4637-84f5-5be5d56bb90c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514857, "uuid": "e78371aa-5d87-4a3c-915a-52a93db240a5", "value": "top1miku.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e170e1-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752537251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537251, "uuid": "419c651c-15d9-4fc3-9ffc-b01bd10fc32b", "comment": "Malware payload", "value": "0a6de2faa8460c0279c1d89a9fda7556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537251, "uuid": "95edfe0a-bbb0-4e24-8f3a-b0aaf9be9504", "comment": "Malware payload", "value": "3c43bc3a27681d54a55db07886da3ccef80957a95c03699452dfe2818bb831ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537251, "uuid": "5e1769ab-14ca-47ce-9db5-f99052ff07d4", "comment": "Malware payload", "value": "de0dffeb99644bb20850920a5361084a130be06a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537251, "uuid": "0255eacb-8627-4dea-a4fd-e4f76f0a72c9", "comment": "Malware payload", "value": "fc75f4b41ec31da17e045dd1c6e5d3ff18b71ccbc3da7a25f0b5e38a69323e45fd36af516ef9ba0652a8cbabc8755471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537251, "uuid": "4fa1d574-95ed-4697-8b3f-c6f027c0e872", "value": "T129332984B9816B17C6C20277FA4E438D7B2663C8E3DD7303DA269F61379792B0D6B944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537251, "uuid": "706f043e-224c-4372-bb87-3942e7f43a1e", "value": "768:KV9q8BGzfNUyCG5660SyMONgdcFWtmhzVbtWvkmwPI:oo1bJbdONhWtm1HWvk/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537251, "uuid": "aa38b445-6ef2-442d-a74a-a75130948a4f", "value": 54900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537251, "uuid": "882ba62d-3c4c-4d29-bf9b-e6ea3b979d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537251, "uuid": "6b94ddc3-4834-4b27-ae24-a4e3e11e89e9", "value": "fsociety.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fdf592-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752513929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513929, "uuid": "839eb537-b57e-4ddd-80ca-ca6343ac316f", "comment": "Malware payload", "value": "7ddcde64d8cf932a10b0cf129dd2b695", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513929, "uuid": "eeda5ebc-b386-4063-be4e-7dbfd9b448d5", "comment": "Malware payload", "value": "3c666e673d005b61d6290ae88dceb970012e7ab3c89a1edd39df8b88a8c45322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513929, "uuid": "db2030f1-d0fd-4aae-9e22-8db88fcd2c29", "comment": "Malware payload", "value": "3ad184a17d9dcad1788f951602ae053fc2eff717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513929, "uuid": "48e5603b-bd8a-4dc3-9230-0d77bb2aee19", "comment": "Malware payload", "value": "84174f33b4eb41d1c18b254996d36296203cca51fc5deeaa808a200ed12338720694cf10772f8616ad6be8d487ef07ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513929, "uuid": "6298dd42-9e6d-4599-a809-fc4529faf61c", "value": "T1F6B402018F881F8BC5AFCD750A2E167311AEDD9F46CA653E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513929, "uuid": "39aa997b-b45a-4be3-b423-97afb4253da9", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513929, "uuid": "7db965f6-a7a9-4128-80e9-9a5058e7bd11", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513929, "uuid": "c31ad335-4f70-4f7a-bc70-46807fcedd4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513929, "uuid": "74563439-aea4-4376-823a-dea808b33bde", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841e1344-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485143, "uuid": "9d1d3cb1-55a5-4ad3-9cad-58796d57d569", "comment": "Malware payload (Mirai)", "value": "7acf3550842b5ff89ddc448b20c9c5b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485143, "uuid": "6fe81781-e6bb-45dd-b4b3-0c75d79ac765", "comment": "Malware payload (Mirai)", "value": "3c9b9c81df39c2d3b309a552c1b35b46488a23f6aa20d2b20ff42f99a1d9fbb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485143, "uuid": "23e83351-7de7-44c8-bb47-a0131c08295f", "comment": "Malware payload (Mirai)", "value": "7485ac2845f45809e8d76771fc3ea08d5b9bc663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485143, "uuid": "f7e52c71-efc2-42e6-aad1-227b6d5098d5", "comment": "Malware payload (Mirai)", "value": "53bfbb9b43a2054bda61ac85865a1fa431b9578acc41ea9389be32bc8a8733810dfac566f59143b2c10a96b34171e9fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485143, "uuid": "0bbb81e1-adf9-40d7-8976-d68e728b30d7", "value": "T1AA730A85B9819B25C6D513BBFD1F018E331657E8E3DE73129D201B607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485143, "uuid": "1d68a0d3-098d-4a9b-8967-8ee52d578070", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3b5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6bs4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485143, "uuid": "1253e491-cfc6-4777-bf75-81663ca7c943", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485143, "uuid": "e74321d7-767b-43b2-9173-c7d9ef2ff6f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485143, "uuid": "adc50466-14be-4ac0-97eb-eb3337ea2c73", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3005ba-6077-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752472733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472733, "uuid": "78cb473e-06f1-4de0-9181-ac4a246e3d22", "comment": "Malware payload", "value": "a08c9e7cab7c8cb0b60843a980f57632", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472733, "uuid": "6ce606c9-72ff-4dc7-9a81-45d6a95dd48b", "comment": "Malware payload", "value": "3d02441be4d6f93256ed353bb977277d113614797b45864b268721706ee66a77", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472733, "uuid": "58b7bad1-e8d7-46bb-9ec2-c1bdfe11c333", "comment": "Malware payload", "value": "de12196b89c02237362b7950a08f724ed5e7d9c2", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472733, "uuid": "7d92390e-e57c-4296-b556-8bb616797b22", "comment": "Malware payload", "value": "76412fdf15c436633ec6173ff4a9a8c8ddd44226546a85af1e7c8ff8f647a27e30c7534c15f9d46e5be4d6f7d88aebbe", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472733, "uuid": "deaee40a-46dd-42a4-a116-929f3970c625", "value": "T11BF0DC25D8CAC82840348B19A3F0EC48EB27E84383804889FDC4744B1B51AE549430CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472733, "uuid": "156c18f5-3c33-437b-8d92-b32c238509d0", "value": "6:TMVBd/BT9mc4slzb3tZLApFMqUu3tZOx4mc4sLC/9fAbplit/vTGQxdKOMf+XBlS:TMHdfpt6AqUWt8GC/Kyt/LfIOMf+xleL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472733, "uuid": "2cc4dfe3-51ae-44a1-be59-2e5a1295ca1b", "value": 467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472733, "uuid": "16f35750-617a-4761-a187-d45ed388f76d", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472733, "uuid": "9e73268c-feff-454c-8d24-ae0b7317cabf", "value": "Rechnung-2025-3.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3010d9a0-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536971, "uuid": "33242c86-34ac-4328-a60d-6f9c1339ba1a", "comment": "Malware payload (Mirai)", "value": "df9eeec592f98593ec561d0bb8941aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536971, "uuid": "2aee6f27-6dec-4127-a38a-7131d840e153", "comment": "Malware payload (Mirai)", "value": "3d528060a549323cf141c1ac3f62a58eafe534c6f1b7cbab7c478d71d71a12e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536971, "uuid": "c6dc279d-cea0-4458-8101-67bdb9490485", "comment": "Malware payload (Mirai)", "value": "60a6f522c321675e63837622e3dfc7d0e7fa7f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536971, "uuid": "f6f6411e-63f0-4183-8865-3b35558276d0", "comment": "Malware payload (Mirai)", "value": "e4210f425408af10db66a2672b36d180a8ac3f65fd4e037c836c12db5e8c0f52ade4d8dcee3f56d873ae1abb08819563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536971, "uuid": "52e3e278-034e-4d6b-9aec-83c112ee1801", "value": "T1CD933A81B841A726C6C116B7FF5F028D371657A8E2EA3303DD285FA4778B85B0E27746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536971, "uuid": "3f9c298d-e050-45a8-8e95-ac5349ed35ca", "value": "1536:LccdIyry54iXyJavfeN5SNdfU2QXF6+e9elDtXczlkOIhN23+2MUFsC8jooWne:LccY54iIa+5EdM2ykLglDtAEN23+UsN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536971, "uuid": "c7b32eec-0d04-4124-b50c-cbb48d5e2dd3", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536971, "uuid": "88b956ed-abc8-4138-a349-333734b5cf3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536971, "uuid": "1006562a-462d-40c9-9de0-fcad014b111d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d607f71-6062-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752463550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463550, "uuid": "ffb51139-3cbe-4251-bbdd-4a8851c4a38a", "comment": "Malware payload (AgentTesla)", "value": "f569555c7b3a65ca52d5c633665e920e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463550, "uuid": "6e753ba2-234c-447a-84b9-f0a5ddfe68ec", "comment": "Malware payload (AgentTesla)", "value": "3d5c6d39c05f201d05895f0f360cb80e7c1a6aae3e5dd1f6fdf1c4adc2b01971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463550, "uuid": "270eb5e5-9f02-46fa-81ba-890faa854fab", "comment": "Malware payload (AgentTesla)", "value": "b4d939d1f612091624394831d5ca9041d75a27d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463550, "uuid": "c19395e9-a6c9-48a2-b43d-76185f87bc39", "comment": "Malware payload (AgentTesla)", "value": "462e5d8a1b25a978c076cfbd031aff886f82e8e667ebfefae9a190da2659c7c3e9fcf3d9cc36778ad1434acfd6626472", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463550, "uuid": "5e7bb8cb-ddda-4343-822a-3c5ffcbdef0e", "value": "T16735BE1227DD8270C372A9737B15B721EE7B7C2506A1F95B2FD4093EA8A01A1731F663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463550, "uuid": "ea7a9d07-8abf-475d-bbdd-70ee16497f73", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463550, "uuid": "df2840f8-d6e6-4d8e-8165-23e372304e59", "value": "24576:Ztb20pkaCqT5TBWgNQ7a/4H444tLO6ybuS9mj6A:qVg5tQ7a/4H444tLobuS905", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752463550, "uuid": "3adf7e74-64af-4c1e-a469-67b02c5addcd", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752463550, "uuid": "026682aa-0963-4f2c-b167-07c7f7346ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463550, "uuid": "3cfdf768-c3e0-4aed-866a-cfc0d964ae62", "value": "Rubber Conveyor Belt-Conveyor Hood.DRW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea36e711-6076-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752472430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472430, "uuid": "9ac04102-da41-4380-ac0b-c8cb7f15bfce", "comment": "Malware payload (Mirai)", "value": "72cf2db3631548c4fa9a42cde602a8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472430, "uuid": "aea822e3-7b9f-4ca6-9470-64f295b9cdba", "comment": "Malware payload (Mirai)", "value": "3d607b8940b613dfa40073abb510677abd5c207d41eec5e83fc8c00de532aa94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472430, "uuid": "417e0677-6d12-4da7-8487-e4a201340a24", "comment": "Malware payload (Mirai)", "value": "5ff99372b123abca9843b2b91d6aadcb9b599e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472430, "uuid": "1031fec0-afcb-45f6-97ff-4b5b9a4eadc4", "comment": "Malware payload (Mirai)", "value": "697449a064a50019b3e6049fbfdfb8b95b46b00b9c772b34cbd1128366aa9bfbdbcf861302016e714c159dec51e0c73c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472430, "uuid": "6cf14f5c-e79d-4764-997d-9346a4ed4442", "value": "T1AF04D806AFA10FFBDCABDD3302E90B1239CC955722A53B753674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472430, "uuid": "c56bbd2f-d8e9-4d7b-9429-ea4d60c19001", "value": "3072:b8H3cJswc5VMFaqF7iBOAWSvUqscYWE0DtBiz:bmsJzc5V6PgvRs8LtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472430, "uuid": "afab1afe-39ba-4d92-be1e-617c2080ba53", "value": 181892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472430, "uuid": "c3fdffc3-b8a4-4b5a-9640-78bb02b28164", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472430, "uuid": "cc27f279-7ecc-404e-99fc-e7a1896ccd7b", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90946c34-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513081, "uuid": "4a2f24da-592f-49fc-8211-dc71067c36e2", "comment": "Malware payload (Mirai)", "value": "0d47f7100d27d8ed3b08ef343c08a8a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513081, "uuid": "10036813-0022-4a65-9276-630815da8ef8", "comment": "Malware payload (Mirai)", "value": "3d67413008e52d80b69ea710bd81c2a7d23a25596c92cacd30396221e57dd98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513081, "uuid": "3978b97b-d6bf-49b3-b98b-a8eb2632fedc", "comment": "Malware payload (Mirai)", "value": "cf6f194188ee03f4a9d7ca6ebae6c4d37b8f1dd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513081, "uuid": "aae32d90-524f-4b4c-ace4-eefeb2145bb4", "comment": "Malware payload (Mirai)", "value": "ade2faadf5b32a39f7d341e0f3dc245e771dc41e56cbdb05f3af43cdd56fc5314212d71ab8f1bec634c37503231da891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513081, "uuid": "eeb1a147-6a06-4380-9cc7-c2595e0233b8", "value": "T14FF2F121DF89982AC39C667763084DA57CF6FC8918BC160F780D08EF259B7B9D3692D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513081, "uuid": "37fee05e-0889-49e6-a9d9-31b058fab29c", "value": "768:95cJtY4YHQ1aFhfkip7TuSkahJR882L3tCdq4IO3bUJt6O/kuiR:LmtNYHuaFhfkip7nzRL2DtMq4Hw6Osr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513081, "uuid": "c3fcb607-5e2b-43c4-b7f0-7889c31598e4", "value": 37564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513081, "uuid": "ab2bfa66-af65-4090-b1c5-4b4e4a9974df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513081, "uuid": "d53e2f81-f86f-4e68-bc67-0f55aa150b5c", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cc307e-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494855, "uuid": "95b728ec-9a4a-40b6-a7f9-ffe00c70c955", "comment": "Malware payload (Mirai)", "value": "2141dd1b078fb57f1fc5de7b596dae10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494855, "uuid": "6f4d77db-bae9-4230-8593-d32d04d076d5", "comment": "Malware payload (Mirai)", "value": "3dae44b5ce190ab5c3ae52e913c9026230863fdfe7e1265cd4769a24925def7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494855, "uuid": "3db6635d-83b8-4ae4-9405-0742b4dcd689", "comment": "Malware payload (Mirai)", "value": "fa2fe0f804aa567be4adb5a073f236385df25144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494855, "uuid": "1a570bef-8cd9-46b2-92b2-93cf469129d3", "comment": "Malware payload (Mirai)", "value": "4e6c6808040febdd7d48175f97dba50c4d3d0458f6878888fd98d972483e26b124feb09b730e243949c109ff59c0cb60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494855, "uuid": "d9e61631-1e40-4a4e-9a47-73071ed90a60", "value": "T15343F122BE6674D1D629247209A48A1B6FEE8774C23D712D427D33349CCEA1189FCAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494855, "uuid": "df2440ca-31a8-4b27-987a-66aacc8a96c7", "value": "1536:lKpiLiHYeIU/XDX8wclTv0h0OLgw/7BUWmpeag:nLRer/XLslTy/L37BUFpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494855, "uuid": "6ce96ccb-e6cc-4691-b7dd-19fa22bf2066", "value": 60604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494855, "uuid": "bf5fb157-9a30-4066-9d4f-c724e6857435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494855, "uuid": "0b5d7cd3-5434-4af4-887b-fe23d25b4169", "value": "top1miku.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e60694-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493120, "uuid": "ceeb5443-7f34-4d23-bdbf-751a62c690fd", "comment": "Malware payload (Mirai)", "value": "0b33a44f404c7cef42e9690b751562c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493120, "uuid": "deb36491-848f-4c35-9d43-9f51036d4dfd", "comment": "Malware payload (Mirai)", "value": "3de3fa9555bee8fa8a2162bde42cc025e3f10908075f847c14053620d6b7e92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493120, "uuid": "b1877d06-f64f-4d6f-9dcf-ee418c03eb5b", "comment": "Malware payload (Mirai)", "value": "73b515e87fc6670bc2c0733151c8cbfe5978b8ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493120, "uuid": "d4260d17-20b9-4f91-8edd-3b94c81ff148", "comment": "Malware payload (Mirai)", "value": "4bd73c974abf6188b2461a81f0c9d9a457a9c8af5ec10a677b17937c1ab84f8c3b8b07316e6898103142d99ffcb84349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493120, "uuid": "06df975c-4a5d-4bbe-8540-74f453bc7a98", "value": "T1DCF2F20D1605A8BEDECB58F717F3176E0F250BDBA0A6CE82101ADE519D6D8B97C412F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493120, "uuid": "df9d925d-cca1-4be5-855c-4fac90b19efd", "value": "768:6dFvRfV8nmFX9f5/pJmthL6y9YnUe6MMNUJaLwhJgGlzDpbuR1J/:yFRqmZ9ftkRYnFMN9EzVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493120, "uuid": "1b5f5b8d-d486-4fdd-8b6c-d7f208d9ed67", "value": 36584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493120, "uuid": "0b9ca744-a67a-4953-b70d-c3a5b507dcc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493120, "uuid": "43709efa-3ce7-4f53-a917-4f8ef7506490", "value": "top1miku.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684c6403-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485096, "uuid": "e3872c66-d663-49f4-a7e0-10fbb1e568db", "comment": "Malware payload (Mirai)", "value": "2a4495b9e5d83c2473e7129df6ec0903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485096, "uuid": "47f6150d-2219-4409-b420-9b5ba74c3d6b", "comment": "Malware payload (Mirai)", "value": "3df0728692c0227bc0d948a8d626a1e23e7a206b73fdbd041c4f024a0eb619ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485096, "uuid": "c7d95a6b-c6ea-4091-81fe-657c4fe85254", "comment": "Malware payload (Mirai)", "value": "6c576a575efe117e68115d9ecbcb479ce37dcc07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485096, "uuid": "ca206e42-5680-47f9-a3f5-9cde999fa616", "comment": "Malware payload (Mirai)", "value": "f5b839f3834d503f0a6c34eb054e6ca412bfe957edcbaca6e5727fadf3ea270718fc96f241c560490e215c119e2c6269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485096, "uuid": "251386b2-ec64-4464-ab3d-971468c491f7", "value": "T1A7D2D17D63054BDFC67A88781DD40B68189403E3B693A40D7796A8936F1D86C7C5BED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485096, "uuid": "cd1fb753-44f4-4b83-bc27-8dde65bf5bde", "value": "768:04ylAtv6pq7FdaPd0vj4yjO4TisCG59IJgGlzDpbuR1Jx:nMBEpr4hWCVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485096, "uuid": "d873e967-e1e9-48a8-8d8d-f14a6b0dcb6b", "value": 28892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485096, "uuid": "d5850ef4-13ee-4e2e-a838-762a297df90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485096, "uuid": "22ec49f9-43fd-4357-bd0e-c233f6531c32", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5974ea-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473512, "uuid": "78fc2345-ff45-492b-9c1d-d429214e064c", "comment": "Malware payload", "value": "9b92927b5bce6dddb6c3f5ec857c880e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473512, "uuid": "eb0fa5e1-4e9e-44c5-b1c8-e93f7d32454f", "comment": "Malware payload", "value": "3e6d5e32a552c070ef50a927dd19c90515efae5d917c81910a9152906153bed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473512, "uuid": "f335a4b5-1e30-4add-b2c7-27110f1cf450", "comment": "Malware payload", "value": "e290491b51062778fee235d1f5efadacebcbd3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473512, "uuid": "fee1dde3-b79f-4cc9-8940-3aa90ba2687e", "comment": "Malware payload", "value": "4b5bdcb05b7b5665837fed69345444ffefdf736b8300ee530cf263c1cec818610841b5769f9aafb78065c7269e5e5ece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473512, "uuid": "9c2cf026-6dde-4219-bdb4-f9f1a57b8376", "value": "T146A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473512, "uuid": "8b4391a3-dc7e-41a6-aeb9-4c2e5b7e3894", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473512, "uuid": "4652af5a-096c-4728-9928-64a3342eb66c", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473512, "uuid": "9daa9b69-014b-48e2-84b3-1ab02dfe7975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473512, "uuid": "898e36a6-04e2-4305-b0f5-66720242b372", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d772d2-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496895, "uuid": "1469a6db-b326-42d7-948b-11433e308ada", "comment": "Malware payload (Mirai)", "value": "ee274f812a8b6197cd863ee0f4fbc674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496895, "uuid": "17b11a00-d58c-4e09-a512-e53644e5ec32", "comment": "Malware payload (Mirai)", "value": "3e8967ed9adc342f569cd6048135e620c907762c14591a847cfe99fe9bd390b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496895, "uuid": "f5d5a301-152a-4177-ae9c-49833ff782be", "comment": "Malware payload (Mirai)", "value": "02ac9b0fab8f8fc4fe0faa3ae900c26e2480b1e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496895, "uuid": "07ac8a99-3b94-4f87-bae7-c63992ef9f62", "comment": "Malware payload (Mirai)", "value": "cbbbbf0704aba6ba407ceb41142dbae84234653930adf63302fc72ed95c40324b96de5b11d19b4721f84f6b8b5dfb1b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496895, "uuid": "df7e72fd-4264-4fde-a0c1-b0cb4b6bf506", "value": "T137633AC0A593ECF4DD1507B43077EB374A77F136611AE9C7D3A8A923BC82A41950B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496895, "uuid": "7247b095-66cc-4687-a546-1707430d6a01", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatGSk3Ja86t3zzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatGS8aBlcSQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496895, "uuid": "d99596b1-34d0-4340-aaf9-9c5ed970ead2", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496895, "uuid": "f2f24cda-cae1-4a5e-8167-d8d2873612bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496895, "uuid": "2256d980-2665-4dd8-bfa8-d07b857c217c", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a210dbc0-60cb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752508816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508816, "uuid": "495914a7-9bbc-43c9-9d39-ae229552f8a0", "comment": "Malware payload", "value": "44b86b3e8646bf800da636a60cac06d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508816, "uuid": "064abf49-041e-46ac-9843-b2173bbc120b", "comment": "Malware payload", "value": "3e8970a740e2fcad734abbd87b80ac78f4763ddc778b5db42048c09c0e52834c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508816, "uuid": "81ffd9a8-ce4f-42e9-bbce-62011429653d", "comment": "Malware payload", "value": "3312faca7dd24e35d9f1416111419f17d660f2b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508816, "uuid": "a050d9c2-ad5b-47d0-b4a6-c54c7309a86b", "comment": "Malware payload", "value": "c58b86685dd2994310a70d8f3cec1f57c449c1919f188e4c603cf6561fa3f5df930d6ff2a7dd1d27a9da9deccf53b1c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508816, "uuid": "2f1ce7fc-876e-4aa7-932c-f470597339cf", "value": "T121E733DEEE1F6902CD7117B36F924ED595B13E21348B500C005E54638B9F9A2EDE28EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508816, "uuid": "815214af-fc2c-4596-b851-897a09d9f3e3", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508816, "uuid": "d6bda4f4-9f3b-41e3-b18f-7086bbc5723e", "value": "1572864:qNcSlxgg83CRlItR4WHrpHAL5DvOqtfw83flwyJ85DnR:qNRlxggECbWOMrpgtrwyC51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752508816, "uuid": "14b0b609-8425-4f76-ba5e-ec844dce8288", "value": 64855220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752508816, "uuid": "e2095da9-02a6-496f-8668-a9ee77df2470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508816, "uuid": "8f4c0163-5ad1-4f83-8679-3e0127933f33", "value": "Yiwaiwai\u6613\u6b6a\u6b6a_\u8f6f\u4ef6\u4e0b\u8f7d(126).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a90076-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485087, "uuid": "a6f68e31-2b09-4001-8f2e-a2e83655284f", "comment": "Malware payload (Mirai)", "value": "ec53171418ec151ecdaba939146c425f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485087, "uuid": "0908d0ba-e432-44ce-8b05-49ccca795b17", "comment": "Malware payload (Mirai)", "value": "3ec06b04581a5ccc11d85758a2b2006e0c27a7902bf894fa9a45752f2b446fba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485087, "uuid": "845c6afb-270a-4b2a-a988-7d30f440a1ab", "comment": "Malware payload (Mirai)", "value": "5dc75b31500da9d8e0d5fe284b62e01791bb899d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485087, "uuid": "7d2bdabe-a826-44b8-ae1d-6c7617b829c2", "comment": "Malware payload (Mirai)", "value": "dd6cab29e7b008194abed0cfb0c42e2720635d88896adf77e33486e854f5f6cb0ca98611532a3422c339bfe972812c1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485087, "uuid": "51f2666d-d783-4049-82a6-afdf1e8769e0", "value": "T123C2E1A285FACA17CC63837D1928157351681C55D70DDE3D1B2BAADC53C80E72ABAC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485087, "uuid": "ffeaf48a-e531-4d77-87e4-925c366e3215", "value": "384:Msy9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcB:w5+Kcrb9VDJef5Q2PdHuzb8HoEPboEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485087, "uuid": "abd6922c-4d72-47d6-bf86-abf1b6067eea", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485087, "uuid": "0b690eeb-19c5-4d23-9809-5a0299b7afa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485087, "uuid": "d7270ae9-72ec-4dfc-850e-31d1e486b181", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c4ca28-60b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752499668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499668, "uuid": "7b349456-118d-45d1-bfc3-fb2de65cfd53", "comment": "Malware payload", "value": "9585919158b559ee657eae2ef44ce275", "object_relation": "md5", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499668, "uuid": "5e9ffe90-b021-4596-96d9-926eff0dfafd", "comment": "Malware payload", "value": "3f0d968c3a68f5ac90789d1f0b0295c7f797ceacc448e64a295e37058bcad2d4", "object_relation": "sha256", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499668, "uuid": "8c80de09-31df-498d-97bf-96f3a1dc0991", "comment": "Malware payload", "value": "a6c1b388e1da1b72c5059d49f88dfef1870e5415", "object_relation": "sha1", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499668, "uuid": "10a497c8-c950-41da-94e3-3cf8f128cbd9", "comment": "Malware payload", "value": "5c674b8c074365d5f5da440a65da0e00db735d1c3837b0df4579b099ba87d5c9d0e1fd8bddf1619494ec823f39532d59", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-173-59", "colour": "#C6897F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499668, "uuid": "7de7594d-f252-4901-9395-72b1202c3be5", "value": "T1D2D5F288D99C960C7669F7E80D76791CFC5427BF188F9D4734A8AEED97B4020C053CAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499668, "uuid": "8c515829-cf8b-4301-87ce-741ccf70c4df", "value": "6144:AkoLuR1zCzN/031zj2WJ9tyEd3YxQT9Hy2oRl+q5av:AkfRcN/031zBJyEd3YxQTpy7Rj5av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752499668, "uuid": "38093233-c186-4575-99f1-66d68317c26a", "value": 2991412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752499668, "uuid": "065fe720-8321-4baa-8475-57a0cd4226fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499668, "uuid": "8f00cce4-99e9-4259-ae6c-d706b11c39d1", "value": "PaymentNotificationDocument.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6add5-60f6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1752527129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527129, "uuid": "8e0abe59-fc1e-475e-82f3-6006e5b557ed", "comment": "Malware payload (PureLogsStealer)", "value": "cd790459dba42c4939701d8c5b25c5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527129, "uuid": "88cf784e-fae7-43c1-8de6-0a479546137c", "comment": "Malware payload (PureLogsStealer)", "value": "3f2c2a27ffd45d9aac74c88a5cca6a086e1205e8a88ad9b951a6b093c0d6ed34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527129, "uuid": "ee70193e-f5aa-4b67-942a-60020e9b2665", "comment": "Malware payload (PureLogsStealer)", "value": "cd3f3714e305d74099e1f84e0380255927a5a4f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527129, "uuid": "bfe79592-b826-44d7-b6f5-3913bf5184bb", "comment": "Malware payload (PureLogsStealer)", "value": "9541a53073fcc71e3453c684b7d1fb38d386d574620c8ecf38901264923dba496e6ee9d92f26b6c3171dc78066083dbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527129, "uuid": "496c4582-20d9-4657-87ea-7bfea31b870b", "value": "T151E53304564D4A52D2DE4DFAC6DB284213AC78FA0D86DF6F60C33F892B297C94A7542F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527129, "uuid": "89b9bc67-9ed9-4b53-b07c-8a94ea0396b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527129, "uuid": "13c27e59-2526-4c1f-accb-52c8c3a195ba", "value": "49152:3Lpvt/Z6su+MSDoMJOjALEl5Lrlp08a8WDEyK/DEljzej1B/ysSFDQDxCUM:3LH/ss7DoHQEXPA8gy/DEFYRysSNcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752527129, "uuid": "4caf82cd-72c5-4981-945a-3666a342207a", "value": 3090800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752527129, "uuid": "982c878c-0f20-43ad-81b3-fc607b94dbc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527129, "uuid": "bfb02840-f845-492c-b821-ed286b9aab99", "value": "3f2c2a27ffd45d9aac74c88a5cca6a086e1205e8a88ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3e8629-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485214, "uuid": "6eafc736-4516-4293-af6f-2acd251fb53b", "comment": "Malware payload (Mirai)", "value": "b17462dbb47a6f72e5e8697b8ed03d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485214, "uuid": "c988baa8-4df5-4a9b-ab87-5929fc836e89", "comment": "Malware payload (Mirai)", "value": "3f5c0531084a397874d521282f4cc40ceb6461d2f0434a7a23e0bf28a9d43ca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485214, "uuid": "bcc01e25-d0d4-46eb-8e65-81bda0b1d755", "comment": "Malware payload (Mirai)", "value": "f71de6f473e4f4c01ffb60c87ca9a0b8ffb6144d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485214, "uuid": "a320437e-5a23-47da-aa3f-1bab16ef8878", "comment": "Malware payload (Mirai)", "value": "160c56afc649e098a6d23fc924ccc540c6b724cb473af0c5689da1974ebfc8e38e205c66c144cb0710437096ecfb6e4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485214, "uuid": "7439d46f-65a8-41b3-b90c-853e0e328465", "value": "T11773065AF9819B12D5C1167AFA1E524E732307ACE3DFB2179E18AF30278B5270E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485214, "uuid": "173b5e3d-de49-40cc-9ff9-5e83d4c6018b", "value": "1536:+BnQ8tVScQUokDaaHBnLL+I2izmhRF5rLrA7I45x+xqYNv:4t4ookDaaH3mhRF5rLsE4a0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485214, "uuid": "8a4ded0c-b08b-4ff1-85e0-38b0a4d016bf", "value": 79004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485214, "uuid": "9e8982bc-e690-4556-8fff-511e3679df18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485214, "uuid": "cae835c1-8234-4f1d-ac2c-31818d77ddf2", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98f04c9-60b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752500319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500319, "uuid": "8ca92c2e-a1ee-4e33-8048-3cee169c20ca", "comment": "Malware payload", "value": "77e30a1dca58dd92c2e45842fd43f0aa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500319, "uuid": "c83a2f09-66a7-4624-9082-d8c8c62e76dc", "comment": "Malware payload", "value": "3f9646c1e8760ce5646f92166e4df386d77b102c276641aa5ba405ad38cbe440", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500319, "uuid": "ebb5cd63-ac6c-4767-acc9-e646e9e53b0e", "comment": "Malware payload", "value": "786c82269a1f1657c8a966a88ea974f522e55048", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500319, "uuid": "fb4b63d2-b35b-4f1a-bdb3-ddcb0338d09e", "comment": "Malware payload", "value": "3ce2b957b3377e66d190dae55f605fadf69ad8299e09edd8e991602dab24e10a320d8f11363c7f24ee22c153568f3859", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500319, "uuid": "d339fbc8-93de-427c-9589-96ff8c97bd14", "value": "T1CAA312608F6B7835D5D60B3143DAF8D2A1D026842269FDDD09F6984D3CDE60B8E3394E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500319, "uuid": "3923fc19-ee1d-47dc-b510-5d801bfae99e", "value": "3072:7hZ+6HVhryI/sFG7f0Js6KqfgRSRz+ikULs0QQvxquanEW7XG:7/+2VJN/T7r6K9SRmUL/QQvDaNLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500319, "uuid": "718c5fe4-f942-4b8e-8f70-9c53519b895f", "value": 105652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500319, "uuid": "148b8bf8-f861-468b-a78e-3aa66ba3b7a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500319, "uuid": "5f7e54dd-d1fe-4aea-a900-496104067d93", "value": "SampleForChallenge (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b955a301-6072-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752470630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470630, "uuid": "880fe8c9-fe67-467e-8efa-97114f82d3ec", "comment": "Malware payload", "value": "a38d47b722492609b07d4ddd19f7e3e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470630, "uuid": "7d9b585f-db55-4f91-8cbc-51f9c735b9a7", "comment": "Malware payload", "value": "4041e2c89210473b71d747fd8bb69343bc84f8db412a105a3ee320efb85aebfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470630, "uuid": "a36084e5-3958-4037-95db-3de1db039a01", "comment": "Malware payload", "value": "2698d7bda461607e6f55f71a27579844e246713a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470630, "uuid": "3246b465-a9c0-4f79-b490-3ecccb730002", "comment": "Malware payload", "value": "6c841701e1d9d62b693dfd84c1a39d5950533d94e7c854074a8a6608ec44a889ee003ef69b7ea46202240f57c67eb72d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470630, "uuid": "641ca2a5-9e5b-45c6-97a6-648069c992fa", "value": "T13EC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470630, "uuid": "181f409c-5f77-4641-a7d8-5ca038fc93b6", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470630, "uuid": "ef95f75f-c66c-4090-ab62-ffd42eb415b7", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470630, "uuid": "3e8f6627-8f30-41a4-aff9-3d6b8965e24c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470630, "uuid": "5a1455e5-722c-4c87-9eba-12f5f748ff84", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee262aa2-607b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752474584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474584, "uuid": "e3f323dc-b021-4b19-b61e-47ed6075c38d", "comment": "Malware payload (Mirai)", "value": "bb8d1e71603c3deef491e17f31d21aeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474584, "uuid": "3a0c028a-3870-4422-9a38-ed0c850bd662", "comment": "Malware payload (Mirai)", "value": "406f64d5ee8297963bdc098a541c4654d7a14c07aa978f2c4142647c06fd8864", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474584, "uuid": "cdd38dd0-3d63-45db-9208-f8bedb11351e", "comment": "Malware payload (Mirai)", "value": "8b3d9a8fdc25a2f31fc608fd0e57a6fdfce4e461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474584, "uuid": "4e54441e-4dac-4e0b-ae69-3013096ee738", "comment": "Malware payload (Mirai)", "value": "9dbef165281946eb4a46f2c163befa195640638faf364a9d184beb8874250b0d937e3e0c6a8bd9bc1a31bcf728264821", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474584, "uuid": "2a86ddb5-625a-4451-a17e-42225409e1cf", "value": "T183B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88773CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474584, "uuid": "4e773778-8167-45ad-a518-2b9f7f012510", "value": "3072:MDVLSItJP+Xsp4JlN3HPjmH1cuEgvniuN/:MDV+ItJH2l3HPjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474584, "uuid": "2b5522a6-0ff9-4cb7-aa89-fd9629812362", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474584, "uuid": "4081350e-e472-4452-a5b4-ab0ef1a283c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474584, "uuid": "48836be5-da11-4ee4-88f4-9d5e49d1a8d6", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c477001-6091-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752483707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483707, "uuid": "94964de1-3e11-4f17-bafe-c5c836967202", "comment": "Malware payload (NetSupport)", "value": "6bc12de238bc983d4164e6da83c653bf", "object_relation": "md5", "Tag": [ { "name": "176-65-140-160", "colour": "#D05C54", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "resetis-com", "colour": "#7C6520", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483707, "uuid": "63a60dc3-591d-454d-a1ba-e64e13839ee3", "comment": "Malware payload (NetSupport)", "value": "40cd93c23a235d47f4a2aa3ed0a2ac98a486b37b8f75bef6a7bb5d268a7d5f67", "object_relation": "sha256", "Tag": [ { "name": "176-65-140-160", "colour": "#D05C54", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "resetis-com", "colour": "#7C6520", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483707, "uuid": "e977cd26-9f31-4310-b067-e0bda34e769e", "comment": "Malware payload (NetSupport)", "value": "c1ad9998b34c567c887c7f1dd9ed095d9a325715", "object_relation": "sha1", "Tag": [ { "name": "176-65-140-160", "colour": "#D05C54", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "resetis-com", "colour": "#7C6520", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483707, "uuid": "395259d3-0259-43b0-afd0-116e5494b764", "comment": "Malware payload (NetSupport)", "value": "f4c85571136b2e18fc1adafd25117cdb842a2f3faefa17d264633d8ace4ebcbef609533008efe155e810a1a81876b676", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-140-160", "colour": "#D05C54", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "resetis-com", "colour": "#7C6520", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752483707, "uuid": "a4c36c8c-8934-4383-bdec-f68b75f3b345", "value": "T157A2D130AB7CE256E71D06F3B2D6B94D4BF850281780428AE98CFD550B5FAEF2116179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752483707, "uuid": "88d25b17-5e52-4e9d-a90c-512445bb6859", "value": "384:6XoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NSz:6XKuqXS69Szi/urdMt5lBUeuhJrsRxLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752483707, "uuid": "1808bf2a-f91a-4b26-bb0c-cf88de4d6cb7", "value": 22141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752483707, "uuid": "cf3c164b-3ed6-4fb8-b342-25bd51d28e32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752483707, "uuid": "a259e66b-1e17-482b-83e3-df185e4fe377", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649c3cbd-60b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1752500123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500123, "uuid": "775965c6-513b-4ad9-a9ee-52e691d50f88", "comment": "Malware payload (AurotunStealer)", "value": "3f7451a9d077139f30f5fbb024e85f3c", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500123, "uuid": "d1212947-35c3-4cac-88a8-0a12776fa835", "comment": "Malware payload (AurotunStealer)", "value": "410e6273918371cecde3b89b392ed1f286edc9163eee9ad5ff56ab9ec36052a0", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500123, "uuid": "3a2cc25d-06c2-4109-ba5f-82c1a6f90b25", "comment": "Malware payload (AurotunStealer)", "value": "51f873a8ae9671a4fcd4261fff2f93bfd7833f43", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500123, "uuid": "6218168a-1d4d-4968-92e0-f10c93c1bffe", "comment": "Malware payload (AurotunStealer)", "value": "9f321e73c9286042d75fe8c98ecf8a0db783c514b2cd7db3a5b9eaef6756f21d529fb7fb8a914cf115dbaadf3d743595", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500123, "uuid": "e92c4d30-61fe-4e4c-9af0-df32d7cef027", "value": "T160C69E6AB2BC00D9D47BC078CA9A9617E771741903F057DB269096EA2F23BD07E7B740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500123, "uuid": "0ca3775f-34d2-48f7-85b7-247fca8dc595", "value": "89d69ee60e55dee42074de52767a98bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500123, "uuid": "5867b1c8-2c80-4bb8-bf40-ac125a552c93", "value": "196608:BPv86df8858iGxTMKIpuGo/xtQeVT0h0qbiEe:RvVV8858iGdMKIpuGo/xtQeVTabiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500123, "uuid": "2cddb346-4e6b-49bc-8d5e-c002493fdd9b", "value": 12510208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500123, "uuid": "5a635744-d6b8-414d-b997-d3d47a93b90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500123, "uuid": "a2a67046-de1f-4e2c-9be5-146599df54a7", "value": "3f7451a9d077139f30f5fbb024e85f3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b84838-604c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752453999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453999, "uuid": "d25e189e-3ace-4bf4-bacd-386e7f459501", "comment": "Malware payload", "value": "50edbad095762e9f54001864ecfbf101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453999, "uuid": "3adfc989-93f9-4429-94e1-bf1d26811d01", "comment": "Malware payload", "value": "427ffe0452243a49598a164e77556c4b4e3d7e58d229c7384c49a356c653276f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453999, "uuid": "14b257af-fbb5-4f3c-9b2d-40284139c8c1", "comment": "Malware payload", "value": "458a78096913060ad07cf3a4a679692152dd05f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453999, "uuid": "34ca0c54-d0b1-4d19-a61f-695b53d63956", "comment": "Malware payload", "value": "5d2b05c1a4fe3808f07918d8c7be2534263773a91ad1b0422251c70d073bdc33759864a90ba9e0d41492e0d9985e2139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453999, "uuid": "7861eb9b-110b-4818-8851-4bfd044f15cd", "value": "T177E401037308A756DF4BA83A82CBFD31B7C2799153D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453999, "uuid": "684a0d3e-1aec-4fe8-9fbc-f7339d131395", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752453999, "uuid": "a7229359-56d0-41f7-b0a1-ae18adab55e9", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752453999, "uuid": "c9f8445b-7f68-4263-a0b4-c4df7512d914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453999, "uuid": "9a40e68e-b925-400c-8ce8-7aa3438f4b4c", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ed2521-6055-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752458115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458115, "uuid": "b3473c9c-1419-4d92-868c-89a0f6395388", "comment": "Malware payload (ValleyRAT)", "value": "7678ba7092c658fb4ad3908852277184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458115, "uuid": "d1b5900d-a5f5-47e0-acf9-f34a68e77769", "comment": "Malware payload (ValleyRAT)", "value": "43130df9d6c99e0d01470a57e0a21215a9afbb1c9b191e1b86fcb046316de6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458115, "uuid": "4c118cae-ffca-46f0-a405-0e350b2ee961", "comment": "Malware payload (ValleyRAT)", "value": "98079ea87d017add7dc8f17ff96d81065316220e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458115, "uuid": "f3182c55-5e1c-4c28-8f9f-cd28760f46de", "comment": "Malware payload (ValleyRAT)", "value": "e5ff83432856cd0242cd7cb79343bc0099992262cbf3a9702d7656b52da4d89111ea905b10bbd5b6b49a9fa7fc5c81a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458115, "uuid": "7033dbf4-dc06-452c-aee0-efb439ef7dcf", "value": "T17D471231B14AC43ADA6201B11A2C9FDF5128BF261BB514D7B3DC2E6E0BB45D21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458115, "uuid": "f2c43227-7c70-4aa9-bfc3-2073cb47ec57", "value": "4d363d3b473a6c355539abd95921390d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458115, "uuid": "0ca8a757-1c1e-45f0-9d38-97520bbb0b4f", "value": "393216:wEXg3pA8BmqtQLjoHWahnc3X8oC5xxb+jDcIYQS0uzsTRfnSGPrbI0lwFfSV6I5c:jX+pAokcHtcHaqvDjSDsT5nS+k0MqYI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752458115, "uuid": "dc05ad1b-6d3b-49d7-afdd-8eb60e475117", "value": 24925704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752458115, "uuid": "68b86507-c7ae-44ea-ac70-a0e823ef7eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458115, "uuid": "99da5739-feca-4cfb-b85c-342d9c301ab2", "value": "7678ba7092c658fb4ad3908852277184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85eb2d76-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516070, "uuid": "b4b6d38c-b132-4a8a-9ca2-5d44e480dd5a", "comment": "Malware payload", "value": "ba920d7c4066af160c402c3dd9d0191c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516070, "uuid": "f8cbcefd-787e-4ef1-8266-d68ea94f9267", "comment": "Malware payload", "value": "436fc4d611556dd8fbee1ddcd9f65e119efebfd465379bb8490dc1a0d3c161b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516070, "uuid": "2f956279-ed45-4305-8dad-cb18056cc6a7", "comment": "Malware payload", "value": "07912a4f5156b28bd192c82a02f52a812871679d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516070, "uuid": "1dd49b5b-33a0-4a7b-91ba-0d61ed715708", "comment": "Malware payload", "value": "dfa60ca1c254e0ab0dafa8d81dc7317cb2e93bd8ab56571992218895d61708cb589bccc4612d79fea57099b5d08014ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516070, "uuid": "a1aebb4a-832b-431e-b56a-79248fdbe769", "value": "T179160A73548B0CA5CDC32BB890C772347F74BE76851A6A5A6E14C326FAA35C05D2FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516070, "uuid": "b3c4cdcb-da1e-4651-9445-e720f487a8fc", "value": "515f06ec247e6cd83d1e0b03508ce4b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516070, "uuid": "d968b2ff-7b4a-4923-befd-290c8bab4463", "value": "49152:BWSU8pTVLrA0agckRudrTMKndagduUmkBm65hP3BB1z:Vfvck+0Uq65hP3BB1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516070, "uuid": "a90a92fe-ea6b-4f14-9971-ec270106e4d2", "value": 4019597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516070, "uuid": "f31b3824-ea58-4fbe-9ff1-c1d4ad535d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516070, "uuid": "7b59e0cd-e081-4525-b1ff-c1e9e981ec1a", "value": "update (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaeb66a-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494851, "uuid": "f3614afa-7fc8-49bf-9ba7-de75c4fd1553", "comment": "Malware payload (Mirai)", "value": "86cd20b6e37b13c37a8f5a5ffb795a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494851, "uuid": "352ffeaf-3fc2-4971-ac0e-c2318cfddf5d", "comment": "Malware payload (Mirai)", "value": "43a58144bed2fd812313a59aef629a170de4eaeec91a96395fdaa5531f598503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494851, "uuid": "e99a3251-f4ee-4557-81e4-d3729fb674f4", "comment": "Malware payload (Mirai)", "value": "3c39fdc84544157d71368be2b4c36d6b950cb416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494851, "uuid": "0e6e7f68-dbca-49ea-a0de-be9fd1a0a718", "comment": "Malware payload (Mirai)", "value": "83f07c6b44d79a46b1398f1e788a3c689e8d1976386fa78fd8b627b25e576b61f8ffc767183b4ff6e2febe740c5ad490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494851, "uuid": "82ab0bd6-d508-4de6-af68-4af9066bdf9e", "value": "T163936BC4A683D0F5ED5651B1543BE33A5732E439501EEB97D32CAE32DC92980EA1A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494851, "uuid": "942d5682-473d-4d2c-814d-9eb9a6ac8dea", "value": "1536:kiwZ9fQeiZYMfs+9gSAPzTt2k8Q9YboYRoepYfwqxdvWo1kyJcVQvS15QOF:PA7TBvkoYRoepYfJeo1jJHKwOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494851, "uuid": "28b7a3f9-90d5-4566-91ce-d22c06f7c726", "value": 92552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494851, "uuid": "cad752f1-8a74-4d15-82cb-312185ae09b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494851, "uuid": "f432513b-ae58-42f2-befc-823887d18144", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a992a966-60b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501097, "uuid": "7da1cef6-863c-49e6-ae25-36521c34f988", "comment": "Malware payload", "value": "9567d0d74e3925fe4392a82386643c48", "object_relation": "md5", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501097, "uuid": "0061f0dc-c2ce-48e7-9926-06c97967afde", "comment": "Malware payload", "value": "43eb57bf564a58394f7b1a093c4845c8e96cf60dc73e3502136673ddf902d869", "object_relation": "sha256", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501097, "uuid": "beb5e6ad-9e0b-4d3e-9c74-3471342d33a8", "comment": "Malware payload", "value": "b52bfea3c8006feaad8256917b41d931325b6fdd", "object_relation": "sha1", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501097, "uuid": "d4d2a7f8-d7a3-4485-9a90-ba5023a3ed7d", "comment": "Malware payload", "value": "4456b8670e1792738dc8616d205922aebfd9ef812dd419f7431e5c8cc7b229663c0beedd2cd85065b4fb3566bf667998", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501097, "uuid": "947172b7-4d44-4f16-8f8d-28f31378d808", "value": "T13B32527076A627AE45D7242D7ECF8948629844ABA2CC0C467CDCC191FFC6178DAB5BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501097, "uuid": "c83dea0b-4b93-4116-b9cb-165838d9c858", "value": "192:Fv5SW8P6E9b2x6/52ALiC30oFi1uTJRYT/CRN32jhBgsQUc/cXUL4Mi2REhceyrx:Fv+Pw8hFShUtadO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501097, "uuid": "ac6a10f4-6e58-4a6e-b328-6290d7af248c", "value": 11071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501097, "uuid": "1c81cd12-1a3f-4450-b3ca-369a980b822e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501097, "uuid": "cce17dcc-2d72-4f74-a5f2-7e2942045bef", "value": "raw.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e48bcb-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517731, "uuid": "bc7bbefe-9b9f-44a6-8f9d-a32187d43702", "comment": "Malware payload", "value": "40e04622e9a5b592d5c7d1e177feecdd", "object_relation": "md5", "Tag": [ { "name": "185-149-146-172", "colour": "#D74BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517731, "uuid": "84a34749-8b44-4cac-8eed-2416b1c7c38c", "comment": "Malware payload", "value": "44a4deecaa4cac2be17a66d85ca8d5fd321f9c9dfe35c6e86154bb6ff820c8ce", "object_relation": "sha256", "Tag": [ { "name": "185-149-146-172", "colour": "#D74BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517731, "uuid": "2739fec4-720c-4b42-ba71-199b3f2b8480", "comment": "Malware payload", "value": "2e5251ab2c57bbbb87b26060bf0072f4db7471fe", "object_relation": "sha1", "Tag": [ { "name": "185-149-146-172", "colour": "#D74BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517731, "uuid": "1aed5f09-417b-4973-bb11-0a7ded366d3f", "comment": "Malware payload", "value": "a58acef5e4253732a1d1cf49a21b0939e47318f478bde16fe90e0d80a3d73b43b1f0a6e63aeeed2dd588cb16cc234c9d", "object_relation": "sha3-384", "Tag": [ { "name": "185-149-146-172", "colour": "#D74BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517731, "uuid": "d5b84a59-5e50-4974-bd9c-8a0e86062390", "value": "T1BC67332BF13594BED5FA467748725608E5377660A8069D1F03EC304ACFB32E11F6AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517731, "uuid": "10cde3ce-4136-486e-a4b1-715d96bbd096", "value": "6bd223c0e65ea472a2d69bf1d6f62828", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517731, "uuid": "6c8f3b7c-9de1-43da-b3b6-6128e3f9e5d7", "value": "393216:J488Y4Ov0k/7BiStwaWDQkg1iY6OURSf2uRsOZwr+xLKMCVQ8yru1OW9OHFHJK:J488Q0K7xtg/xYl1BOrRM38yK1OW9kJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517731, "uuid": "8b8faecd-e43f-4fd1-998c-b923bf9b756e", "value": 32315036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517731, "uuid": "4bc390fc-c82c-4dfc-879d-b056575c67f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517731, "uuid": "0943d3c8-e437-4987-b142-88dec6461756", "value": "Setup_Official_v.1.3.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ba5ae6-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503691, "uuid": "472da4e9-de33-41db-a48a-9b7e23113d7d", "comment": "Malware payload (Gafgyt)", "value": "3fe769f959121d8ba8a17784f8224540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503691, "uuid": "b6cf9512-4161-49a3-8627-d7f06159c6fd", "comment": "Malware payload (Gafgyt)", "value": "44b6c2f33c60fae6ca913fc9b05c3584f2b8438677b035b1c70cfbfbf9495bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503691, "uuid": "b2e4a664-a281-40ba-a559-96e6178615da", "comment": "Malware payload (Gafgyt)", "value": "787d79e5b3ff627fdafa9d6bd9a297d3a11c7107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503691, "uuid": "ec088ed8-a985-4ae4-8150-7bebeb46a5e1", "comment": "Malware payload (Gafgyt)", "value": "59cadac2529c852a168dd755a5cf78d3215fd72234e00ba9b1d4961f40f64f059096c3e6537274703db3aa3dea6d1a95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503691, "uuid": "69e35397-6c8f-4998-a10a-9311953efc68", "value": "T1268308A2B950970AC9C3063BB70E828977E703DDD6EF3203971FDF2926865971D7A900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503691, "uuid": "1b406234-2e7c-45e7-a5a9-098292beeaab", "value": "1536:pl7nAGk8IxPyfooAKwsZ+hmxP70VXXgHO9fVT3vRk:L4ZyxAK7xPgNLvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503691, "uuid": "bc2ff4e5-b7f2-4181-b59c-65133d0c501f", "value": 87604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503691, "uuid": "b295c9e9-beb3-43d0-a0a3-421078c2fc52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503691, "uuid": "9480ae15-f77f-41eb-a590-f1ea869e420c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea958cd-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505132, "uuid": "84c3e39d-93ee-4cc4-a7a7-a11ad277d6c4", "comment": "Malware payload", "value": "b2ee7888af294dd2ac62566003f73cd0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505132, "uuid": "f0fc258f-438a-474a-bda2-4d2edee4f549", "comment": "Malware payload", "value": "44dc040ef6043839d7407dd3f0b4cee9232cf0adba4a0ad2b043f5e89fb1f93e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505132, "uuid": "536f2996-ea61-44b9-9567-4066b283b03d", "comment": "Malware payload", "value": "eff98ddee5373dea8c8d4c3b517e00321e25c851", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505132, "uuid": "96e788d9-2437-4a31-a863-e2332b6148d1", "comment": "Malware payload", "value": "6d9acad29d6b930efd6d83a95404b854d92dc43c7eaf4a946896a91423a27a5e584290d3203fdfff008df53f038f09bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505132, "uuid": "60abb217-efad-489c-86e5-b5f8aed38729", "value": "T12EE0271ED402C0FF701589B9FEFD79D4760F219A034F0318557D41575CE0C58A055136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505132, "uuid": "70aa7351-1c3f-4806-8c97-3de27073bed5", "value": "6:/VJqaN4f/lsGVYOk3F5kJVKE6LsVKE6NiVVNDV2uVf6v9yR5:/VJnwtNp3g5sguTh4yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505132, "uuid": "72da0e0f-40ce-4503-a6d7-cde63e571432", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505132, "uuid": "a99d90f3-09d7-4570-a9f1-44b8e997fde6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505132, "uuid": "fbd7906e-f23d-45b5-b980-9f7417c66166", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fb3a07-604d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752454467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454467, "uuid": "1b8c781b-45b2-4945-9a9d-a72ceb122bea", "comment": "Malware payload (Formbook)", "value": "a850c71dd695d98b1e6386b3057a713e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454467, "uuid": "a9c65ef1-b420-4400-8bbe-5c1777223a2c", "comment": "Malware payload (Formbook)", "value": "45df70e99e2b34e92f877ccc75efcce8e4edab48b7c796ef6ffbfb0a90bad217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454467, "uuid": "175488ef-8d31-46c9-8527-f5f6361e7b2e", "comment": "Malware payload (Formbook)", "value": "cb8a98fb93807606e7f7c09b85b319950af5f165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454467, "uuid": "da9af5bf-1bdd-4797-b066-366417dc443e", "comment": "Malware payload (Formbook)", "value": "b150ad60afb5a0ecdbc6d62787c158eff687cd70490fded21b472bb5b60f71de7e6154bada19c709c6c1ba97b7257cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454467, "uuid": "2f47235a-4f9d-4981-a1e8-9bb6eec976ea", "value": "T10045CF2373EE8361C3B25173BA557702BEBF782506B5F86B2FD8093DA920121525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454467, "uuid": "c24bc73d-dd71-426e-b75c-caa6f084a9d0", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454467, "uuid": "e92697e5-4218-4395-a670-14c16ccf7dbe", "value": "24576:Qtb20pkaCqT5TBWgNQ7adZzTKBold8mszqvuX6A:ZVg5tQ7ad1uBIa35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752454467, "uuid": "526997b2-78b6-4692-bdc8-9d7021abfd81", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752454467, "uuid": "7f97b888-70fb-4c25-834d-03e62114f91b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454467, "uuid": "de1acded-fa8f-4569-8d05-962efdd1e7b3", "value": "INQUIRY#4061425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97eb53ad-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536716, "uuid": "90036eb1-f09e-493e-93b3-695261c1a70e", "comment": "Malware payload (Mirai)", "value": "67c554c82893abede9ca7e5f96761750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536716, "uuid": "13326226-6ee6-443d-9334-598d8867dedc", "comment": "Malware payload (Mirai)", "value": "468f51c0893f05d2e3ad09a5be5a3c7cf9a428caf5bfc59f8473c9594b6dcde7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536716, "uuid": "cd896372-0f80-4dfb-808a-e8e33705efa4", "comment": "Malware payload (Mirai)", "value": "4c6a394f8e1262f71e34f7492bbc45e4bcad214d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536716, "uuid": "618737dc-9675-46b7-bc90-ff5fe7e6790a", "comment": "Malware payload (Mirai)", "value": "0e6246efb5de26eab47d81d53f95b628556a888fe8802713559b9c9f9ed1aa8fe9f432e81f34e64b3bc154ce6c95f3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536716, "uuid": "cc16e234-2298-485b-915e-cf04b6ed6460", "value": "T166A32996F5419B15D6C20973FA0F624A771307ECE3EE32129E248B60BB8785B0F3AD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536716, "uuid": "faadcc8c-e9b1-42de-a7b4-df3e49e3ee0e", "value": "1536:g4nPDdQ4sEHS1yQ398vSMQaeap/7h+fMEisHdTK3t5pxnsYgWX:DDu4rHej98PQaeapcHdTK9Fs2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536716, "uuid": "a725bc73-d549-4d12-8e4f-75fdd45e3c57", "value": 99748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536716, "uuid": "fe0d3bf6-7b09-4b84-a251-997ff2764a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536716, "uuid": "5173a34f-9015-4ac5-8cb1-84374bc8af16", "value": "dbus-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1977aef6-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505151, "uuid": "14e3228c-46c2-4d95-bd90-55c917fa68b5", "comment": "Malware payload (Mirai)", "value": "b40a3099a2699ca0e31a2e6b60b4a2f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505151, "uuid": "265c6fdb-b2ae-4fc3-b563-adeea3cbabf5", "comment": "Malware payload (Mirai)", "value": "46ac6e461c759ddb309ea19a8f08d1109f834c72fa08a527cfb44aa1c1af3ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505151, "uuid": "827de954-a1c4-4f45-b323-b4249b713ef3", "comment": "Malware payload (Mirai)", "value": "a6ad9fbfc4db22fe9bb9eb7b87354a81d1db7bd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505151, "uuid": "fc5ba4e4-7397-4ed3-816a-c14636451605", "comment": "Malware payload (Mirai)", "value": "10b164e965f0dc9fdb473ca17a6288b0ffd761046fbc15a8371268ba170aac0ffd39450d7050deba955aea7b0fb7b2c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505151, "uuid": "4553d858-cbce-4747-89f4-fd2e31478b54", "value": "T1EFA31989B8806B15C6D526BBFE5F018933135BACE2EE72118D241B6477CBD5B0F37A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505151, "uuid": "35242b74-e69e-4e26-a034-360b59d4c1fb", "value": "3072:IsDpx81eAy421MlvA496f3iafxJWJn3r9c3JAgH0nZ:bDpuI31m4xPiaZJWJn3re3vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505151, "uuid": "e77c210f-26cb-4ff6-bf30-15b30375de6c", "value": 99876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505151, "uuid": "f18dc495-dec0-427b-8c27-0c126b92a084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505151, "uuid": "22435ee8-2297-4854-9893-95579cfbfc63", "value": "harm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc36274-60ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1752501510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501510, "uuid": "95a58c87-7697-4eeb-b012-7538cbb78365", "comment": "Malware payload (ACRStealer)", "value": "aa0a4ef401c5bd31652f2c09e4284a73", "object_relation": "md5", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501510, "uuid": "52cb9816-8d84-4a99-a7b4-215b0b242afb", "comment": "Malware payload (ACRStealer)", "value": "471e54d930eaad1a0d2407eb5074442e2ea981cec474630602414568870bb43c", "object_relation": "sha256", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501510, "uuid": "6f9650b5-bf5d-4ce4-8975-00ff513c80e5", "comment": "Malware payload (ACRStealer)", "value": "7e1462b3120164730f55630bf3728e11d57b9250", "object_relation": "sha1", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501510, "uuid": "4c9ba6a0-d1c9-4860-808a-3d3e4013cf0a", "comment": "Malware payload (ACRStealer)", "value": "a280774cd0908ddc09681c033ba7b195229779a219cbf104f92b26bec24a494e5204cb0739a3292059402ffaed70f16b", "object_relation": "sha3-384", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501510, "uuid": "cf514c60-320e-44db-b409-2c3b7cc721f7", "value": "T15ED633889F119DCF3F6EA31C0E74D909ED52E40A6E445A1BBEB108792DCE7CD72AE045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501510, "uuid": "2c661185-0dce-4dd0-a825-621f88b61b7f", "value": "393216:1g3aeXUZg1tqNzSKV+GcQ99QUg5N6zB/jQPRuZn:Gaeke1tqdS8+2MNIepAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501510, "uuid": "35c4db9c-81fb-4771-a4a1-8af102d70342", "value": 13201951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501510, "uuid": "ce1ba9cf-082f-459e-a626-4f07cdf612ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501510, "uuid": "0df9983a-8151-4606-8eac-05dda7fd143c", "value": "#0\ud835\udcf9\ud835\udceeN--F!le.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e622e9e-607a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752473806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473806, "uuid": "eaa5b2d9-229d-4b91-8408-e6eb2d529650", "comment": "Malware payload (Formbook)", "value": "d0c7f4a737d8cf834412e08590bb15a3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473806, "uuid": "ac725fa8-c38c-4736-95c9-7079b2f99738", "comment": "Malware payload (Formbook)", "value": "472a97994d77ae3f38335e9f6e5b71c8324f6ac0962b6cbb2313bb09cd607d84", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473806, "uuid": "1ac8dd51-e76c-4294-8116-b72282ca17ca", "comment": "Malware payload (Formbook)", "value": "d172c9134ee2eacbb07ee0984ea1789fe18c0836", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473806, "uuid": "7a5a097a-70ec-469f-9b24-abbd1bbe3b8f", "comment": "Malware payload (Formbook)", "value": "a3dc72c410b6a7bf9099e82b68094b0c7f8c8440e3d0f543b474ec8d22b2f2ab86d0d3047ae1f226c9b639592f673ff9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473806, "uuid": "5a66da47-efa6-40d6-82e3-e12d4c24e25a", "value": "T1FEF4339D34C029C59990C98148942AAF7A59846FFFCF580B77C32234DEBB43BA6541BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473806, "uuid": "04387577-bc41-4cce-9057-6c1e94e51f5b", "value": "12288:mqR0500ETDTaFDPcjNgd5i+sB37cNS2OvsRHR6RKHa6qH4hTC9fAC+hILN70NBfA:bu3MXoDPc5gmt97c8sRHR6AHwCOfA5u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473806, "uuid": "0376fe0c-70ee-4e80-8513-d296121d4aa9", "value": 749930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473806, "uuid": "c94def6d-13e1-467b-9b95-9272ed87a20b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473806, "uuid": "b293da7a-5aae-4698-83ad-d62c2c05b3ad", "value": "DOCUMENT OP441608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c4bfbb-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752473516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473516, "uuid": "da1184cd-3b02-433f-8d52-fc2e8280f96a", "comment": "Malware payload (LummaStealer)", "value": "60f37e2c05fcfd4651593e3467dc585a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473516, "uuid": "5778c478-8d96-4f2a-8095-76b283ae6b72", "comment": "Malware payload (LummaStealer)", "value": "473c34411392285dc7b7fad591eadc8e6c64d577da8647ce94d4a9b138bce2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473516, "uuid": "9888f761-a6e5-40f0-9784-1036d3ee36f1", "comment": "Malware payload (LummaStealer)", "value": "4e71ab597d92ef7fefdb77861806742c028c7ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473516, "uuid": "102bd3ae-26bb-4d36-9afc-9d923ddae0a8", "comment": "Malware payload (LummaStealer)", "value": "3fa65d0bc44890157dd524ad04514cb346f680c2006b0ef2cb5dd99430db97b22d52343edaf2e0b846861db54bba12a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473516, "uuid": "3e0a81c4-ad42-41ed-9ef6-6545596c0d06", "value": "T15D8533FF24326C41DCE142F1C06E810A7E9C55BB35797A07FA75AE0EC35B2252B662C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473516, "uuid": "278275c4-8051-4181-a543-43b73b05c5b8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473516, "uuid": "3ff001ec-e18c-4673-ba3f-84548a20f025", "value": "49152:nH+jXRigew40TSRrhcq+gSSwRJmJ+Elgf2w9cEXDNE2GlhA:nH+XRis0rhcfgSVe8Eyf2w9VNpiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473516, "uuid": "c7870393-c734-4ec4-8f7a-70845808e72d", "value": 1791488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473516, "uuid": "4943577b-97f8-4850-b957-b73caea2f163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473516, "uuid": "234ad1ef-bbf2-4df3-9358-c6a7c0c0bb17", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60960777-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504411, "uuid": "ac9d13a8-39b2-4316-a02e-4cacea23af82", "comment": "Malware payload (Mirai)", "value": "bc46a99e3beb0b17810372adfb4204b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504411, "uuid": "06af9e1b-e06d-4dcc-afd0-5877db856083", "comment": "Malware payload (Mirai)", "value": "4825a4b2532117cf3e0eac787945eb4fd40137c263589a8e7d8ae8ab00cfd28d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504411, "uuid": "e2f1496f-baca-401f-a651-ccbb74365c8f", "comment": "Malware payload (Mirai)", "value": "f98c59695903b12135538d1b3491d63520fd717f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504411, "uuid": "6f69de76-fd33-401d-8b24-91bd20a84f60", "comment": "Malware payload (Mirai)", "value": "daeacccd88e01bbfce040c0b9b179fedac443b2e2228091f2ef3c735b59bed46e73a34a31ad0f572b852ca2a657c0e59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504411, "uuid": "87b66847-5474-412e-b75f-831d6f32cd79", "value": "T126F319D7F900DEBAF81EE3374853080AB130BBA114925E737257353BED7A195096BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504411, "uuid": "18067cf8-7704-49ef-b666-5d08dbd60e6d", "value": "3072:77aeXkf90IsFuCZ8h94cyYGajtmytGXyZxfdU+UVVjbiSLx/LT/4UAB08CPR:PaeXK7scCy1yYXjtmwGa1U+4LxAUU0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504411, "uuid": "cdd5c160-3b4d-4781-b0ad-4309ba92580d", "value": 168844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504411, "uuid": "ddc7b9a2-0cde-4c1d-a249-751dfedaf788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504411, "uuid": "e6fb006f-431a-44b4-8591-fddeff60e70f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c32fea3-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528482, "uuid": "d9eecae7-54a7-4c49-b512-4599d9049bb6", "comment": "Malware payload (Mirai)", "value": "04c828862c950ebf6412af70bfeaf027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528482, "uuid": "f882dd7c-ca69-4859-aebc-7ebba13d623a", "comment": "Malware payload (Mirai)", "value": "482a9caea96cf79ec2eaec9b504c57617fa8d2e03095804c31027c19509dd88d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528482, "uuid": "ec026165-fc66-473a-b254-2e40567a6eca", "comment": "Malware payload (Mirai)", "value": "6a08b2f93cedfdd59fe95d5d33d284193431fb7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528482, "uuid": "058c50a5-e9c5-4ded-bddf-f204dba50aa9", "comment": "Malware payload (Mirai)", "value": "8b722da92c18ae836e561702c9777a5425f63c8a4cc4fee5c55ade7d65ad6b56ccf7d8de82a5865f3cb658763d00366b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528482, "uuid": "600874da-065a-45a0-8de7-d6e90836da82", "value": "T18092C070412B7CB1C7616432963F8602892507FEC5F5317F332455A8DB8568F1EB55CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528482, "uuid": "7e31018d-b9a7-4e56-8470-e5c8c03dd4d4", "value": "384:kn3CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8gPiURhymdGUop5htF:KCyEPgoKRwZGx04nIns0t2FRs3UozLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528482, "uuid": "3b9a633b-d225-4e21-9115-b72117c308b8", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528482, "uuid": "5b03f365-4e5a-4012-a335-6f47ba9a7143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528482, "uuid": "72b027f4-75e7-4193-89b9-b6a43c9f3405", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1e6b39-610e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752537507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537507, "uuid": "d96d1a26-9ba4-4d5f-9ce3-379c902ff914", "comment": "Malware payload (Mirai)", "value": "d42aaa9ae6979438cf5e7214c0e9e1d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537507, "uuid": "847d3827-3f4d-460c-bbf1-0d7df2c89657", "comment": "Malware payload (Mirai)", "value": "4895456f866444b3b9236221486d688b828d8b2b6e7eece2cfda3ef48eec44ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537507, "uuid": "e25f889d-4bea-4d17-ad9b-d4f6c92b94a7", "comment": "Malware payload (Mirai)", "value": "44ffad32d63d96ffc8e33f67a80f6c43c002c12c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537507, "uuid": "d81565a6-3120-4435-9604-29fefae3279d", "comment": "Malware payload (Mirai)", "value": "f61b92e1d3d2e716e0452e6ce8c444e9d4bf282420f3250e3a32f614d668a2f2210ab68ae093e25a4124a23fb1ec71a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537507, "uuid": "189a4cea-d777-4e1a-a356-eca81e907ddb", "value": "T140A33B85B881AB25C6C156BBFE5F018D33034BACE2DE73129D245F64778B85B0E37A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537507, "uuid": "b208958a-be70-4224-8758-9407576f913f", "value": "3072:a357JqBbv0G21MEy7P0AS7yalcAyR0ycPYRh6nQ:u57wB7yj2TS2aHMcPop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537507, "uuid": "db0067d4-78d6-48b7-8108-f2379b3dd204", "value": 99712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537507, "uuid": "4c1dd245-3830-4c32-8c6f-ef00d48a929a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537507, "uuid": "5a4b7f34-1fa0-4fc5-932a-bf5105a39fec", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7998d9-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481082, "uuid": "842e5b81-a675-4602-9aeb-249e8510898f", "comment": "Malware payload (Gafgyt)", "value": "72eb39b67fa755dc150b7dbc87c8c7a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481082, "uuid": "bde1b617-2902-40d1-a802-b7168a1c65d6", "comment": "Malware payload (Gafgyt)", "value": "4918ef40a19c1bd1826dedb3aa9f0da6fe33928f818aa184fb493b72be33a325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481082, "uuid": "9baad83e-75d5-43a4-a78e-582c24fcf7af", "comment": "Malware payload (Gafgyt)", "value": "680b798a6d89e04913604c75908b5948f2e3cdcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481082, "uuid": "efa3723c-9c22-4e7f-8d68-2a84cf4df60c", "comment": "Malware payload (Gafgyt)", "value": "5141cb5b61695181e84490625d23637c41c03f834b0b1ead0f8415e164743ff3e6e54cdc86f7a8e27eacce9bc5785361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481082, "uuid": "e3ea656a-e3bc-4191-8b76-4783d04ada52", "value": "T12F831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481082, "uuid": "1bc1151c-5d33-4d64-8a80-53373a61397e", "value": "1536:BQOc40ozMPjej5qckA39ikRFaznrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3B6rWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481082, "uuid": "1827b198-d36d-4997-9d45-1c3234434d54", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481082, "uuid": "14009b91-b2f4-4819-b8ac-1e4b3afb7ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481082, "uuid": "c31ec38b-06a6-48db-89e1-26693c284954", "value": "a-r.m-7.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599ed90e-605f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1752462309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752462309, "uuid": "c7d3e9fd-d526-4bfd-afb9-c3f74085a43b", "comment": "Malware payload (RedLineStealer)", "value": "8117ea1f78fd36cf01a19ba540c7679e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752462309, "uuid": "995e4e4b-ddab-4200-877a-6fdcc1782200", "comment": "Malware payload (RedLineStealer)", "value": "4958ee660fc911d0eaed8783453a081032f5793f5f159743117c8e22b01b6f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752462309, "uuid": "02f937c2-81a4-4806-92bf-1648c524b29f", "comment": "Malware payload (RedLineStealer)", "value": "d74c24ef737011fb7b9ee410caa32b81a5235d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752462309, "uuid": "2e2164a2-522e-48a4-828f-bc2d83fa3ed8", "comment": "Malware payload (RedLineStealer)", "value": "7144b9aa122c54c40fccbc10687a26fe0c6540027be61dc588cf023edf491c1d2c8341c02ebf01dd30f0631834107d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752462309, "uuid": "680ee860-015d-4b0f-be3a-efaf45219ee3", "value": "T1F8F4E0403E828056C3057A34930DEDA7DA3990F947CDA94E169A47FA6FD6B30FF527A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752462309, "uuid": "0252e674-cdb2-4db8-94a4-e69a31fd370b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752462309, "uuid": "b972293b-3388-4245-9326-15b5e2ff0aff", "value": "12288:gZjvxnsTfiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:gUrBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752462309, "uuid": "0a678167-6474-44f2-8447-22db4b39c458", "value": 756032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752462309, "uuid": "bf2aee17-6266-425a-8358-89b0ed619993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752462309, "uuid": "b0aa28a8-9b7d-4b8d-8d12-64de9f053165", "value": "8117ea1f78fd36cf01a19ba540c7679e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cefd175-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516082, "uuid": "980dd088-1b4f-472f-b21d-e54e640c584d", "comment": "Malware payload", "value": "acf3b7f2f07f5d04083f99b82eb0c8ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516082, "uuid": "769d0710-fd60-4be3-91ff-654e882f3831", "comment": "Malware payload", "value": "49f89b2fdef345a9d92fc821e4a226d8ac99e4ca0d2d11b5654f6557800b85f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516082, "uuid": "25c92004-c246-492a-90e7-ddc8c2d0192a", "comment": "Malware payload", "value": "f0560d544a8b310b6b6446be10f8d10a1f706171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516082, "uuid": "c5b9d861-1a7e-4b09-a64f-e9bf9cf7118a", "comment": "Malware payload", "value": "54ab0b66fe0cf4b6b545c499a21cbd1511fd2300fc0cbf17658f9bc50449857941f2bf99713fbff3cf88652055b03e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516082, "uuid": "8376aa6c-899f-46ca-a8da-7507f1135a7f", "value": "T13406097364870C95C9C32BB890CB72307F74BE77861A6A5A6E14C326FAA35D05D1EB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516082, "uuid": "a1db40be-afc0-4718-a182-03552cfc20d8", "value": "46dc4db5ebb9de9e294a265329504d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516082, "uuid": "7210431b-ca50-499a-9a6d-1211184ee7fa", "value": "49152:T7RB7+NcgMUXJ3UfqbKpdaKdl1Rl/65hT3Tmho:/mZXJyV65hT3Tmho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516082, "uuid": "08e57da2-44c4-4672-8c0b-b5b6350eba3c", "value": 3867643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516082, "uuid": "685c40b5-3503-47da-8dec-c1d1f726015f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516082, "uuid": "3fa6b741-6a67-401a-8b16-d3d9e685d435", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfd5706-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752477858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477858, "uuid": "52594655-62c9-4ac5-9445-ec5a26c90eeb", "comment": "Malware payload (AgentTesla)", "value": "f924c6667d84fed652fce8f8fd81d431", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477858, "uuid": "c067575d-7fcb-4c25-aa3e-27008603792e", "comment": "Malware payload (AgentTesla)", "value": "4a3b905690067a7e06cf16aa3ca07213e627fc4d6f5f30885c44d3d6f8b28f32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477858, "uuid": "1010e323-2ffd-4088-af3c-a5742261b8ec", "comment": "Malware payload (AgentTesla)", "value": "ca8f6c128c7402e5623133e17482d2bb8a9d5671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477858, "uuid": "7b54b63a-5a2a-4a35-bf61-cec3d7aad35a", "comment": "Malware payload (AgentTesla)", "value": "e189a427f90f5e7075998629a3063adda8074f24badbd546f68f4d6db7e7f4065450d0614a810029a3bb497babe487c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477858, "uuid": "667889a8-2e5b-4424-958d-2cae0ed8a409", "value": "T13FE402147699EB12DAB55BF11370E23513F46F9EA021D35A8EDABCFB3961F022890353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477858, "uuid": "4aa543f5-202c-4c20-aad6-9aeae19e08be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477858, "uuid": "589a587a-73b2-4d23-a549-14f0e0428e05", "value": "12288:iWEt4HB73xh0G69P3IYgz8wn5VGquwiMNcHg6OZi3XEhAFtK:iWEGh7f45Az8wn5ItMaHg72XeCtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477858, "uuid": "4781c53d-5deb-439b-bfaa-4d65b1dd915d", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477858, "uuid": "3199b33c-3a96-43a8-a478-bfcdd466959f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477858, "uuid": "64b15fef-d424-4090-9121-8a61a2dcdad6", "value": "Purchase Order-3443567787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e25dd9-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503673, "uuid": "cc59360f-150e-49e8-9f11-e9a7aacf8987", "comment": "Malware payload (Gafgyt)", "value": "d55e9beb49a3b905522359e9db5c36eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503673, "uuid": "72d22d14-ea99-46e0-9dad-dc2d3474113b", "comment": "Malware payload (Gafgyt)", "value": "4a4e5fa1bda0baa604459b7e1df8b3f69b66898de1bf26fab76e60ab51cefad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503673, "uuid": "19715df1-095d-4a47-b49c-8c3349720ac0", "comment": "Malware payload (Gafgyt)", "value": "3886fe7c047bc09e2f59972597f7285feadf59c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503673, "uuid": "92d8f3da-6673-4926-917f-6f425b83597b", "comment": "Malware payload (Gafgyt)", "value": "694fb6ac9c023e6c49dee9d3142dc0cd329112d401fd8dad116bfe6d0bbc84cf0b28ea75a858cd91ff42fa01f58e7e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503673, "uuid": "166ec954-641c-46d1-878f-099568d15cb7", "value": "T1B2831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503673, "uuid": "1d1830ed-f2de-49f7-9d22-52be4e9c8018", "value": "1536:BQOc40ozMPjej5qckA39ikRFainrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3B7rWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503673, "uuid": "1e777d22-6295-4cb0-b321-04fa96f220f1", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503673, "uuid": "04552f14-60e9-4ef2-8819-1f9763b14a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503673, "uuid": "84ddb8b7-8947-4975-8231-72b77fd5f576", "value": "a-r.m-7.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1429ce84-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752495693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495693, "uuid": "a7f548b7-276a-40e1-bdc3-439fb45924ba", "comment": "Malware payload (Mirai)", "value": "34806033a05ea4b3f32f54317b6f76bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495693, "uuid": "698ff5cb-c777-4f02-a22c-49129b256dea", "comment": "Malware payload (Mirai)", "value": "4aa38ca536d1951334b14cb44966c1b5ede193404ce37051f5915ba7c9d966c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495693, "uuid": "392fb6bb-0e74-4c61-96fb-a48f1ed500df", "comment": "Malware payload (Mirai)", "value": "eea8d82b441df87ca37d8f6923161f41af71bfd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495693, "uuid": "35dc1ce5-6aad-4970-8044-82a6b87ff1be", "comment": "Malware payload (Mirai)", "value": "708a0252be7066824b411930176c2b31a39db8b39af712aad562db9ff474bcaaa9a657c34182049c0ce99cc36131637d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495693, "uuid": "4f95bd2c-4624-4ce3-a507-4689ddd03b9b", "value": "T18CE2E0B0E1060E96FAF1BC775A83D3D46B804F4A3781AECEB001E55547A2E29F395DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495693, "uuid": "37a8be8e-e12e-4cc2-b656-9a856691a665", "value": "768:QG+PHyUNDn6xWvzwmJESSYq0BQamxjELHYJWhL88KQZf4uVcqgw09/:QG+SUNDnCWvzZJSqJKELyWZDKmf4u+qK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495693, "uuid": "a26381f8-336a-430e-b7a0-887bc867ee5a", "value": 33728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495693, "uuid": "5ff53f8c-2427-4de7-b112-0312bb2ed3fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495693, "uuid": "a0b88505-1be2-4e13-ab70-6370f1bc547f", "value": "top1miku.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31156baf-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513351, "uuid": "195cc2bb-02a5-4902-832a-c9d0251654f6", "comment": "Malware payload (Mirai)", "value": "7cb997358f7650760360322c25b5d551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513351, "uuid": "88867db4-9436-478b-aff1-ef68688db8c2", "comment": "Malware payload (Mirai)", "value": "4ad9938d9a5f57b31d0e91e9c03140062e8e0202cf1a757bbd7190d1cc574607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513351, "uuid": "553a05de-bc08-4a5f-8424-6f2e9e75c9bc", "comment": "Malware payload (Mirai)", "value": "a879699edec653867547f574a70f91966f75a962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513351, "uuid": "eef059fd-4f81-4c91-b76f-bf46bbcda786", "comment": "Malware payload (Mirai)", "value": "6ea4d307b476d68fd968819821f747bdd3d40eddcfe86df619f995644e985cc4115941c1754b646ece6b50956dec7e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513351, "uuid": "680c92e7-f16e-4982-8129-5285ca704a97", "value": "T10663BE23C82A2CA4E94946F070A1DF754363AA1282871EFB95AAC775D043FDCF6593F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513351, "uuid": "a9607b39-97c7-48ec-b0c8-e5a64f59bbb9", "value": "768:QqUGWQ4yjfNBfxGoj4p/oAeL3BCEhlTvK7x3wPhYjaPo9RgV5CwgyFK0wdtfpMDB:QcLdGoj41IpDK7x3Gg9u5CwCTwxpfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513351, "uuid": "ac09a099-f2b3-455b-a4a7-bb629c90c890", "value": 71844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513351, "uuid": "2dc8711d-8455-4ffe-adb3-7d085868a281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513351, "uuid": "cf32d69c-9f5c-4d58-a784-fade2cfe2664", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320f117c-6078-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752472980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472980, "uuid": "f44806a9-e8ea-4cfe-99bf-26ac44fc6e85", "comment": "Malware payload (Mirai)", "value": "6cbef6b35834dc0b230c029287be177b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472980, "uuid": "35c21d01-86ee-4ef9-bcaf-8eebd8272d2f", "comment": "Malware payload (Mirai)", "value": "4b936262d50c8fc7034aea06f4db85308ff94acb8e7895896f27691668de5eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472980, "uuid": "ecd978ce-355c-4d47-9467-e1f22d7daed9", "comment": "Malware payload (Mirai)", "value": "44dcc19cd06b9be45ba5d5d9fe5b992a22ee15bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472980, "uuid": "572ed9f8-59b6-44ed-85da-f6dfa2d6ee1c", "comment": "Malware payload (Mirai)", "value": "213b851973f472734f2ed270103de80e8a687219d308cf290f7a452ef7214dc99dde5f496f9dfdf2a06cc73c50a46dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472980, "uuid": "c24802db-2970-4e08-9263-7cdcfbc604b0", "value": "T144E34A1775D080FDC4DBC1788BAAB53BD932B16D1234B22B2BD4AE261F4DE211E6D724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472980, "uuid": "67f8f3ad-16c5-4d2b-afce-c5978e07e823", "value": "1536:JGBxHJyKAPGJlr1RP2FEoQRG2i4pMMUvv/bqmHWYAOvO+cb73V:AnH3iG/7aAi4pCvv/bqmvAOvWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472980, "uuid": "4a6f0e74-38fd-4c48-a93c-9f8de8a5b2af", "value": 143480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472980, "uuid": "613889bf-ee89-4f67-8b88-89242fb3c8f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472980, "uuid": "09b7018e-ad14-49b2-b18e-d6d3dbc9c0ef", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a73906-609f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Athena)", "timestamp": 1752489924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489924, "uuid": "68175ee0-8a19-4ab2-85d9-6ba848443290", "comment": "Malware payload (Athena)", "value": "b562d62b508a10550a7f9d28753ea368", "object_relation": "md5", "Tag": [ { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489924, "uuid": "ccb8e457-1199-4da2-83d3-1deb40fa9f6b", "comment": "Malware payload (Athena)", "value": "4bad7705e8883dc6eaf2fd2d23375e2c2482638778f311106486feb1b60661b4", "object_relation": "sha256", "Tag": [ { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489924, "uuid": "109e8eed-8d57-4d6c-a3bc-3faf172c4cb9", "comment": "Malware payload (Athena)", "value": "8b3c11653bbec3145fc440f55e68d2ef18af4ba9", "object_relation": "sha1", "Tag": [ { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489924, "uuid": "4a1d52fa-d209-47a3-96f0-00f90ffe4666", "comment": "Malware payload (Athena)", "value": "b6319be7d9247bf3f47a6fc9dc7d1dea08d4082ff69f907ee2ccad2566afd02f161efc5b592fbe061548aa057f2fb1da", "object_relation": "sha3-384", "Tag": [ { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489924, "uuid": "47b22a03-c5e3-41fc-8899-07a8baf9fa42", "value": "T13CF53301BAC98471D4A20E765B76630399BEFE206B568ECFABE10D4DDD625C0CB31B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489924, "uuid": "198b941b-b6a9-4834-8251-11cbbf3dd1ba", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489924, "uuid": "e523b742-debb-4ac5-99d2-7fd64b2e378c", "value": "49152:7B6HdSF7TpcCMgiYwCVtycgjLE6luVNL3vNntE488uRzs9ZteLiX:FkwF7T3RHycsKL31ntE4e20GX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752489924, "uuid": "99071011-b89a-41a6-84ca-ece76f52ccae", "value": 3361460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752489924, "uuid": "2e8417fd-07ae-41c0-92d7-6ed2ab5ff0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489924, "uuid": "76b2c57f-7519-4b48-8db7-6add4a3e41ab", "value": "b562d62b508a10550a7f9d28753ea368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082c2d11-60d2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752511564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511564, "uuid": "bae7f21f-686a-4f18-b952-5e922bc2bb55", "comment": "Malware payload (Formbook)", "value": "94315115fcd6b154f650bf1a1405c5e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511564, "uuid": "3feabce4-ccbd-4edc-bc0f-3528e0a821d1", "comment": "Malware payload (Formbook)", "value": "4c732e0d384f492723ed512743084b8d30e75dc836f9baec38435e7f7298a752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511564, "uuid": "79832463-2533-48d6-9aac-d05d130c0e6a", "comment": "Malware payload (Formbook)", "value": "2a14666caf71aac30f62748e91c78fc5c9f198b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511564, "uuid": "6c5364be-0615-4b90-8343-528ed879e98c", "comment": "Malware payload (Formbook)", "value": "42549ba3ba60a4a2ddd749cbf265ad14f528e657f3f09295661ef690c74cb8b29a029e3104a8f757413daa9e55cf423e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511564, "uuid": "a3b1dd90-40c8-463f-be23-5aaea4501e2d", "value": "T130F4F115B83ACE05C4620FB16721EEB0037FAD5DB821E3279EE6BDDB767634255C0A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511564, "uuid": "12bc5177-ba6d-4b80-ba48-7a52ac03f44f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511564, "uuid": "b2aafaaf-fc60-4441-8e25-253c04589028", "value": "12288:i+s1/3plPNV0IrKdGcmnUR+wP7Gh+YyR4YRcPeobNdPBQaT9jljw6dC2IJ3Tn:uF5lPNV0LGXURfpYyR4Yq3pBQaj0HhTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752511564, "uuid": "a68539e6-c9dc-4d59-b995-747dbb95f48f", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752511564, "uuid": "a45b17d1-5262-446b-95c4-247d25847fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511564, "uuid": "345f953a-14c6-48ad-9ab9-d3e0c309e3da", "value": "Annual Leave Application list_doc.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e6c94b-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752477845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "eaaa2b8a-da6b-4c71-b8b4-a9e09f9af776", "comment": "Malware payload (DarkCloud)", "value": "4a1a3c71c1704b9a64b4171bf9369b5f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "ab009d53-467c-4810-b6db-d6abdead596f", "comment": "Malware payload (DarkCloud)", "value": "4ce2118ddf2f2a04da17bb3b02b467acc072139d5f8ff38c5d926595bef5e64c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "2d66b962-158b-4120-bc32-fb4f736064ae", "comment": "Malware payload (DarkCloud)", "value": "c8efb303d8392f571e301f2922dae10e4de404ab", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "95ff2f28-88eb-4ae6-8817-8f5dc377d216", "comment": "Malware payload (DarkCloud)", "value": "b8739c9f95255e21ae582d8e80300147a7c13607fb7df38dec15807f3032a483b82422dfffc3da6c3c311cbacc264fc3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "6032e393-0a36-493b-8533-8ea74a2a8580", "value": "T18C6423924C374039634FE9CB62463150B790B695F31B8F2F805D5B8768AE6E427D8ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "b88a1645-8391-4f55-b2e7-610d46ba2c56", "value": "6144:rr+vmjUj3zoxxr8giPZPDhELAgx+3OO6E5AiSWtqXodpwyq5WwX4ffEnSa6:kob+VC+3XF5AiSnXWyh5P40nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477845, "uuid": "5846de52-5607-4b48-b565-c58e5d437b53", "value": 320233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477845, "uuid": "0369aa53-a09e-4b91-8e74-6d51f64e9be1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "b016e79e-55b8-4651-9d67-9e885a651f99", "value": "PAGO@@92899#00992.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c6a4de-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505149, "uuid": "eeacfa65-4588-4a86-a3d5-bfda62c9fd27", "comment": "Malware payload", "value": "6695e04dc93473f0155e2c67f568383d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505149, "uuid": "5fcc052c-787e-4d18-85ee-4e11aac3ae5a", "comment": "Malware payload", "value": "4d2d5d7d61800a54cb19a32ec82cad2b4070018d6b95f8b15ed09b82b060faf0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505149, "uuid": "aab41b88-877a-40fc-bfca-132c1c84cb68", "comment": "Malware payload", "value": "7ca6b6b200281a061705f0beff8f46567e65314a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505149, "uuid": "9e2a411a-0839-4bc8-a34f-f4961f55f422", "comment": "Malware payload", "value": "5a87919adecf4f7654c0356a7035f2deb3b204ba89602a09b358fc2e3d44a835dc327babf817d21f37bf39e961756ff9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505149, "uuid": "a108699a-4842-46e4-9dad-d2123383fcdd", "value": "T1CAF049EE641991620907EFC8E8779E84A8A2D2C01109CF0A7ADEC43F80A9E10F536B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505149, "uuid": "3a085de4-b677-410b-a93f-fef677b9010d", "value": "12:os6Ku7QoKB0LKfKYNIl5aEOKMiKKNKUCFvL:osXu7qYKCYNI7aErM/ZUCFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505149, "uuid": "3a50ae61-4ef9-435a-913a-4acad4bfdcc8", "value": 562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505149, "uuid": "bd2a99d2-1ca8-4db7-84d0-e24870e98f50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505149, "uuid": "91882c4e-d5b0-493a-8748-4e1a87de0985", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b507b3-60da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515073, "uuid": "a4a53876-0a8f-4bcb-ac91-e278fe37f537", "comment": "Malware payload (Mirai)", "value": "32e9f4323074dbb2961443b7ac0f174b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515073, "uuid": "e48e4d17-f1f4-4ae8-b658-b5dfc4fee419", "comment": "Malware payload (Mirai)", "value": "4d7197229ad8528345f68dd42e3db75bdedccd0d6d32db3b24c9fd1a00e2f2de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515073, "uuid": "2b505f95-0070-44ad-a136-90dc3d094efa", "comment": "Malware payload (Mirai)", "value": "06c3f12a00b901d625d01575607b44c776199b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515073, "uuid": "1d460905-c84e-4600-a6c9-104b44bf79a7", "comment": "Malware payload (Mirai)", "value": "ff79f04d0ef01c0d7453b13d6ecf6b89ecef7fac0c7a4c519dff4b09db6dfb8fb04aaf1b9a73c726e6eb1ae590ae548a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515073, "uuid": "c39526eb-eb4c-4002-a5ea-e6f50cb9a4bc", "value": "T1E804D90AAF910FFBDCABDD3342E90B0139CC955722A53B763674D524F94A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515073, "uuid": "bdc04dd4-08b3-4d2c-89df-8f1775307fba", "value": "3072:ne+Bqtze14pBXDoqwf36H5a7ttQ56as++IAgngsAdBi:neHtzBpBXDLH5mi6F+Ug8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515073, "uuid": "935fec93-ce22-4757-951b-90062193047b", "value": 182092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515073, "uuid": "7ec29d0d-7554-4fa1-91d0-a43f7cfeb5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515073, "uuid": "b5aa454d-057a-4ef1-8cd3-3c368e065c24", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024f9a4d-60e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752518856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518856, "uuid": "80aacbba-2a53-4815-87b9-d01ff3542fdf", "comment": "Malware payload", "value": "5a711e0bfb340bdf7d76dad1e18ac113", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518856, "uuid": "0045eb9f-cb2c-4373-9979-4fe64b4133df", "comment": "Malware payload", "value": "4d8c3a7437abae74c57f795a6cd6082e79d99c19b3486be87b5bcd12880cb521", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518856, "uuid": "8f8ff864-6885-4c3c-b964-2a9441c42465", "comment": "Malware payload", "value": "59584defe1e0a46989449405c1dfd4c309205e78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518856, "uuid": "020da311-99a9-403a-a02e-9ad2d6b4fac3", "comment": "Malware payload", "value": "c184f34ddfb411b3a3bd609ec60ca9d5888c5e77570efa47d583e1ec57bdb06a5d6d43666287a3ac922bfe7322608449", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518856, "uuid": "5a34344b-7c2c-4ab5-bff0-b55e93ad577e", "value": "T1981833BFD2A0C710E15DBA31065B013DD275B9397D216CF0A892E8D9AED7EC70B3644A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518856, "uuid": "c3771f07-ead2-4237-bfd6-b12f0e77319b", "value": "1572864:JTUUUAlpV3kCrUU25lsEE1A7LL4He/adPqdExLJBzzwi3ZCXYqJ04YT4X:JTUUfZLrU3YWd/aFAEJzB3ZCXYk04Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518856, "uuid": "41011b41-0a16-45df-97ec-4c5e832db267", "value": 92636245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518856, "uuid": "9a7986ab-e781-451d-9c3f-c0bb60766dbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518856, "uuid": "dee042fa-140f-4b7c-924f-70b94fa4f659", "value": "GMBH_2.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d718aea9-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Kaiji)", "timestamp": 1752482705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482705, "uuid": "943449e3-2fde-41b5-8ba0-66a7326af302", "comment": "Malware payload (Kaiji)", "value": "4d67c3b77febe901f240a568a6ea328b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482705, "uuid": "8f55f121-6330-49df-b26e-965df5315814", "comment": "Malware payload (Kaiji)", "value": "4d92c4a0f701dee5831f9cd6968c68addceefc887d139cf92d5d6f83a82a6b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482705, "uuid": "0aed9517-ab36-49f3-ace8-d16a6464f27a", "comment": "Malware payload (Kaiji)", "value": "dd567b0210de3870f6de6678836370401ce9d433", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482705, "uuid": "9048ca6b-18d2-4d03-95a0-70b0afe7d9ce", "comment": "Malware payload (Kaiji)", "value": "ae78e8bbc3a04d4c3b4771c7077637f474c4cf1df4c3254b166c80b953b0344339d8a245286a1e91a7a7745c2c24f072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482705, "uuid": "6f72d69e-106f-4807-a927-13cf34dbb0c3", "value": "T1A0463943F89095A8C1EED13086629293BA717C895F3463D32F50FBB92B76BD46E79310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482705, "uuid": "9e1eb983-2d53-428d-806f-7926045150ec", "value": "49152:7Xa6xzZWhrb/T4vO90dL3BmAFd4A64nsfJPJ6TdXnT9aqeJaz2xNkapDnYRQoj1B:b2ONLBzSxtST9ElHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482705, "uuid": "96ef8e45-8632-41f3-86dd-37fb5aa986c6", "value": 5435392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482705, "uuid": "4ae161d1-1711-44b5-a8ce-5b9c83a71d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482705, "uuid": "e4bfe145-e7d9-466a-afa9-39f010a81ef4", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cddb11-60cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752509486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509486, "uuid": "e00fcc4f-4fb8-42bd-baa1-0da9a399dfe1", "comment": "Malware payload", "value": "1123e19c5761a26d7fbb494abcb61386", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509486, "uuid": "8fdd2a4f-a872-40de-b995-73ef01818860", "comment": "Malware payload", "value": "4e146759d518e456d41864f36c899efc51f0e8d230550dfc6525494f7d2adf90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509486, "uuid": "355bb506-e005-4e82-afb8-0ae59a6f1d8d", "comment": "Malware payload", "value": "27ff9558522cea2af2c730c1ddd1948b5645fb11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509486, "uuid": "bc2ee5fc-6911-44d5-a1b6-d92db547c813", "comment": "Malware payload", "value": "5eaa10a0c5efb795fa7dcfc5ad97c89ca537244d87fb7eaefb349165c5b5898d76244b5dc4c90ce1f6fca5ecdeabdf7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509486, "uuid": "9f1480f0-f18d-4872-947b-f993dadae5f9", "value": "T143A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509486, "uuid": "abfa85da-18b9-473b-9d1f-2d09eb280ff4", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752509486, "uuid": "a70e49d4-7905-48ff-9537-5abc77381199", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752509486, "uuid": "a9ccece2-dcf0-4e5c-8c5d-a36246b22c08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509486, "uuid": "7f92b5d1-4066-40da-811a-629cb15f3279", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f2d13a-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752503932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503932, "uuid": "aa0f0935-57a2-497d-992e-ff8193ea2ce7", "comment": "Malware payload (Mirai)", "value": "ebc002d575e02dbd0f81160dd1f261c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503932, "uuid": "0209bcd3-2963-4ea5-85c9-bce88e605a87", "comment": "Malware payload (Mirai)", "value": "4e38f310c45ad13e5fae10839e61d06fcfe6c0b021f1aa12cf7c23dc47231e8b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503932, "uuid": "db627ec0-7f98-4b20-a4cf-ebe18249e745", "comment": "Malware payload (Mirai)", "value": "e589e5d1d7a16fe44cf7971d0fdc1b09943c8823", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503932, "uuid": "b7a81c39-add5-48bd-83f8-6c8e5b5c9b3e", "comment": "Malware payload (Mirai)", "value": "ccd8cd32cf6139584333601e35c4ef538db2f235b37b226d09f8696ffe91b7a7e2f9611a68090462b839b20cbbf1a809", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503932, "uuid": "5d014303-26b9-4089-befd-bf0ac2801709", "value": "T10041DFE41AA104352CD5EBA6B6A5459034C1F2C26CC02FF5A1FEF4EF415EE982341FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503932, "uuid": "57f31a02-dd8a-4ad6-a4fc-a548d966a7a1", "value": "48:vv09vd4vTaVvioKVssvrzYLvMXdJvNfkvpUvJEJTfvFy6:vgWk4HILcmiw06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503932, "uuid": "e47348f7-5efe-40ce-863b-4affb2ca60a2", "value": 1940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503932, "uuid": "2cf5d7c2-818a-422c-9ad9-69b644ba921e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503932, "uuid": "fc8902a2-b53e-41a9-8d8b-b242e7cc4687", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c69545-610b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536197, "uuid": "c292ff9c-a0bd-4376-bdb5-77b4a80a006c", "comment": "Malware payload (Mirai)", "value": "aba4f4960adf7b3d79f3bb39264c382d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536197, "uuid": "6109158b-861a-4c80-97b0-74de0828f588", "comment": "Malware payload (Mirai)", "value": "4e4c72b67cf76d19cdc0718ecf57a5d12f62c1e178e3befab280acb193123cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536197, "uuid": "8ecfb88d-36fa-461f-b210-e9bc6fc33eb1", "comment": "Malware payload (Mirai)", "value": "a45e5d0cf771af05b9ff2c4b22326837b7d7f020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536197, "uuid": "7fa2cfa2-b2f1-4777-ad5e-68a50aebd7df", "comment": "Malware payload (Mirai)", "value": "e6da960418d84d9ca997549b9d0d2d694e277799aa1a748adfbffbfd4ffddd60bba4a819e02f58f393767af9c1914803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536197, "uuid": "7d4d9cef-b217-4128-9c6b-d1e1a5753087", "value": "T1E11308757506B278E8D51038B84B25E528530BCC3ECCE2D362B3717AEEB5B09BC85D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536197, "uuid": "04f90553-a960-47fd-8248-e9b737cf5e0e", "value": "384:mn5ScVn8JxRRVKB2B6BvhqrSW7t3uRFT0h7uH3zX4nj7cxobKSTyRxBgtRCykzTj:mndn8JxRRVJ8YYMBbKb6ZcHvbpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536197, "uuid": "0af1249b-0e2e-46a4-9b8b-732822449d34", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536197, "uuid": "920abb33-9afa-4fbe-90a1-5e7f52a08f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536197, "uuid": "be70a5fa-b7a2-4d62-b224-e8277b54feae", "value": "fsociety.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251a19e9-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752491856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491856, "uuid": "97ce9832-f112-41e3-8a14-1c53007a6c92", "comment": "Malware payload", "value": "232027166ed97ccc300c72d57422f4ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491856, "uuid": "1fe4622f-0db9-40fd-bd2b-d8000480c02d", "comment": "Malware payload", "value": "4edc1f2de7890845e498cd6a7e06003b9c7d962648afdc5c0033dbbbb6139771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491856, "uuid": "a8a6e837-5205-416a-8683-4cb2873b48aa", "comment": "Malware payload", "value": "fd87cca61e2efb32170b886de79bc676ef965a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491856, "uuid": "295a107b-a5ec-4835-b4c1-ab37164cc7cc", "comment": "Malware payload", "value": "882ba175e198fd1d392f79b18ec581fb0f6cdc02d62e523873e0238666cecf2884d6b69fd16cce26b9af210a375afe07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491856, "uuid": "dacaf69d-c023-42ca-bbf3-2d1e725be6f7", "value": "T12FB402118F881F87C5AFCD750A2E167311AEDD9F46CAA43E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491856, "uuid": "bb42d3fc-0c71-4ce1-889d-6257b04ccf2b", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491856, "uuid": "92b0951d-e5d2-4c3e-8c06-423efa6b016b", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491856, "uuid": "e6aec159-6744-4ab9-bd8d-5c4de9c480d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491856, "uuid": "05106e20-29ae-4748-ace1-f2e386b85d2a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766f75ef-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485120, "uuid": "bafbf123-bffd-42ac-b4d3-d9348d4cf1eb", "comment": "Malware payload (Mirai)", "value": "b9de89566035da24a35e4df966aeb377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485120, "uuid": "ea44c0f7-b321-4f01-ac8a-396fdd0c5e36", "comment": "Malware payload (Mirai)", "value": "4ee66145b14743c9d9ef40d8ba0f8bef3d290fca5421f6e53ad916e433e653c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485120, "uuid": "104001fd-fa05-4354-b5cf-544def78add0", "comment": "Malware payload (Mirai)", "value": "3f6a8d0f91114a153cfce2112e3f47a58c64a857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485120, "uuid": "17a484c5-0a3d-41d8-9167-00ef84e6b9c1", "comment": "Malware payload (Mirai)", "value": "732d1c77522258d2c1c234290ba344052e4e5773440ac58d2d6041bfe2b58c22a5b4e78c48b3d56103b8cad3d7a6aeec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485120, "uuid": "f70d8246-4fae-4a51-9dca-a919f809bead", "value": "T121C2E161E1B62DC6F7766E502BA5D2C177B04E9EB777CC92255CAF0908A321707097CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485120, "uuid": "8bb7a20e-f084-4982-838a-20538fca9a07", "value": "768:lG959yM0HWubJsWDYcGmj4uVcqgw09S0m:tM0HRJswYcGmj4u+qgw09S0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485120, "uuid": "88bc0343-2a8c-453e-844a-14647ec12690", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485120, "uuid": "e5624aaa-e27a-4ae3-86bd-b9eb9591be9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485120, "uuid": "93a2a07f-d434-4383-90cf-1c197dced7d8", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0109518-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752495927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495927, "uuid": "29c562d0-3c5a-4921-a708-81c6c1fa5091", "comment": "Malware payload", "value": "d9c6622f6572960c99e1e149f85415e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495927, "uuid": "6c06907d-a940-4c56-98de-f2c4eda1868a", "comment": "Malware payload", "value": "4f34cc0c07b862b5d1d85589d831376cd09fc4439b67aa8d25f3850d500d5254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495927, "uuid": "d6327042-a711-4b80-a586-dcf03c0910bb", "comment": "Malware payload", "value": "a30ca9acfcefb768a002347a098021621cbf8a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495927, "uuid": "29ec6086-a861-43b5-bd64-caaa65788a63", "comment": "Malware payload", "value": "4d3610b869d6aeffbff9bf8189133d1582f15fcf7036f8467228ca5b69cc487cb871d770dfcc76a7cb72bcbd336bf439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495927, "uuid": "099b611c-f24a-41b7-80c2-63dd4f5b0a43", "value": "T18FE401037308A756DF4BA83A82CBFD31B7C2799113D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495927, "uuid": "ae947791-b029-4e10-be73-04a7ad671b37", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495927, "uuid": "6f9278c3-570e-4dd8-a50f-666b59a54ed7", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495927, "uuid": "6993213a-63d2-4c29-b23a-7a2d1003e3f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495927, "uuid": "589302e4-cd91-4f1f-88b5-fd6fdf5476d2", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a91fcc7-6063-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752463974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463974, "uuid": "e6c7c5ee-9eb4-4d61-9628-b0a8b059957a", "comment": "Malware payload", "value": "404e326a2693f1b48c342e26cb92b68a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463974, "uuid": "a9413c60-b93d-4ee8-be67-30012e02a495", "comment": "Malware payload", "value": "4f364f636228fedc5800d935114e9bbf9efc68e9e24ebac6b72940463a43a464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463974, "uuid": "536d543b-0d81-4b34-bedb-c0a438e860b6", "comment": "Malware payload", "value": "842f4661b19ee8909726db295fc64a5d95aea6ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463974, "uuid": "361438d2-fd32-4426-bd8d-ce6597892778", "comment": "Malware payload", "value": "cf90eb3ba6e8549c1847d27779044bc06e6c6100e8d52fde9bf3bfd42e681697375fbd3cd39c299f61fe8bc94dcbefce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463974, "uuid": "cbb38734-f0ec-401e-9afa-77577e304eed", "value": "T174B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463974, "uuid": "a0b012be-2804-4545-bc46-d84277ef7aff", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752463974, "uuid": "c725815f-5d20-4381-9b60-cceeaae175fa", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752463974, "uuid": "cf1827e2-eccf-495a-8e05-64ba0996d51b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463974, "uuid": "406999a4-f6f3-44e7-9368-845fd143611c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930da524-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752480014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480014, "uuid": "fb5a1395-8b8e-463e-9a6b-4f3107a61b2d", "comment": "Malware payload (DarkCloud)", "value": "00a4a51a26ac30c87349c2cc0acbdaf9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480014, "uuid": "1416c865-2ce1-4cdc-89b1-99b081247c0b", "comment": "Malware payload (DarkCloud)", "value": "4fb5ba01653be0268ec6b25fcfe0a87c21c233787a109d449d95ec31f6cdc090", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480014, "uuid": "26f01597-a7bc-4569-92dd-427e56871fbd", "comment": "Malware payload (DarkCloud)", "value": "2601f03601b6c02c0ecd85c56664ea650e0a157c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480014, "uuid": "22045576-aa6d-4cbf-8a5d-eee47c9d07f2", "comment": "Malware payload (DarkCloud)", "value": "f9357db57810eb53fa6def46d497cefacb3787af109e170cc55c362142926781120a713250efa19d48de07deb15a267d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480014, "uuid": "a724f0bb-a766-459b-bab1-e6af993de378", "value": "T195052262691ACCFEFABB13F5447D3AB16A67BE20D80B154F25CBB28047F4190E467724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480014, "uuid": "31d51d7d-2aba-48de-a448-ff96940f7d9f", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480014, "uuid": "725271c4-d045-4390-bd81-ef77589f1b25", "value": "24576:Kq5TfcdHj4fmbxF6FmQlw5dW1VukuyX572j:KUTsamcmQlw5auqJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480014, "uuid": "616896c7-c2f4-463f-b0e5-3d7f4c06cd0e", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480014, "uuid": "c2b5b542-7ebc-4b25-b339-d02b5b00fe50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480014, "uuid": "276391a7-97ad-4e81-9bc9-eb42dafbdd61", "value": "QUOTATION-ETH002341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8845b997-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479996, "uuid": "5fcb1ce7-5a83-4daa-8785-30d90063b728", "comment": "Malware payload (Mirai)", "value": "c5448f5e1e1be680dc102357f9753967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479996, "uuid": "03448be1-27de-4ff6-b506-322d548e85c3", "comment": "Malware payload (Mirai)", "value": "4fefc3f056ead1a64fe2c5132c19e05b700ce944f9319cc8c50ba094ff860a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479996, "uuid": "67de3bf7-bf42-4c8c-af63-72139118ee6d", "comment": "Malware payload (Mirai)", "value": "761e861a6110c5a8460703d66eae9a4f4eba41e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479996, "uuid": "9bcfa5f3-af14-4530-b8cb-9ed5acfe785a", "comment": "Malware payload (Mirai)", "value": "b6abe98c724f8b9c7ce0dfe4b4d9a7831d9a58ac832209cd0934128275810a79b480afbd5e1db6aacc867d52fc351ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479996, "uuid": "52d71def-9853-478e-b75a-9faad32341ef", "value": "T17A73BD23CD21ACA4D04846F131B18F39A7A3A61295472FF725AAC2B5D443ECDF6563F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479996, "uuid": "eb180e92-0222-49ed-a8d1-d6f6d29b48d1", "value": "1536:N4nks5wPpU7dgKyDMA1YB9Cn7UzOEb4nHC:NktwPi7dnyNYB9uE+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479996, "uuid": "1c7a6595-a33b-43cb-85de-96ad1abd2128", "value": 75628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479996, "uuid": "6478285f-e8d1-4374-8f48-ee2cecc2d5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479996, "uuid": "eb8b5edd-71d0-48da-86ec-12c86dae129a", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c328e493-60b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501140, "uuid": "d425a9e2-e9a1-4c87-8ce8-488562276106", "comment": "Malware payload", "value": "bfacaba34ea054d8aeda52b7cc72e8d8", "object_relation": "md5", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501140, "uuid": "d7ccc971-1525-4a93-b203-346835206c59", "comment": "Malware payload", "value": "5013fb3fd7de1fa92ce2ec4d99a600a38eded77819dd92f81ae5fdd8e488e8f8", "object_relation": "sha256", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501140, "uuid": "6706cc6d-db5d-4319-8ee8-574ef51d4149", "comment": "Malware payload", "value": "3117554815ca12712d17581351c9f52b398d5c78", "object_relation": "sha1", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501140, "uuid": "4480bba6-7c84-4d0e-84ba-f1708f8ea07b", "comment": "Malware payload", "value": "0570ee9ca240def05b550b47a21e52cde62080edf86c778bd7f91ec4475a80e4322df963c2259b1931fa2f63b7c5cf14", "object_relation": "sha3-384", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501140, "uuid": "0c58da88-1e18-41c8-9d86-6ee4fb4f04bb", "value": "T1F146380BEA935499C0EBC138A76AA3767D3238158134761F6624CF312F16FB1A72E75C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501140, "uuid": "3b9956b4-10da-4b4f-9e13-925254f2e9df", "value": "bb6024bc08332bd3aa5de4f81ae2cf63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501140, "uuid": "9499bfe4-6acc-40a3-bfa6-4968cdb467b9", "value": "49152:ETRwEF7ezESvcNnioUX0henboCrjaZlghoPtZNjau4pLQo+9HBfd/AlIvA8rh/me:E1SenioUkg0qMPtZNjau4Jg5GlIoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501140, "uuid": "d9a84e36-2b37-4420-9b98-923a0299f9aa", "value": 5718088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501140, "uuid": "fbd9a569-5111-4a1c-bbc2-05b8d85027aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501140, "uuid": "8d1b47a0-d21d-4b9c-a14e-ee5289eab871", "value": "wxmsw32u_core_gcc_custom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20b5fff-6097-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752486589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486589, "uuid": "280d53fa-3080-4af4-be27-d317ad9ab617", "comment": "Malware payload (Gafgyt)", "value": "655438a01a8948693d414dc707cfc51f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486589, "uuid": "2c3bdc0f-264f-4968-a0fc-275e104b0d13", "comment": "Malware payload (Gafgyt)", "value": "50316dbe76f4ac9ee3e3de4773cc3d1e14ceb24b54d9754f2758a10e21fd66a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486589, "uuid": "ff11c3ac-8519-4779-b5bf-ca2c3fc2863f", "comment": "Malware payload (Gafgyt)", "value": "f0cd00ee25e1df8342e6e8c60b28238efdf3ff24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486589, "uuid": "9c384b23-c2c9-4ac7-99a3-e4fb7188f99c", "comment": "Malware payload (Gafgyt)", "value": "fad718f98b7ec9065bd18b75cc8ce9baf0fb4f556541d310bca179200280833e7a12241a3d24686390d02c6a2efefb02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486589, "uuid": "cb5d8e1d-ee9d-4832-8782-49f80e1dd9bc", "value": "T127C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486589, "uuid": "6640cb60-b485-40b9-a261-6e54d2386ff5", "value": "3072:4jDy/+mh1vtbPIKa5bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa5bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752486589, "uuid": "1e7c1b12-ede7-426d-9226-07607a2edc50", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752486589, "uuid": "e3fd4c10-227f-4095-b944-80bfddfa2ddc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486589, "uuid": "57f41072-8fe8-41f3-9d54-909750a36c21", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70f3e9f-60a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752491242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491242, "uuid": "46126f4e-d6a9-433c-9c90-60811ae5c6bc", "comment": "Malware payload", "value": "4720c4b083712ff678fdda0334316c82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491242, "uuid": "ee058e48-ec75-4121-885d-325c8522db89", "comment": "Malware payload", "value": "50a9767cf70223034f641841359ebd5daab0e64ba1c306048f399d5336c3ff71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491242, "uuid": "5f2fb8ce-1edd-48b9-adcc-9c4d8c0b587e", "comment": "Malware payload", "value": "c5b43d7d921f0c401a62735d4a9e3ae4778115e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491242, "uuid": "ed57cb83-5848-4bd4-b3c9-aeaa3b45a62a", "comment": "Malware payload", "value": "a050001b625bf103052a047b3470aa6d3e84471d48be6edef31e90a487b4a80320d486c3d6d37774d7d29168cb002568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491242, "uuid": "f47ba42b-14e7-4727-89f9-ce0d82012984", "value": "T1CCB41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491242, "uuid": "4f8b2e82-5074-4fc1-b308-561baf1ef932", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491242, "uuid": "898f6ad4-b726-416b-9813-b9ae11498929", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491242, "uuid": "e49d1d6f-d53a-4df4-ade9-39d896f240e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491242, "uuid": "ab47f69d-922e-4c2f-983b-061d0812b73c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8c343b-60f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752527917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527917, "uuid": "92aded45-226e-426e-be8b-40ecea3aafd7", "comment": "Malware payload (Mirai)", "value": "7567d7c87b208689b04639feec0ecb87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527917, "uuid": "372a785f-02cf-4bc8-b268-8961d3267ee9", "comment": "Malware payload (Mirai)", "value": "50f7293ef7d44976954e0ae26c6959db30a62ea30119cb10bdc0fba9baea9693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527917, "uuid": "ee7707be-067b-447a-8440-5a85fc4b8a3c", "comment": "Malware payload (Mirai)", "value": "e3a996c868a11fb4b9bd9f1522b0604fba011203", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527917, "uuid": "fa692328-61cd-4d7e-b7c9-7ff434e47712", "comment": "Malware payload (Mirai)", "value": "7c4e770039ae4502167c710e92f8f92dacd3b0e9d2d145b9f7a13f1dfaca984fb6ce8e3650c0e8d965c13922ca8ee982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527917, "uuid": "fd7c8ebc-a1ab-493e-973e-a26bd392f518", "value": "T106A30946A9819F02D4D631FAFB9F414933136FB8E3EA7101D920AF5427C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527917, "uuid": "039a5c79-4dd3-4834-abf0-2254a594b24e", "value": "3072:EiKERobXXNd2Sa20ZC7GPvdtSKjdLSruxbDG:JKWobNMSaHZC7GPv3SiSrulDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752527917, "uuid": "701036a4-f2e2-40ce-8026-b68f1c03b2e1", "value": 99420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752527917, "uuid": "cf62c184-202a-424b-9642-60d7f30fa128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527917, "uuid": "23c2732d-4be4-45ec-97f1-79dedec65061", "value": "SecuriteInfo.com.Linux.Siggen.9999.31395.29644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf1613b-60b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752500162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500162, "uuid": "48dae6ce-444c-4018-bb74-9fc84cde7630", "comment": "Malware payload", "value": "8ef70b346493de86ebff4c9de2dbcf77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500162, "uuid": "c06c8226-58e8-4f6f-b96c-cf581b3e6cc5", "comment": "Malware payload", "value": "5111c22f3e659c79151227fefec5185dd6fb31f9ea1a56ea26fb261670560ffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500162, "uuid": "af49acd2-005b-4795-8c8a-6e3d6786e823", "comment": "Malware payload", "value": "72e8cee08405f07233088630be20de020f5a42a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500162, "uuid": "3cd5bedd-b46a-4d66-8568-68aa21aab5c5", "comment": "Malware payload", "value": "7ac4bb72459ee0a8d3b8e8542fd0810b0203acdfd7ee8b754248039dc7c75a66151855af76ad737594b13aa80abb9718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500162, "uuid": "4c1e4f78-7941-4634-9324-fbfe1873590e", "value": "T148184906770A8E5AE012A43044CA8F9173A6DC71EA71635B3F553F796FFE1089DB2E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500162, "uuid": "ac69e417-e42f-44ea-9e52-afef9605ccd5", "value": "f50aa1dfd7723d95926559101f0ad1b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500162, "uuid": "9fc032d7-2f7a-4e05-a942-313be1c06371", "value": "786432:exd7Vfp1uVS+w13S2xbRDIQ6phvCAVCGCHn:exXBUweQ6phqAVCjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500162, "uuid": "abc11bd2-d0c8-401e-b5f6-4c1a144a813c", "value": 85663279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500162, "uuid": "b6006aa7-4c57-43b1-a57d-f8877ae5994b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500162, "uuid": "022c3bbb-e816-46f7-83f9-c339b2ac21a6", "value": "bii.736885002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f374823e-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485330, "uuid": "44535acd-acf2-48db-ac6a-93be76a65257", "comment": "Malware payload (Mirai)", "value": "2a8a0065078d06e43df0eeabf42bef5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485330, "uuid": "7a83ca92-a0f6-4d3f-b296-8ffe15f39940", "comment": "Malware payload (Mirai)", "value": "5119db42a38f20e66469e146d789d5b0fd4fefe9cd08019d9b57d35851f4821d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485330, "uuid": "de7c8db0-4598-4a48-acf5-66338e0d72f5", "comment": "Malware payload (Mirai)", "value": "1a80a2b1fa7245d6aef4f727f3328e6e3ca72e25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485330, "uuid": "a0ff9f6d-db64-4836-96f4-b238f8df80d7", "comment": "Malware payload (Mirai)", "value": "e8d713ea6f0f9039e5bcdb7e60453e2972933c0c3d1ad4ea13dc2da703d72968c6dc110a52cf5c9e4ef4cec9c1b170fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485330, "uuid": "f33d4d03-f974-48c5-a4f1-a7b480a2852d", "value": "T118437B62C8701D59C71885F8B0788E3AAB67951062CB6FFA116FC379E053DACF8453B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485330, "uuid": "3ee7c362-35c1-4beb-96fc-4d70689e6839", "value": "768:BDKxd3iH5rXtOcLCfjxAKK1GoM7sa8oBOYCncuRA0rdsfT4OtNNxOlSYrtl4moOB:bycL2KKK1Gz7v7YYCnEF3ToSYsaC0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485330, "uuid": "83292088-7782-406a-8623-a7bc6946f2c2", "value": 58532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485330, "uuid": "89892538-0e41-4e5a-b595-1b2a53b7d5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485330, "uuid": "63499bc8-b05b-4191-9e5d-1bbd56c0a7e0", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b2fd16-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485094, "uuid": "df374091-12c2-4a09-b467-44bcecd25795", "comment": "Malware payload (Mirai)", "value": "8f2b6221d61e6c7fa6d90271b6b4d715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485094, "uuid": "8320941e-0ff6-4e54-9f21-c2fbf43670cc", "comment": "Malware payload (Mirai)", "value": "51d02515ac135fe1d9b7e4aad15bf97f7876600d9cb0cfb3f228d7c1514aacca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485094, "uuid": "80a34a8b-4faf-4255-97e4-b7ddcd03aca9", "comment": "Malware payload (Mirai)", "value": "8008a86bb42decab627487c667baf4baf03ec6d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485094, "uuid": "c13e412a-c8f8-482d-bca9-21caf5dd2ba9", "comment": "Malware payload (Mirai)", "value": "b4cd46b305ef53c332e3a64b1fdceb49e59668bc621d56c113c1212c384f7ccd6d64ad619ddd0942c9fbcbb85e43023e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485094, "uuid": "6ef0d84a-8933-4413-a2ea-c5c70a61769c", "value": "T100C2C0E0D1B66F8EFFB7AAA45888C6C17331591EB372CDE665149F4120B63072B54ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485094, "uuid": "5a8e768f-6ce4-49a9-8ff3-1dc78a4a497a", "value": "768:LG959yM0HWIP+Ybfh54OvZKfhB/4uVcqgw09S0S:TM0HBWgZFZKhB/4u+qgw09S0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485094, "uuid": "70346bb1-b298-4034-a7c0-6777c511554b", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485094, "uuid": "daecd96f-a916-4775-956f-dc56190daa22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485094, "uuid": "eb91d6e0-39bd-4f98-93aa-336a7b3af236", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca26b6f-6096-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752486097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486097, "uuid": "b7302b35-d917-4a0e-b524-859f6ffe7439", "comment": "Malware payload (Formbook)", "value": "5f763db293f54c634bb185f33e0d69da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486097, "uuid": "5d42c070-1a37-4aa6-9ff5-46f7f12fc546", "comment": "Malware payload (Formbook)", "value": "520d39249b7e25f668576f049dab1645d0c701632932e0bcc3c3f1f90ee8355e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486097, "uuid": "f48c8690-f54d-41cf-8dd0-cdf8ef114bf0", "comment": "Malware payload (Formbook)", "value": "26b407ff5b29ecb8a1f630af2fb6156c59671059", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486097, "uuid": "d23c5490-9bcb-4b41-ae4d-334c034361d6", "comment": "Malware payload (Formbook)", "value": "1302f1bc9927ce36a7c6ce648c0c9c93a4c498ee7d9a4cbd0e767587c68b6de970814f07624d35e9212eb7473c379f45", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486097, "uuid": "bac7525d-facc-41b0-a932-8e1dfd66c7db", "value": "T1354663C6EAF19FA472482F983A343747C8ED42C7EA5210F452A8D536DB7D629C79D032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486097, "uuid": "16b820f3-68b6-4f31-bdc8-602193b899f5", "value": "98304:FCjQXVV/ajnM2HVLVRrBgPBEB4OTa6+BL+hWs/1H0L79371lPnKYz7N479gCC5lA:FPcnM2TViI4OTa/BKhWs/VY9k+em7tmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752486097, "uuid": "0c992f90-e510-4d32-a1a6-ee38f2da7d2d", "value": 5640810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752486097, "uuid": "c251e717-b1d9-4d57-9657-acd2f88b1c4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486097, "uuid": "1859eecd-c1cc-48f3-bc8f-7558a6844d5d", "value": "swift909288172918.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da5002f-60b2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752498017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498017, "uuid": "9fe7fb69-c3b6-4199-a1bf-b1efde0b635f", "comment": "Malware payload (Formbook)", "value": "c6c76ca1ca7467594ae8a63fc86ac6ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498017, "uuid": "7f0eeee3-a732-446b-b1e4-fe276ad07b3d", "comment": "Malware payload (Formbook)", "value": "53884b03bc727653b07a61a15261915406275a10916334cb304aede8098fba03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498017, "uuid": "5c912276-03a9-4a3b-b50c-53aa4737e0fe", "comment": "Malware payload (Formbook)", "value": "015fed4377b8a4295446d99999aa6bcc9fe60d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498017, "uuid": "bc7a02ce-72f9-44c6-b297-4403379f4bac", "comment": "Malware payload (Formbook)", "value": "7f6f84c5ec9668960779966dcb5dde9ebc20fc39e37153a0d9163fabb51ad973edb282be1ed6bc8ae73d20a4fa4d58f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498017, "uuid": "8431455e-f66f-49cc-8636-c73350716b9b", "value": "T1F745CF2373DE8361C7B25273BA567701BE7B7C2906B5F86B2FD8093DA920121521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498017, "uuid": "77636076-26e3-4f13-ad88-8eecb8314e95", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498017, "uuid": "1f9d3b96-c7e3-4289-97eb-b1cb14444559", "value": "24576:xtb20pkaCqT5TBWgNQ7asmv2XknfH9PMXU826A:CVg5tQ7asCdfVMXUT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752498017, "uuid": "86bff57c-59b8-405c-b06d-c6285f866a59", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752498017, "uuid": "ab13511c-0b76-4499-9572-3e6ded64cbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498017, "uuid": "801306d7-0598-4762-a3bb-16dea514daa6", "value": "TUIP_20252701.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee5f903-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485188, "uuid": "94fa96db-07fb-413d-abce-a70540139b5f", "comment": "Malware payload (Mirai)", "value": "62b123908d0c0d7e89101b0594cf079a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485188, "uuid": "69f318e3-986f-43b8-a6bb-69419e055754", "comment": "Malware payload (Mirai)", "value": "539afdc256cfc40d4cc61e1d7e8e663ea8524f0a1aff84811f10ecb4a16e540f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485188, "uuid": "65b70a4f-d3ce-4694-8a7f-1f68ca61ab7c", "comment": "Malware payload (Mirai)", "value": "5ef62467b7c17bf436d26626120bdd00c7bec0bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485188, "uuid": "74417661-fa38-4725-a478-d5bf28d482cf", "comment": "Malware payload (Mirai)", "value": "ff48c274b10ae776a3c30d03211c826b3a4637813eb9223e88e81bb1d9f87fc5c135eff723408f0c82b34b132ab246c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485188, "uuid": "82b49247-265a-4bdf-ac9e-5baa8185cea2", "value": "T15B630891B881A626C2D1137BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485188, "uuid": "91ac323d-dcd6-4fd0-a4c4-2eba7dd7f86f", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWSYRM8fhWtu5zPeH:eOTgWLeMDcJSYRrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485188, "uuid": "acaf9d23-b5ca-4e2b-94c5-7633e6edf080", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485188, "uuid": "74a4e69b-c494-48d5-a7d1-33668c0e4152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485188, "uuid": "61c4a5b9-a215-4a28-9150-3ccacc5e8673", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7e866e-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485077, "uuid": "6d5fe65b-38b6-4a56-94e9-671c479b924e", "comment": "Malware payload (Mirai)", "value": "7e68fbc64bc657f98f630c0887d25222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485077, "uuid": "f7a6a831-d9d4-408b-a63e-68213292a4c8", "comment": "Malware payload (Mirai)", "value": "53cb7b96144a55d4048c25617078a07efd300306b0c689a31864030659427966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485077, "uuid": "45bcc164-2d94-4f7e-9d52-153714e90472", "comment": "Malware payload (Mirai)", "value": "16eb5bd4c140ad37eddedba90e05cf0f0d7423fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485077, "uuid": "3ee779a2-a9d3-4581-b059-e5fe9e30f9cd", "comment": "Malware payload (Mirai)", "value": "838320dda5483e8f7672a03ea9a72b50bf9e9a645f3c4ce7896d1b4f04708c7a74810f241d63e9f0851cad012a5fcc36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485077, "uuid": "2e4b6e4d-e874-4739-b9ad-5136bf687dab", "value": "T13CF2E891B8854727C1E41379B6AE5A8E373073EC92CBB62BD8224B207BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485077, "uuid": "d47de271-f3f1-4878-89bf-aa2882175f2e", "value": "768:VxwgXqSoG5M1ImBHGaBwO3iRtWV5za9ZSFHE3RCTXpocoztSwn:VRqZG5MRxGaeVKSUkB+Xen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485077, "uuid": "8dfe9ea3-8edf-4071-8859-4c2607b85cb1", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485077, "uuid": "1c77cb3a-2dd2-4568-81ac-1a0dcee05b7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485077, "uuid": "db0b13b1-0db3-4a99-b450-e9476314e911", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d94f11-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492146, "uuid": "de149338-aff9-4954-9f9d-9f79668debc8", "comment": "Malware payload (Mirai)", "value": "2900f113c7a64bdd6ea71eb6be015c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492146, "uuid": "0ef0b98d-17fa-4483-8524-ac8013b6f414", "comment": "Malware payload (Mirai)", "value": "543a85a472aaafe07469b59e92561d779bee721c4fe04e9726f04a1f3c2863f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492146, "uuid": "8b1df1c7-0bf3-4108-baec-5828b58d37b9", "comment": "Malware payload (Mirai)", "value": "fb6fde1ae503c1389473c2809a1748ee5543f7ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492146, "uuid": "7fa444e0-d1b2-43b9-8c4b-4a1ee9e2823f", "comment": "Malware payload (Mirai)", "value": "41e8e9b8e442709a57fad93cc24b36a866f6498fe3a8b9e0d72c80c41e5bfbb750aeb1d7b81544aeb0562187db2b1962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492146, "uuid": "62d4a2f4-f50c-4b82-9666-f88e5ce1a531", "value": "T129E32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492146, "uuid": "15f45292-1018-484b-bcc8-0b729ed802ae", "value": "3072:FYvMxqixyDJAmUzdBJXu9WRtotmLFQTihvdX0clM/9h4b/kP:yvMxqixyDJAmUzUSotmLFuiXX0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492146, "uuid": "6464574c-1dc9-4068-a167-3f02c61bf886", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492146, "uuid": "20880f50-2a68-468d-bf10-eadce7248f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492146, "uuid": "af2b68d3-ef21-4b14-8e03-64e2de34c32e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2a3cbd-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514500, "uuid": "3177ed45-4412-4f41-aeb9-dfce19175fba", "comment": "Malware payload (Mirai)", "value": "b2d09bcd2977ce3cecf4e32158879a40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514500, "uuid": "8ada468d-3398-46f8-8fae-bf0a3ab48b50", "comment": "Malware payload (Mirai)", "value": "5452e699ba4955e98d57b31672cd964f07385346f27294573c6801ba900deed1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514500, "uuid": "f3c9c134-eb27-4270-86a5-ab1ba9a966d0", "comment": "Malware payload (Mirai)", "value": "a86ac6fbf56a9028b15b01b2651135e7a34dff08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514500, "uuid": "45b8c43c-38fb-4294-bb3e-4c11442b7e80", "comment": "Malware payload (Mirai)", "value": "f56f7d0a9021eabce330f798064fcc552880509e381005ef7a0db3082195dcb3372eefae083bcc69ccd370edb15a1150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514500, "uuid": "9677397f-5c3c-46ba-add2-ab86833cb747", "value": "T1E503F1DF97BBE174E43003B3AD9C269CB5DBB433514A4EA30A9A717F6EB7A512504180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514500, "uuid": "dc66d6cb-a30e-445a-be3c-7f5a85335253", "value": "768:6QTWj2PMuS6gMo573XZoMR/IqDDWHNJtImCd/tTn3mKk2g6Kx0WO:6QauM3PMI7nW0//WnOmoty/5BJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514500, "uuid": "2d2289d5-8673-4796-8baa-90065431e418", "value": 39828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514500, "uuid": "1bbbff2e-27bc-4f50-b6fb-2bb970e05f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514500, "uuid": "1410f573-fd39-4218-bdfd-a7ea9bf81335", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e773950-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1752477886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477886, "uuid": "2b01f65e-46fe-482d-9a8f-b15d40be79b7", "comment": "Malware payload (MassLogger)", "value": "8f4ee26f1c60f38544194e0cf6b8597b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477886, "uuid": "4ef49738-037d-4263-97ee-8b5c5a834222", "comment": "Malware payload (MassLogger)", "value": "5457dc106b0165693cd3b25cfb4185d7c958157b4ab6ef05f636dbc880612dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477886, "uuid": "fc8ad3fa-6ef6-4ad9-a838-b5e0a35a05e6", "comment": "Malware payload (MassLogger)", "value": "42723be9eafbf9b465ecf8ca1e117895fa165288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477886, "uuid": "c9dd0130-e935-4600-b1dd-a82a6a78b9ed", "comment": "Malware payload (MassLogger)", "value": "a1e4f2b47b980ff93a088ddcd4422c20391a986590254ec3cc17a55ec70ae20baec87153b5c7f742db6ae303d609a088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477886, "uuid": "cfcc8d16-15c2-480f-a1ac-cad51138ac32", "value": "T1FA35AE2263DD8360DB725373BA1ABB216E7F7C2546B1F45F2F94383CA932161121E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477886, "uuid": "f8e7387f-cf46-4421-981b-1977b56cfde4", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477886, "uuid": "a2c340d4-02f9-4e53-ac9b-a6ccd90bee69", "value": "24576:Vtb20pkaCqT5TBWgNQ7au2p2hGqH1axn6A:GVg5tQ7au2p2hH1aJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477886, "uuid": "6d8c70fd-f26f-4581-90ea-8b442f72883b", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477886, "uuid": "d8cde203-be2b-4109-949a-94151d81dd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477886, "uuid": "cf02abc0-bcdb-4bed-928a-eb7cd89dff9c", "value": "\u0e43\u0e1a\u0e2a\u0e31\u0e48\u0e07\u0e0b\u0e37\u0e49\u0e2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189e888a-607b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752474225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474225, "uuid": "da943507-b7f1-4497-9abd-d7444b7be978", "comment": "Malware payload", "value": "ddd0f11ff6461d2a32908bba32f9a9ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474225, "uuid": "1ff047b4-17e1-422f-9743-6ead76c09e37", "comment": "Malware payload", "value": "54710523f027d1ce4ae69371b9b37e74177e066865a067246025867e1d1e0b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474225, "uuid": "1c4f12c9-7fff-4c22-b15a-0b8dbade38be", "comment": "Malware payload", "value": "b86a8953fa232cf33c6f3fec788758832d165660", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474225, "uuid": "6679859f-8d8f-4abd-ac02-e58153f3439d", "comment": "Malware payload", "value": "7e119ce250a79b7e970fcbded34c69450a7844a375fb85227a62ed7b8ec56c778a895b92904539d950b5a53280a0167d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474225, "uuid": "cc00ef02-b1a1-400b-b800-a9c9731f6d39", "value": "T136A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474225, "uuid": "1affca0e-29a2-44b8-9c5c-64f7fa936c91", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474225, "uuid": "d9a4a56d-0728-4e9d-9b04-bdb643375bc5", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474225, "uuid": "e17a7081-a60d-4c8f-a427-9ea7988286c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474225, "uuid": "2f368d82-6cbb-46f4-8164-0a248b6a6500", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac08048-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514494, "uuid": "6427a21c-7b65-4886-9370-9f1294c0042a", "comment": "Malware payload (Mirai)", "value": "262062ee2bf77a9ee8f92768201df9c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514494, "uuid": "f364fae6-d5c4-460c-872d-73a732e2d4fa", "comment": "Malware payload (Mirai)", "value": "54891d6fc64fa62a5401215b257a9931ee6644fe7201ee0d17f86675a72009e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514494, "uuid": "8020722a-a9e2-4283-97e7-a611dd1c19dd", "comment": "Malware payload (Mirai)", "value": "75abb7f15a571a193f1e811e4e5be436308f8f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514494, "uuid": "c3e13594-1836-4e02-b147-f7f2e88634ba", "comment": "Malware payload (Mirai)", "value": "1b7f8e6b05363fbc339bfed1925601fb74df2a2eda8ffa0d4c259369bd6e47f7ea76cd017ce534240a224587ff1c2596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514494, "uuid": "0d3b6673-a289-4633-9399-02035ea5ddbc", "value": "T103C2E19360B9CE03C8B3837B6E3C59A222609434634EDD2E37695FC933464D0653ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514494, "uuid": "a198f85f-b3f8-458b-b458-c11eca7e14c4", "value": "768:X5+Kcrb9VDJeU8ETgdTHOBcK5ZCAyue7G:0lrb9vegTg9QB5VWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514494, "uuid": "ecb35ee1-fe00-4c34-b5d1-c5e9be8772c2", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514494, "uuid": "ca9879b6-5d90-4785-a1d1-2f609357f35f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514494, "uuid": "3bfd2af7-f57a-470e-aa6a-fa62f0b3b8c0", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de21132a-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496891, "uuid": "693f9201-1ab9-4e30-a3be-3ffa35a639cf", "comment": "Malware payload (Mirai)", "value": "b2d8b3bf5297798ee1e31d082e6e33f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496891, "uuid": "17540cc3-469a-453b-94a7-c503678dd6b0", "comment": "Malware payload (Mirai)", "value": "5495966fe202a4f05400a366fcfe1a1ba185204d0dd88d8354660c10e25defb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496891, "uuid": "e8cc7b86-3634-405e-ace7-079134503f29", "comment": "Malware payload (Mirai)", "value": "05350f822456a0cdc5a66d0c1ec91db933d7f02f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496891, "uuid": "da39d2bb-5d3f-4526-80cb-646b17dca36c", "comment": "Malware payload (Mirai)", "value": "3b3b32c278c1ef6ba412a160d4e492e25014c91fc49d24384ed874fcf2760ee3dd6ac14eac7c19931b10f3df761b8ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496891, "uuid": "fb1f2505-5c85-4ddb-8316-4fc26e470139", "value": "T1BC83F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496891, "uuid": "65ac13e0-d950-426f-96d9-40a56e3b8b4b", "value": "1536:8sCvlPf6NDyL9Jb0+pHXlzPhha0xT45wn6ahWNr/xKW5XnHM35PrC:8sCvlPCuTxCwn1higWm3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496891, "uuid": "135e4b03-b5d2-43ff-9b9b-aab34a64da83", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496891, "uuid": "b10d3fd6-97cd-4afd-8abd-111d2620ad00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496891, "uuid": "ad57957e-a339-4dde-9fcd-39d0241979e3", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a435d68c-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752501947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501947, "uuid": "94e31416-c7f5-4402-947c-660cb60855ec", "comment": "Malware payload (LummaStealer)", "value": "672368c869a72ae731efc0e8c6f9d096", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501947, "uuid": "02eec886-d711-4da7-9f5a-3ec19208bc50", "comment": "Malware payload (LummaStealer)", "value": "549caa03c9aed64e4d13cad0a9f4ef45d8729d7e777a0749df6e2b2996dbea2d", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501947, "uuid": "84716c51-6aca-426d-93c6-d1b097269725", "comment": "Malware payload (LummaStealer)", "value": "afff43bd96ae962a44bf606ccdbc09b39843a6d1", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501947, "uuid": "3edb6917-7e56-43f3-9ac7-66f72014f0a8", "comment": "Malware payload (LummaStealer)", "value": "8875ea3510ca0b736d8588355faf4828559053f6ae74dc35032b11142992a03866be42035cceba5fdce769435a028d68", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501947, "uuid": "3fb8e78b-8508-45a2-b64d-59c5ad9c4328", "value": "T116289277E475222071B3543540A41AFBBFBD6A42519C83E272481B0E1ACEE3B765FC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501947, "uuid": "cfb659f2-ed20-4160-b291-74acc08c9e28", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501947, "uuid": "499359b9-ab49-4b64-939f-c4c0ccfe7abe", "value": "24576:H0aFC0KZGovBgK36P+oXX9i6/jAV9gpQw4QXUaP:HrCFlBv36PTHZ/jO9kcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501947, "uuid": "7f568d31-eb2f-4294-bc9b-f314ad040944", "value": 94385515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501947, "uuid": "2665e80c-554a-4ab0-8917-566303413da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501947, "uuid": "3703c496-59a4-4ef3-9990-9f33c66c1ef9", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cacb5e4-60a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752491439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491439, "uuid": "f7ada304-7030-40fe-8ecf-a92217f318ac", "comment": "Malware payload (Mirai)", "value": "7f36d0dfcf3e9b7bc33237b1a6ba7ee2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491439, "uuid": "7c045d5e-63db-4e83-9cd9-e52d648c5f66", "comment": "Malware payload (Mirai)", "value": "557c3e6e7d59d96137630377e8a018a6725adec14b4fc861e636df8b1a15825c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491439, "uuid": "83491bb8-b703-4688-bb08-e22bb8a76986", "comment": "Malware payload (Mirai)", "value": "1f07ba8dea2c7d52b7bf8a92a64f025a360bc3d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491439, "uuid": "a0339a12-a911-4f1e-a245-c0bf6d4c33a4", "comment": "Malware payload (Mirai)", "value": "12474f7a356ddfcd0e0cb07e80da5bc3f39b5b69d11fd9a0edcc4fca64651edce1fbf98acc6de6010748da2e89502363", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491439, "uuid": "11748ad3-7762-4ce9-8fbf-265118e183be", "value": "T19C749633A9158495D0108CF322A773559C079BBF88B622D3EB566EA4FF3441B52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491439, "uuid": "ed9ed161-46a4-49ae-b1bc-524750a92163", "value": "6144:2jAsWdIMT5rgVgD4BhbXOWmEFB8MW2GkkQNU:bTQgDQXhmEFB8MW2GkkQNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491439, "uuid": "88cc761c-1d55-4f31-8a81-5fc37b426883", "value": 350967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491439, "uuid": "445985e4-4b6b-40da-b3b0-eb2abd81c68e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491439, "uuid": "652a5005-797a-43a7-9b36-402553ac7852", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae60874d-60a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752491656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491656, "uuid": "1e2155ad-807c-4a76-baec-31be3f1f0e1f", "comment": "Malware payload (Mirai)", "value": "fc47c7e8f3c2ffc5ecaf3303702edf68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491656, "uuid": "0062c5ff-111a-4514-bf0f-1c73680c993a", "comment": "Malware payload (Mirai)", "value": "56e51644daf08328336affa01d7962d77a61cc44d47ff5e6141d0d57aef1cc48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491656, "uuid": "3664e287-6740-4390-9c47-244d308d0e83", "comment": "Malware payload (Mirai)", "value": "4728657d0b92a87e13b9cb132d95d1680fc2f88a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491656, "uuid": "95fb83fb-8c25-4b5b-93b1-bcde2f737143", "comment": "Malware payload (Mirai)", "value": "ae72e6fc0f4e38e9d5efadc94a5cf74a18af7e7a3811b56e83432d15554d57edab6d2e5586f8a06aee49e9eb64adfda0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491656, "uuid": "407d1100-63ad-4e47-a500-49d034513886", "value": "T1F5E339D7F901DDBAF80AE33748574805B530BBD648925A333267397BED3A0990537E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491656, "uuid": "b3f4d549-11ca-4eb0-ad62-8568e6d89f5f", "value": "3072:y9qf7PRVtkVa/16oxg6H0HwbRDVGjbi9LPVvgyi1Pk:uqu0/16oPHvbRXLPqyiBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491656, "uuid": "0d0c0228-04c3-4f4f-b8ea-814053a9720a", "value": 153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491656, "uuid": "66d06e8c-ef56-4978-aa15-8e32654e25d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491656, "uuid": "4a2b474c-0dd1-4efa-9c02-7b638d8349fc", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2af1f3c-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480067, "uuid": "950ef12f-9919-4a30-ac7a-0babf3e1518d", "comment": "Malware payload (Mirai)", "value": "ecf3811bb86a3012b2064f8435f39ec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480067, "uuid": "499478f9-280f-42e6-89ce-7e0e64f9cd04", "comment": "Malware payload (Mirai)", "value": "56e6d65f75dd4194d1c4d7108c708be1233dd8f9ab4cbab973c6674e211057d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480067, "uuid": "4c8d8bf2-4b79-4a6d-bf6a-8ec5f4d267e7", "comment": "Malware payload (Mirai)", "value": "3b75e8a7ed507754878016fc531677902dd26fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480067, "uuid": "d661cfff-6471-43f3-8792-e73ea9dc766c", "comment": "Malware payload (Mirai)", "value": "b2d4469d61215441d5110679687ee39d95a07af35806bade95d3a433581f09f3b4eda0d5e487916378d345877ed53581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480067, "uuid": "4db46ee7-38f9-4a22-a085-3bdcb3276b3e", "value": "T19AA3F809EF610EFBE86FDD3746E90B0525CC652A22B83B7A3574C818F54B14B4AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480067, "uuid": "e4ec55d8-df2c-4e97-96d0-fa0bbdb28a92", "value": "1536:x9jj96JJklrHsdmUqUu+hOjOBPjG47Zp+SWHmHvBvy1cTLZcvHQBwJYXIxbwyEiN:x9jj96JJ0IdmUqUuhcOmPBvFTL+9xZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480067, "uuid": "0dc287e0-10de-4822-8559-a949c3e3043d", "value": 107108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480067, "uuid": "1a274e83-b5b4-4651-9bd1-68ce0abec967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480067, "uuid": "4b30359e-b8e3-42bc-8337-8d87d0523dca", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71997647-60bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752502292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502292, "uuid": "4969ab0d-e659-4217-b7bf-03d91135751f", "comment": "Malware payload (RemcosRAT)", "value": "53307f7b906a1b74c1694ee50fa36c29", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502292, "uuid": "3dc350ad-8175-4aa6-bdfb-d283142efc71", "comment": "Malware payload (RemcosRAT)", "value": "56faf7910e496baeb5a7d4d39c4c506657fd594600fc4224bcbe474ea2ab5209", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502292, "uuid": "30867cc4-7ec1-4642-b27b-4eacae15486c", "comment": "Malware payload (RemcosRAT)", "value": "a0bd5f6679e6d8866e3aee38ace2645a07ef3e94", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752502292, "uuid": "fd437d92-6f18-4bb5-9b8c-6de2dc26ce68", "comment": "Malware payload (RemcosRAT)", "value": "9815c391f5c34471c4e68ed6b22606e2971cf332fb4d5fb3802b58a0eb218ed5a312e5b26a543154a5a8c953561514a2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502292, "uuid": "16490cd5-4f35-46f2-ab3f-bcac1495a80c", "value": "T196D41342ED3E7E1D9BE462B820DE5CDD0B5D2B9F163198FEA727B14C4F641401CD8A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502292, "uuid": "1c73038a-c0b3-45c0-8da9-38141d869898", "value": "12288:9CEtw3ItZofyn2sOOMQGcmhhRjqNV71AzwL32zfCm1Ls6Nhqllc:9N23EoU2LRjq/3eLs6/qla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752502292, "uuid": "db16335a-5dea-4153-8065-363f75ba89a9", "value": 617546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752502292, "uuid": "000efd55-98d5-4a97-9368-36ff86203129", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752502292, "uuid": "13dd524d-d711-4edf-9297-7a2db8dec577", "value": "PO-MASS Limited_14072025_155442-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bd6a1b-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485329, "uuid": "392a46e5-46ef-44b9-918b-29ce56ca97cf", "comment": "Malware payload (Mirai)", "value": "b0657d577a1164bc646b1279f326f532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485329, "uuid": "86d03ec6-0de6-43d7-941d-884d5e6a7f43", "comment": "Malware payload (Mirai)", "value": "57ab60466f6450caaa5433382760d447f3619adf209f4e9ef16c0c82fb301d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485329, "uuid": "6effda00-70b4-41a6-be0f-00a30cd8de13", "comment": "Malware payload (Mirai)", "value": "028d6c0ddccb5a11dd765fb137c70b433fdf400c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485329, "uuid": "f9176684-a10d-496a-ae3c-ae2d4e6b0080", "comment": "Malware payload (Mirai)", "value": "b3f3949e7192441c5409f15352fbdd42c729ca1179111b142bf77248d2936aa3bb096771db785b0e4981fa4abf2e6b1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485329, "uuid": "a0b916a4-75ea-49b6-9f52-825a6a0a98e5", "value": "T1BDF2E891B8854727C1E41379B6AE5A8E373073EC92CBB62BD8224B207BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485329, "uuid": "ba8303d4-601c-4318-aacd-29c66e028cc9", "value": "768:VxwgXqSoG5M1ImBHGaBwO3iRtWV5za9ZSFHE3RCTXpocoztSwn:VRqZG5MRxGaeVKSUkB+Xen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485329, "uuid": "417be484-4c03-45fa-868b-f479220f19f9", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485329, "uuid": "f8a0aadd-b310-446a-96b6-eeeccff47cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485329, "uuid": "0f9b81e9-0a49-4c5c-9452-b4f2c5af1bb2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14e38c3-604f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752455611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455611, "uuid": "7392ab70-9ff8-4d2c-9e88-b9e1b92e8e70", "comment": "Malware payload (Formbook)", "value": "3395f7a52eb90e8734acdec82972cc99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455611, "uuid": "f74ee847-2dc7-4fdd-8075-f798e3d1b2d4", "comment": "Malware payload (Formbook)", "value": "57c8ee35e3b1d914fb8cc8908626feaafd4856e550409bc8d5e7c152e61cfe6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455611, "uuid": "3a9dc2ba-af85-4a48-93d1-35bcfb7af2d3", "comment": "Malware payload (Formbook)", "value": "74a8bf970bc5bb856f563322b51bbdbbfd10e12a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455611, "uuid": "143daed3-b6b6-456c-9269-de4b678ace4f", "comment": "Malware payload (Formbook)", "value": "0677e70c41f2e5d9f7bec7a6787d5a631d8fe49f2ef3696b2f746d2b4d4c719509df32a6b0b93e364b48003bd829306f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455611, "uuid": "c6fa4cc2-8e25-4644-98d1-32321af40e18", "value": "T1A745CF1273DE8361C3725273BA25B741BEBF782506B1F96B2FD4093DE960122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455611, "uuid": "e5063a32-0ef9-4982-a362-fb312ffff72e", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455611, "uuid": "305d3056-87c7-4258-8071-7b14fed3c16c", "value": "24576:Utb20pkaCqT5TBWgNQ7aCu0Z78+qh80WtjJ42T6A:9Vg5tQ7aCtNxqhIBJp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752455611, "uuid": "972996b3-7511-48e0-bf4b-a45d8f978606", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752455611, "uuid": "24cc33a1-88d4-4e12-8ede-b3966b05126b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455611, "uuid": "3b23e070-ae81-45a9-97dc-cb2d12f6bf41", "value": "Arrival Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66191143-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528472, "uuid": "1c96e8a1-a0f5-4622-bd42-495b3a5abd66", "comment": "Malware payload (Mirai)", "value": "8acd46b64c36f3ff0645d9ce45e74392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528472, "uuid": "54172127-358d-4eb5-a31c-9e2338d9e544", "comment": "Malware payload (Mirai)", "value": "57e9a77bf7f0e23645a6bac328ce704a7323ab74bbf380446872b877e32ee12e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528472, "uuid": "50574bd0-723d-4035-ad76-c91e2fbe507f", "comment": "Malware payload (Mirai)", "value": "a9c3ad8b5bbbeaf1cc2923a916ed43ec6ad0c11b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528472, "uuid": "f79d584a-7862-4049-b621-ec54cbca2749", "comment": "Malware payload (Mirai)", "value": "ae0077474852176d10a4183b0f05481987e009e6673022c7312b4f554a07f17d9214ce393f5b98d6bdb67f587ee96150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528472, "uuid": "8ac935cf-688d-48cd-b4bf-f6bd2176de04", "value": "T13D03E146E871B41EC91F1C3F238E11AA1AA0F2CA71066B275369CCC5EF37D5B94DD8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528472, "uuid": "3d46acea-b684-4825-a0a7-cba8f3341f03", "value": "768:tF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0k+MTOfWV:zl5JnsrXvrKy9QjyBZLvDmR0wSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528472, "uuid": "d1c3eee2-b8f5-46e4-957d-48f84c2085a3", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528472, "uuid": "e738d489-8b49-4973-8121-a039e27fadce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528472, "uuid": "e32c959f-3773-4886-831d-ef97514e4476", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b079829-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Ladvix)", "timestamp": 1752485101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "8244a815-1679-40fc-b776-124447caba43", "comment": "Malware payload (Ladvix)", "value": "c728c589a1ae9defc491c8d61b41d649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "5ef3c1fc-fdbf-4a6a-a0c5-82affc518cb5", "comment": "Malware payload (Ladvix)", "value": "58dbe59f3c201218bc77c2757f4ba66334c8657464dc06ae61354460499722e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "d103819c-984d-4d0d-bd76-35f03d8b60e9", "comment": "Malware payload (Ladvix)", "value": "32b80554ccab4e33137d6649b45ea8d2f0b0f83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "9f96a106-e620-4649-8236-a214b0157961", "comment": "Malware payload (Ladvix)", "value": "d4dd69cdefcc4c0ad30e2a59d795d2a81bd828936053714771a1737588c7c8693a8cc6e2cf9bd50d17155b1dcd5003bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "246ca66a-a1f2-4a89-8616-45d880b31837", "value": "T1A5D2D75BB6609E39C0C5D3B049DFA1B0727374F4A722620F368AB3717541B889F1E6A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "862c5c10-c3cc-4f53-a2be-2173a0b3284e", "value": "384:BWskamFsqGhR9jExKlNUSHNnczUIVA7QvOMy1+VEG48lMdrPFOoCNEVH/gxk1:AFTaLRREUrtHwdOW2gxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485101, "uuid": "fe1636cf-e759-4bd9-b3b1-05d3add68f0c", "value": 30068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485101, "uuid": "bf864e86-f917-437e-9eb1-e02eb7e8ea0a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "f7b3d9d6-5e62-498a-b7b6-27fc6997a4c6", "value": "mig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995c721d-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494628, "uuid": "71334771-e328-4c4e-884c-b821b3f7b203", "comment": "Malware payload (Mirai)", "value": "a78a1064cf9768f47fea4a606a29ea10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494628, "uuid": "06472015-e877-40e2-892c-a74b0d2d811b", "comment": "Malware payload (Mirai)", "value": "5973636a79966ff94e4a3631e0a23ade49ac08d59bd7839a360586c4f53780e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494628, "uuid": "830dc417-2aa7-4211-92a3-f2261870e87b", "comment": "Malware payload (Mirai)", "value": "3e8f1cf32db8718790265b0b3aa0bddfdacf2ced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494628, "uuid": "3418c895-a0c0-4405-81a9-ea4606f6c6b2", "comment": "Malware payload (Mirai)", "value": "47a04525eab1ce7fb878ae255a593f68479f23fef7fde3c6a5f7a11637c31c876ac7f8349ca27878179780ca65540413", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494628, "uuid": "bc7b5c78-933f-4230-b454-eaf8f2fb6853", "value": "T17EC35A23D8292F58DA65D0B4B074CF78AF9389A0814B5FBA65B7C2754443DCDFA04BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494628, "uuid": "e3387c88-06fb-4cbf-810e-550b2ac225b7", "value": "1536:/W0aolSmaFUEYf1DpdCRlClxKqbIKbAzi/X6n3MbW49fPHleyFQRn:/vlh5H0lIYkD/XeeWGfPH+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494628, "uuid": "a777523f-8497-40f4-96ba-8f2057be231f", "value": 122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494628, "uuid": "a1df4b82-7318-4b5f-9820-0027cf2490b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494628, "uuid": "922a4aa6-0949-4500-a7d5-3bc127c84917", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d019424-60a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogStealer)", "timestamp": 1752490097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490097, "uuid": "4e61ecf4-3522-4b36-8577-72382d4b769d", "comment": "Malware payload (PureLogStealer)", "value": "aa06d06ddb6d3801c70cc1991f393112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490097, "uuid": "25828dbd-d9bf-42d0-9253-f246bc575a49", "comment": "Malware payload (PureLogStealer)", "value": "59e0c91590bbffbe1ff3ff907d14ff66199160cf4455a45d52e8afa20dc11fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490097, "uuid": "956fe1e5-ca15-4cd4-aac8-ec38c4b008ac", "comment": "Malware payload (PureLogStealer)", "value": "47662adb2b9ad8bddcaff0639838f030e7fb46a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490097, "uuid": "5002854d-8442-4173-912c-1817df5298fd", "comment": "Malware payload (PureLogStealer)", "value": "77b55e1bc720434ff8635edc8714cda02ab93dbe0a636979ad7f13e9bf9bb91ddf1d19c80e51243e2d47e92ce9d601df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490097, "uuid": "9050de5c-31f0-4c75-8da4-9b2e26ada34f", "value": "T1B4B2E646E13C4523CEEC0F7958A7777542B3BB33B086E35F4ED5E69A2B423C64400AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490097, "uuid": "638a0036-c889-486c-b08d-518dd89f4ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490097, "uuid": "177900e8-4ad4-42ec-974d-357aed993cab", "value": "384:vtCAzIvkyIm5nTFrVliunInTFlk/aiOZ8Dlspxi3hBbN5:A2oz5NiuInPv8Wpxi3hBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752490097, "uuid": "aa363cbd-f464-4708-bdf7-28e1166a0534", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752490097, "uuid": "773ea0df-50a3-4088-8581-ecd1df8c6181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490097, "uuid": "628abb15-b923-4b8c-8321-1a981ae2ea28", "value": "087652432456728726542324256728276254234256278272654232452672272652425672722262272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95c1718-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515727, "uuid": "13ed34e1-f1fc-4023-b438-d77c38c74840", "comment": "Malware payload (Mirai)", "value": "98d6c8e585ade404e693dc9de3c5b832", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515727, "uuid": "c7ac519a-a5cf-485d-b4cd-96fa1985ef50", "comment": "Malware payload (Mirai)", "value": "5a1863dfff1a5e83d8ea34c6fc7d24762e3063c9a02e5ea22d3f68a5e639a7e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515727, "uuid": "96115583-3515-4dd1-bdd2-a7654ecd91f0", "comment": "Malware payload (Mirai)", "value": "5a6cd2c0f91b0ea9be36df5dc7bcd02764d56c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515727, "uuid": "b54de940-022f-4a7d-83e1-0f365317249c", "comment": "Malware payload (Mirai)", "value": "73b31a0145278fc01b6df7b6e2411356d4808a095699575f79b31fb3266f2f4980fb0833614f46c38dd7222753b77cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515727, "uuid": "54bc52b3-12b0-4587-a0ca-0feb92d02eba", "value": "T140533A17B941C0FCC59DC170176BB63AF673757D0238B3AA3798EB126E8AE214E5E640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515727, "uuid": "c1131eee-63d8-4b6e-a108-5106b5160e8f", "value": "1536:uzGIfL8YS4+Q41druM/iI8jOU9EyhKbjxeSGs+0C3O30A:GGID8XBQ41cQM6UDK4SGNO30A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515727, "uuid": "9a905dac-9f82-4698-bc6b-ec2a04fe409e", "value": 63264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515727, "uuid": "11964e91-56f5-40de-99e5-ede632b48acb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515727, "uuid": "c0ab0ac1-5c7f-4fa6-8525-2d2c58f62522", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be538e6-60c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752507758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507758, "uuid": "662b011d-8918-437a-bcb1-ae0a5f05385a", "comment": "Malware payload (Mirai)", "value": "99c4ce3c79cfb36106dba19fe4c4ea43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507758, "uuid": "da718d28-8dad-4333-b990-289486f2b456", "comment": "Malware payload (Mirai)", "value": "5a6283ed8045505c7de916d77ffcde8b175845cc51249f4ced21a8e9f1b7d772", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507758, "uuid": "934e57f2-1f37-4483-829c-9120d21fd044", "comment": "Malware payload (Mirai)", "value": "617545bde5200701dafe66461290dc3edca59ce4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507758, "uuid": "43c9611a-6609-40a5-a040-6e0b8e6e9d5b", "comment": "Malware payload (Mirai)", "value": "7af314fc1101eebf993149a50518d6dbaa87e3df6162dfe573750c32aabfd33f9a63b4c099d2863cc3cbcb99f1396a3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507758, "uuid": "ee20551d-0dc6-481e-8b42-d0ad23a76e07", "value": "T148F03ACD066A22351BD3EF0B53268884F3A4D494F9634DF85CCCE9D1B895DA4286CEED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507758, "uuid": "1b59987b-3ae3-4967-b4e8-6d05a4261500", "value": "6:lOnFflE0FNHViMxDHViMBviMuiMTyLcbnMAMQrAgOKPcbZusCtnD5MAMulmAC5M5:v0FNH9DHaTNnrL1D5N7Q5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752507758, "uuid": "2822d8b8-3e10-4d33-91a2-fade9daa00db", "value": 528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752507758, "uuid": "5a201d81-e430-4aef-bd8a-95895cab1506", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507758, "uuid": "7fdf81f9-ef9d-48a9-aa21-c6501367fc29", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43c3ccc-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485197, "uuid": "4bdae536-7670-4599-af4b-2ad2a5ff9cc7", "comment": "Malware payload (Mirai)", "value": "db633a4c36f5c70a043ee22c01ee380b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485197, "uuid": "89c8ccfd-44c6-45da-9a4d-94bc244839c5", "comment": "Malware payload (Mirai)", "value": "5ac94f5097968d96c31be952846fef188ad6a53e74c586666c6184ba9186dd41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485197, "uuid": "4173f062-8723-44bf-8a3e-7703bf90fa00", "comment": "Malware payload (Mirai)", "value": "1d5e4b09661cd9ba84f4d1b59eb80f38d293a932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485197, "uuid": "ba6351be-bed6-4d7d-a775-d6586b05bf31", "comment": "Malware payload (Mirai)", "value": "782aa6d2e5f5c6212994378f3af07f5b3a44385f22079347810cbd6bec77f36e131be2ddb9faedea4f7cef05561b6f56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485197, "uuid": "60ed4991-5848-41b6-acf1-919c30e492fc", "value": "T15EC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485197, "uuid": "0868df9b-5428-4d18-8692-cd8660c6fddc", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHo8rScVM/9OAvjik:cowpuQyNSG24a1styKdlTuI8rSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485197, "uuid": "f25d6a7b-5976-4d1e-b43d-99343ff78f4c", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485197, "uuid": "efbe52e3-8dd9-45d0-ad0b-9e19da825318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485197, "uuid": "ebe8138b-588e-4abf-b178-ac724f303c80", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be446be2-60a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493831, "uuid": "446cc6f3-d81e-4ed6-9584-f82674e420d2", "comment": "Malware payload (Mirai)", "value": "9fe78180d8cac7362fa190a55d0d4c6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493831, "uuid": "ab4644ba-3a75-4aaf-bea4-c8fdbb0cc326", "comment": "Malware payload (Mirai)", "value": "5b26eacf09c0af0415e3e3f50b410d1150a8bad792bf2f573808b5dbd2f0fd1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493831, "uuid": "93c0b243-1e73-4d8e-b3f1-557ce793569f", "comment": "Malware payload (Mirai)", "value": "5e097c0b7ee1f5d33cb7aef718145ccf55ebe30c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493831, "uuid": "92057307-657f-49e2-af40-898f6f445214", "comment": "Malware payload (Mirai)", "value": "5a375ae4a14d34b9cbc6e6bba1054dfe9fa83d233321d5034b961a45268fbc563214e50e87806bebb07a66d2f2325271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493831, "uuid": "999d2718-c730-4dc8-9210-65d4a8f5c80e", "value": "T13F93A409BFA15EB7DCABCC370AE90B4238CD665621A83F767574D418B24B24F16E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493831, "uuid": "16e1351f-f373-45b1-932a-db6033d01ba0", "value": "1536:dXppn6b1B13862HuIT78zwtw89qU+ydhDSbDZ5vs4T0M0IyM2:Jpp6b1DZX5b7ydhDkDb50Iyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493831, "uuid": "ee5e98ca-41cc-4a69-a098-1e13b4c53dbe", "value": 97388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493831, "uuid": "e3385a73-0b9e-4b9b-b72f-c20f298d1f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493831, "uuid": "2936c902-5b3a-4915-8de7-f8b1409134b3", "value": "top1miku.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e091626-6048-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752452411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452411, "uuid": "36c7f981-2c73-4d17-8b18-432f2f80c9a5", "comment": "Malware payload", "value": "844d478499a2dcc4eb1a77d99ec700e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452411, "uuid": "95e8f8bf-049d-46bf-9951-5d81dd29c367", "comment": "Malware payload", "value": "5c2fbcf4721ee4d2d9477a186e7d8924a03db047543ff61f87f184882f187e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452411, "uuid": "6cbaeeca-fee6-4eec-993c-361cf49dc421", "comment": "Malware payload", "value": "50164f7665767506fe3620a042b94d8de3a14136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452411, "uuid": "30f1e7a0-2645-4895-a570-fffbd75b3a77", "comment": "Malware payload", "value": "5d84420d23df1fee155d02928bcd0472b24f70c156cc6b4afadcf40fdbe1dc76db6606e05039902c88c6f2ea7a5cfeb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452411, "uuid": "dfcf50f9-ed67-45fc-a405-ea3888a6aed3", "value": "T12BC42241EAB7C0F2F65349320103E7BF8F33C9099165D296D742F661EDB1B428A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452411, "uuid": "a03b6366-2b65-4a31-928f-55dc52fcdfd6", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452411, "uuid": "fdd5a6f1-7dcb-49d6-8360-b42d5a8b419a", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452411, "uuid": "3c836730-1525-42d8-b5c3-172e85693dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452411, "uuid": "bc485f4a-2835-4113-8e36-9e84590db803", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a60ab44-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480000, "uuid": "c2ea877a-9885-4fac-ab6a-7022e0864d49", "comment": "Malware payload (Mirai)", "value": "9486fb306bfe4fbd913b95861e9c6096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480000, "uuid": "74b599c9-87e3-4a35-95b1-38075390f4d0", "comment": "Malware payload (Mirai)", "value": "5d0b05171869c2ec854b2d7ed3673f759b42c8b0f42c027646e49ecf2938aee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480000, "uuid": "713790e5-efbd-4a2e-b53e-93b9362e754d", "comment": "Malware payload (Mirai)", "value": "6e6309d116df718018f9685260563df295ebd111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480000, "uuid": "8699c696-cf3c-4364-89f8-924cfe2502d1", "comment": "Malware payload (Mirai)", "value": "71318a945cd1649ef35ddf8a62f6bf532e17ae2e202388b7c68c3804c7e62eaeb582c7561fb20138c63efa6484369380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480000, "uuid": "1a38c214-b9c5-4867-ada2-edb1a559e610", "value": "T1CBA2D1B97669A971A5B14C75FB18D7C633FA4739F2F0B0CB04C242B9DD8781624B4B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480000, "uuid": "8e1959e7-1c53-4d87-989a-ea31a5d6da6e", "value": "384:N77KHj+GGdBXSjkHtvzYZSBhyRrA1Ko7K31Vave2yBsAhymdGUop5hC+:QmBCjkH9cRUko+31UFeds3Uoz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480000, "uuid": "b3cac1fc-9d66-46a3-a39b-ebbf4816bc1b", "value": 22892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480000, "uuid": "ef84ea47-4616-49b4-8f76-0541dc677328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480000, "uuid": "d7fcb106-1696-4bcd-bb37-a54ba1b3f526", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5872e77c-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485070, "uuid": "929418ff-9af0-4f67-8cb6-44aa31a7bdcd", "comment": "Malware payload (Mirai)", "value": "a172b058166d13acebfeb15f7ed7210a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485070, "uuid": "1be14a09-3b9e-42cc-8cf2-755bdb34f8dc", "comment": "Malware payload (Mirai)", "value": "5dce8dae1739bbe575e2f93746f55af3d108490338e905a34aaa7fcd4f976a72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485070, "uuid": "2c3d9c7e-a969-4a05-bf5a-f9aa56759a81", "comment": "Malware payload (Mirai)", "value": "52482e402a9aaca2485ea41fb5f95371c020a44f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485070, "uuid": "a120cd08-abbb-466c-b85b-1c0462e417b7", "comment": "Malware payload (Mirai)", "value": "5eeb5b4186272f6d54b0f6fa96e9c044da1553a0a97f90fadd15e4ed8307326bd17d6c1d533c1edfc96529f770956efd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485070, "uuid": "edc331c3-9a5e-4680-adec-7586ce937f8f", "value": "T1E4E2F1E3952DE47CE53351FA087E8439FE2B16212F4F03AB608C61EE4BBA9932515F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485070, "uuid": "0ad3dfdb-c66c-468d-8dc0-da97477c6ffc", "value": "768:zMcuAgnLccSvK0sVJA8VOa1TrvZz9ao+lEQ8dx096:zMcuAgANwVJA8zrhzoi+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485070, "uuid": "f98af27d-8216-46a3-9268-8180ae08106d", "value": 34144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485070, "uuid": "ac8647c2-2d9b-4564-ad94-d91209cec161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485070, "uuid": "1835133d-57ed-47b2-955f-0381fcd02cbf", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65624b28-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485092, "uuid": "9b9176df-14c5-4b8b-b02b-3eb50d2dce8b", "comment": "Malware payload (Mirai)", "value": "770b428cb2b55116e37a604d0681f480", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485092, "uuid": "fbbf20f8-0436-4c46-a77c-8f9ad7a4bd03", "comment": "Malware payload (Mirai)", "value": "5dfb4325bdc71a4c67a36ee4fa9c6df0cc317059d02ce23eb65592eea0d605fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485092, "uuid": "01732339-c01d-43f5-bdd6-fb29ae0b367c", "comment": "Malware payload (Mirai)", "value": "ba09c9185cc72a02591e887a9bcacf7f731f9dd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485092, "uuid": "fc43b55e-67f4-4786-b1e9-5d7f75230359", "comment": "Malware payload (Mirai)", "value": "08c74b370d12c96f7eeef188f853706dab5979b2558149b95bf40c26ab61bedc1a37548a4a937437ecb468598915b8da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485092, "uuid": "540b4577-9e30-4d52-88e9-e92820423b2e", "value": "T15643F9227A3A1F13C0D2A4BD12FB4B15B5A1AEDF19A4C64E7D721E8BFF105C06942DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485092, "uuid": "53bef9ce-f18a-4d02-88e3-fe665aeb4960", "value": "768:sqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwy:sqtmZPuutfbltZFBSJsBcfDSTFI+BEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485092, "uuid": "c6ea1def-2af8-4fb7-a195-c5095e260b3c", "value": 60356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485092, "uuid": "b0db3671-3a73-4b23-888e-e25fa13c202d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485092, "uuid": "dbae34a7-19c6-4ef5-b7a5-9b7e779c2070", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960894f1-60a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1752493763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493763, "uuid": "6c89f54b-8bff-458e-b34d-4008ddd32d72", "comment": "Malware payload (Hajime)", "value": "d2b186f3136097a3515b93c00134483b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493763, "uuid": "4f308830-c0f9-40f2-adfc-b2f406abb5f1", "comment": "Malware payload (Hajime)", "value": "5e0b510e6237e9e7823e1c7b0713949fabecc88e12f5d64a23b570a32fbeb684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493763, "uuid": "bdcc1942-8936-4c79-9f38-900e3ef450bf", "comment": "Malware payload (Hajime)", "value": "0c65b873585fc36da822bf4c6e049659cd1fe408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493763, "uuid": "7c0950b5-90c0-407e-8b90-b6c8fb638388", "comment": "Malware payload (Hajime)", "value": "bcd77c5d6d7fea2dc407fcc2bfc73cd006f6af640aa17ff26ec5d864c9fe49025cb4d424356b6782c39826d87c2a5c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493763, "uuid": "c2800e0b-1d12-4b7b-a858-486368c5ece8", "value": "T12463124623A92961527145F1E7FD6B8CE20D3A588FF16C246C227CACB83236E5CC8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493763, "uuid": "4c3b5eb3-38c4-4a92-8790-1df79de443f2", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2J:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493763, "uuid": "36ef31f7-76b3-4b21-8a1d-31674688fd28", "value": 72252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493763, "uuid": "b9d02fd2-a9a6-4f3c-a601-bc0170c13752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493763, "uuid": "a125abff-0c49-4108-8b0a-d68e688d312a", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3911629f-610a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752535698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535698, "uuid": "797f6075-eff8-4ce0-b951-acc18184879d", "comment": "Malware payload", "value": "1bf088fd5abe69fe46dc08a06c16f702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535698, "uuid": "0cd0b05b-b785-4e61-80e6-8e2493ddf2f5", "comment": "Malware payload", "value": "5e851d3704d6cabe54ab0fdb5ea6eaa6b92a814a03191bfdb9c080052a127d0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535698, "uuid": "2ddb1e91-4e48-4b79-9940-5ac7bb8c4d44", "comment": "Malware payload", "value": "ed1cf38dda6f2080247b0decdf1e2f7b60ced7dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535698, "uuid": "dcba44a5-24de-4b28-b753-997c7f37d67a", "comment": "Malware payload", "value": "f6f4101acd17726237657a4e8e52cf3cb7780207d059bc8de9925d82b63a8209a9e96c3d40771c0dd5b8f35725b35b59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535698, "uuid": "fe1b7c3f-c0a2-406c-93df-ded58d5a6587", "value": "T165A30796B8819F16C6D166BBFE1E42CD33131FB8E3DA32029D146F2477DA95A0E7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535698, "uuid": "6c5dd587-f65a-4e96-b81d-fe43eb17605c", "value": "1536:YHnK+SZPJalCwPwxGawJKQpL/Ne2YNf/8uL4IOau+P5BPYKYup/xRB0VsYIGYS2u:rraAewx2J3M/KH+P5BAKyVs104no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535698, "uuid": "c9671d91-7277-4a55-9da9-a057fa83bcdf", "value": 106696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535698, "uuid": "d723ed0a-2521-489d-ba4e-09891f72e3fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535698, "uuid": "c3493350-b34d-4548-9c82-10d35b9a87d8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46101d0-60b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1752500713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500713, "uuid": "84dc06c7-bd59-43b8-a647-f405cc399347", "comment": "Malware payload (SnakeKeylogger)", "value": "a2102a0d228e48b45bd3492b34643ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500713, "uuid": "b96612cd-0559-4692-8f57-8f96d3f59939", "comment": "Malware payload (SnakeKeylogger)", "value": "5ef6ec513cbff82ef5e357753db46627351be6fe83d83fe05485d06330735849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500713, "uuid": "db8bb3ae-5494-4584-a503-3a7091ace959", "comment": "Malware payload (SnakeKeylogger)", "value": "668dc8d75067c0bfd2ee5978c68cab1f4c1b6209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500713, "uuid": "610d2f57-b5a7-4239-8e71-45c699421f92", "comment": "Malware payload (SnakeKeylogger)", "value": "f8edcf9015d5ddd34e9e588506130e3bfeaf43a7a6d628a44858da8ad0b69a267c24d92a999c61a3e8cadac422fb8d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500713, "uuid": "b5ceebac-b779-4a90-b639-81038ed782ca", "value": "T19005E12176A59F01C57A43F91660E73147F26DAFE42AE30A1CC66CEF3D78B850E12693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500713, "uuid": "6a14e95e-bf44-475d-9264-94e33a114a81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500713, "uuid": "0df60aa2-66fa-4aa9-8b06-6e2dbb28fc65", "value": "24576:MmF9phhf4edaJm/hmMFnuRXZOhO1/elw4jGY:X9DhVaJcmEuJOhO1Glw4jGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500713, "uuid": "b0f10439-2c09-4509-91e0-34af99d5d1e4", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500713, "uuid": "1457f361-14da-4f2b-a5ff-a042f1ef7e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500713, "uuid": "48f02c97-9173-496e-ad36-184073a7e80b", "value": "Evergreen Invoice No. 25205986 Ref-no A7_FR787BSY.CNT.pdf 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1f9183-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (a310Logger)", "timestamp": 1752477882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477882, "uuid": "b714b1a3-fa61-4ae7-acb7-893666d2eb06", "comment": "Malware payload (a310Logger)", "value": "01c14d60460409c272f8b8ae0592b208", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477882, "uuid": "0d50a832-ac0a-4da2-ab9c-193a3f08d40c", "comment": "Malware payload (a310Logger)", "value": "5f453a582059b3c9ce3733a816b24c75901b0052d3f8645cbcac24e0607c639f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477882, "uuid": "8168c6ff-1b0d-418d-9676-acdb280231f3", "comment": "Malware payload (a310Logger)", "value": "5ac53094a86fe43fdfebeff7dd16d0d4db06b6be", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477882, "uuid": "c09da88a-a49c-481b-9422-ff831367ee95", "comment": "Malware payload (a310Logger)", "value": "4e9c6c5cbb8582d497ab78336ced4c68758180ac40e0a9aa6f8267a2a447293d49ac9f59b649abbc66cdae1394500df2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477882, "uuid": "bbbe77e3-a0ca-43dd-a86c-f54db67379b6", "value": "T136252364A546EB05CDDBABF40B21E37492740F4DE512D3239BEDBCCBBEAAE411C41252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477882, "uuid": "c1209a50-b629-4821-997b-9b3044ca9692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477882, "uuid": "33c19ed5-80be-4878-a2a6-18cea488e3e9", "value": "24576:+Ze4CtK7e7vClOJLaSahUyfzyncEFa3A5ymOFp7k8iuoTJE:Ee4CtKe7vGMLaSaHfzhBA5POFp7k8i56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477882, "uuid": "2843677f-c2f0-48f4-a81f-910abd67c509", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477882, "uuid": "1871a2db-0ff7-4eae-addc-694377d56359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477882, "uuid": "cf16bc80-0832-45d7-b11b-0ae05762b045", "value": "umqa35xV85R1QkZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af16ed32-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492087, "uuid": "7432fc1a-8ca9-435e-b656-c5857a49ebad", "comment": "Malware payload (Mirai)", "value": "d75a750da39c601b8f9fcb9835bb935e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492087, "uuid": "6fbded3b-427b-41cd-a7d9-b34cafd11ca7", "comment": "Malware payload (Mirai)", "value": "5fba33fff698de856d95dabe87464b7c785894e3b7a8370b5ce28fe9e7707b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492087, "uuid": "17754bfa-f2dc-4215-ba04-f74662f97f5c", "comment": "Malware payload (Mirai)", "value": "1a674043ba5ffa8af824c734ebf5fe269be67751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492087, "uuid": "409176e3-7bb1-4ae9-909e-8f1df2d274f3", "comment": "Malware payload (Mirai)", "value": "ee66e1fdf8ac1cbdf2976dbc055ee0f296b9cbd22362da86bc86e8ca2a64ebcee40812603cd48da95b9f00431aea4ca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492087, "uuid": "5dad87ce-9883-4a2b-915f-2a2b194f7017", "value": "T1AA33F1B682ABAD61C57052FB152DA4DD60552338E3F6F10356610470EACB2F38AFE6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492087, "uuid": "d05e979d-17f8-4ed3-b2cb-5e8734ab8f7e", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JHL9VE8amFZP7R3L:Soqs2Twh6P8JHLJ9ZP7R3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492087, "uuid": "ec090e71-a187-4a48-8b36-b26a98723bc9", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492087, "uuid": "6f461afb-47b4-47f3-bac5-43e2f72c4f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492087, "uuid": "76ee935e-901c-4cf6-853b-b620e021389c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca617b6-605b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752460730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752460730, "uuid": "0a588f73-74bf-4521-9eeb-e8e66ff3e398", "comment": "Malware payload", "value": "b26c698a5d2f8e997b509ac6a46bb466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752460730, "uuid": "a832c5ad-9151-4ecd-9355-27cd40a6dc9c", "comment": "Malware payload", "value": "600236c7f8ad118656ef4dd221cea3eb638a3b5696175c84dff646593d0537d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752460730, "uuid": "0faf7c53-dbb7-494c-99d7-8782c83e83e8", "comment": "Malware payload", "value": "d1eab40179f8eefaf68f56aa309f83d58b2986cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752460730, "uuid": "d3bb7899-023c-4b8e-a0a6-cf49e73825ee", "comment": "Malware payload", "value": "fce8df84ce144305f81c7ef7180ac871df639f6cd098d88b1e3c34f8824f8aa24ec17a5d898bc0034ed5ad717520f722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752460730, "uuid": "7d86f952-35f2-432e-8e7d-128b96e3f157", "value": "T1F2C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752460730, "uuid": "61696aa7-ec51-432f-b2c1-ff7bf9e8decc", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752460730, "uuid": "1b13dcbc-88bb-4212-9fcb-d0a332cde2a4", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752460730, "uuid": "cb1b9708-96bf-4ca6-8789-c1cda2bd8724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752460730, "uuid": "241398a0-379e-4d87-856f-527b71c07457", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cde2a79-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528483, "uuid": "8f8eb897-7948-4882-b3fa-dfa256104549", "comment": "Malware payload (Mirai)", "value": "b7ce3f5e4870cfcf8321d9a751d01487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528483, "uuid": "6147599e-514d-41b4-9908-b0f171df5386", "comment": "Malware payload (Mirai)", "value": "6041ccf14c12991c6a3a36c33b55f2c0c7aa7234acc13274df3d984f6bf14436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528483, "uuid": "8b5c8b69-185b-4f09-94e5-3fa251e669ac", "comment": "Malware payload (Mirai)", "value": "78f0143f0a135f22699ee1943b542196a3cc5d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528483, "uuid": "b063b571-e243-4381-be4c-94c9e8cbbb1f", "comment": "Malware payload (Mirai)", "value": "ccd6b507df2d0d96a7a7a4b91ebf82ba9cdd5d545225b6ee0458d20c94d1823141af4e91cd658499aa9de8bbf5e8d6ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528483, "uuid": "e16ab963-45d6-4fa5-a017-ea3ea9dca220", "value": "T1BBF2E103CCFA7F94E95F617100FDB67F6911A40159A660E26FC800AFBE87F516358B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528483, "uuid": "f7233b7f-7e09-4db6-b116-c84987232331", "value": "768:Nyn6j07PZGrTbNXW4w/c+Kca+9TuYczpLrfNzYP8qnbcuyD7UHQRjm:06j0RsTbULfU+/sJNMPRnouy8HyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528483, "uuid": "9fb19db0-13e2-48cc-9728-07bf8e0949f9", "value": 36176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528483, "uuid": "0ff3a638-9079-4ac5-9d1e-730389fbddb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528483, "uuid": "b6a590aa-4895-453d-a200-d2343eb60723", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af5b642-60ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752495436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495436, "uuid": "c0e1366e-8bfb-4b6d-bd4a-cbddde2d390a", "comment": "Malware payload (Mirai)", "value": "013f30627ccd2e7916e4bca1c9e6b76d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495436, "uuid": "a7e56e6c-3895-4bbe-8e26-8bb19725ad79", "comment": "Malware payload (Mirai)", "value": "60621ba0ef698a1f546b5034ab585c0dab9a7dcf6b090acbba380a4f2fb5a7b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495436, "uuid": "a35914a9-6da8-479f-8213-fc0e3376ac23", "comment": "Malware payload (Mirai)", "value": "2242cdf1d7ec87d1d96f540488c815b23f96321c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495436, "uuid": "e98dd641-192c-4254-9c1b-306354701c41", "comment": "Malware payload (Mirai)", "value": "69595aa9ed26247da842b1e8085465189cbe287bc55513d2332a567d228275fa5f556f8c7b73a5461f7ef006cf54150e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495436, "uuid": "46275b5d-6420-4740-9cc3-42f85fd8facd", "value": "T161E30A46F8419B12D5D111BEFE0E128E37131BB8E2DE72029D246F717B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495436, "uuid": "3dec5511-cde9-49ff-b0ba-59263b51c7c6", "value": "3072:4hUtLHVgnPkmUdBHREXS+Mm6BfZaqY5xeYd8bVOeVx4q:4hB1G3EX9Mm6dZa3xeYW1Vx4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495436, "uuid": "d8181a32-4b38-48b5-b848-f2a848f05ba2", "value": 150364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495436, "uuid": "14783d2a-de6e-4854-b42a-dfb9260fa8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495436, "uuid": "3e974ab6-67da-442d-85b5-cb77920a5908", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acb0f8a-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493342, "uuid": "433c42ef-fc46-49ab-9d52-c84bb831cae4", "comment": "Malware payload (Mirai)", "value": "49d3aed955db2dadc29945b121850808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493342, "uuid": "843c0a32-eee9-4290-971f-012fa46d4967", "comment": "Malware payload (Mirai)", "value": "606a55c5126984bad17b339130446a70e1e51441ccb945a174449d0c0705c61a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493342, "uuid": "ec91500e-06ba-4ac9-92db-12586327b708", "comment": "Malware payload (Mirai)", "value": "fa2839238c65966aa77c713323cf7ef3f1cf752c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493342, "uuid": "e4b42310-f1ff-4315-9b81-9948a7367a98", "comment": "Malware payload (Mirai)", "value": "387b53ff7bc7c1541a808206fdecf5feb46978cde3b9a795a9f24edbb34bbcd7e3af38501e015f55d21af9afde9bfeb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493342, "uuid": "4ecc4a2b-0c3b-4e49-94c1-0040cbdea30f", "value": "T196E2E05320AA5901CBF9203A49EF77491295E06C36448DDFFED4E1339522FB4BE18AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493342, "uuid": "3db16c65-4b67-48eb-909f-b5bb293b0c07", "value": "768:kqhlfGucPziXzq0I/h0oIDvkcToleE4nEs2nbcuyD7UHQRjs:su6uq5lFcToleEo2nouy8Hyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493342, "uuid": "3ce757ba-0540-4431-865c-93fe207eb5fb", "value": 33452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493342, "uuid": "06d64366-ea5d-4c47-8d42-76d064bff4f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493342, "uuid": "1e1c9954-18ed-4384-9733-9c3e0b23dd34", "value": "top1miku.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbfd367-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504651, "uuid": "8dfcb439-183b-4cb6-90ae-1fb0f68c9ae1", "comment": "Malware payload (Mirai)", "value": "152afa253c6533e134c3f0b71c21d88e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504651, "uuid": "1f0d903b-58d4-4dd8-af69-34298cd18ec2", "comment": "Malware payload (Mirai)", "value": "608a0f3c19b01a1763ef3af5f28c190e9b864e042e5d3a16c33eb2349888c1b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504651, "uuid": "a8423996-a001-4537-97ad-fcaaf9e404de", "comment": "Malware payload (Mirai)", "value": "5798831f7a66a1a576dbfcfeb1e49edabb44ca89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504651, "uuid": "6e2a5a32-5df6-464a-acba-ee61e29866b1", "comment": "Malware payload (Mirai)", "value": "a7dda6fdcf3b990d814dcfcfd55a9b824465e879d49dbeec5118017c96e366c79154e1322f645b5365f3c8c603dc1b67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504651, "uuid": "6f1a8aab-4fbb-4c2f-bc2b-6a1eec6d89e8", "value": "T165C2E19391A8CD06C863423B6F1F169B31386539134DEE1E373AABDC62464B49176DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504651, "uuid": "aab63f2b-0bea-4814-bd42-b757d095d29c", "value": "384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5cwd/DyZTYHHJC8oytPFnAqV/LlFu:45+Kcrb9VDJeIwkTYTlPFnz/rvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504651, "uuid": "1a454895-eaf3-4c31-9c57-bea132ef6fc2", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504651, "uuid": "72fc3bfa-f26b-4705-84b6-726c825078ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504651, "uuid": "23df3306-af21-4e2c-b685-78b52af0f490", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd759d1-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485079, "uuid": "0a8aab63-5663-4a76-88e1-2c4ee3fcc808", "comment": "Malware payload (Mirai)", "value": "e3798876c08ddfc5d54c594e2c16284a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485079, "uuid": "d21a7390-8cf9-480b-9b1c-0b8846df9ae3", "comment": "Malware payload (Mirai)", "value": "60d9528523a37bbeaf3753476818eb3b19749332d1ea4311c5d8f0594e1a9acd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485079, "uuid": "a8d316ff-dece-40e5-a14b-6153e6fe5da4", "comment": "Malware payload (Mirai)", "value": "46dde408ad56bbc772974cab63fd862960c27fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485079, "uuid": "471e38ce-cb51-4d9c-9363-dfdac7a53085", "comment": "Malware payload (Mirai)", "value": "5b6240c95ee3065d9ffad084fc4aea44b77ce4c801ff1a75cdfd537d884a00bf5bc132ee589dc2f448bdc5a3dc625c63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485079, "uuid": "4fb5c1e2-06d7-401a-8495-c8fcc0890238", "value": "T177E2E0E8D2228CC6EFF62FE068A0F1C43FF70DA173E489E4765A5B619609531252CDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485079, "uuid": "d6e3f13d-bfbb-464a-b47d-0c52bb469e02", "value": "768:wjvFYbnY4/p4Buo8dYwYbu8sLaT+A5Ux9lMUx4w4uVcqgw09v:wj9U1pBoHHiYCA5UDeFw4u+qgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485079, "uuid": "1c33d5a1-c81b-4f16-bc5d-84e175fe3205", "value": 32596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485079, "uuid": "0c9816df-977a-4dcc-90a6-3d6de661d381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485079, "uuid": "96cec6c8-3c74-46d2-a171-bb77959a2552", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fcd6a2-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485098, "uuid": "0bbddaf9-d38c-40a9-a63e-9d87e91c8339", "comment": "Malware payload (Mirai)", "value": "be818c8c0b2f941d4ff615911fee14f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485098, "uuid": "f06acb84-e3c8-4973-901c-6c4720333009", "comment": "Malware payload (Mirai)", "value": "61157d5f0e311956336e77a7d713f5ff13b8a67b1b331366c62331e98f8df184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485098, "uuid": "f897f395-2e3d-412a-863b-e74686300182", "comment": "Malware payload (Mirai)", "value": "45600909b15dbb64d7b562baba7e05f270dfa542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485098, "uuid": "3ea6f447-bf00-4bd1-8e81-a1213fe84e1a", "comment": "Malware payload (Mirai)", "value": "8075ae13da9f44b05e6120a49b66946fc6745c923546b6e1af0024f4a1f77616293b0481cb31c25b6e534ce603325394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485098, "uuid": "bb12ab09-3e9f-47be-926c-39e3985571fb", "value": "T1D3C2E194860D9D35EAF0103B967E5443B66BCBFC82FF7071780283B55541A2217FAFA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485098, "uuid": "49991754-f316-4d95-a732-3057b53cc196", "value": "768:ZyNUQUfhQllxL1aefkqIton21buuMZLs3Uozl:ZyWQUKljwefkRteOu2zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485098, "uuid": "86b9dd69-753e-4a28-b8c0-a353eed2a251", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485098, "uuid": "10b05ffd-decc-4f00-9f4c-b1775fb3dcaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485098, "uuid": "6554b9f0-4a5c-4d35-ae1a-05853d85b730", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218f9f80-607a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SalatStealer)", "timestamp": 1752473811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "759cef52-e2d8-45ec-8895-92b0b45f10e4", "comment": "Malware payload (SalatStealer)", "value": "7552062b096264724dedb9295e1b6f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "05fd3e60-22c8-40de-9346-724c95ff1e21", "comment": "Malware payload (SalatStealer)", "value": "6155a7595b063d90fe9a643c3af022f7c350e27617122f9731d17d247216f39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "590ca52f-5ed7-418b-a226-167d22c116f5", "comment": "Malware payload (SalatStealer)", "value": "b9dd883c1bc00569a9a56726b245e00b763cd432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "45ee1069-0cc4-4436-a7a3-9a7778733d7b", "comment": "Malware payload (SalatStealer)", "value": "cb0fc681e53a47ced60a57e21f5717c7b9b5e3bb825b40b9a342bb8c091d78d8e041062e684178b5b863733946dd7777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "14fae70d-3cd7-4d68-b715-3e9a9c28d9c4", "value": "T186E53328C4E8496CC1551273721B17A2F8E8E5397BA3F55997A4528EF2FC430DB2DC2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "3d74e503-a96a-4c8a-ba7a-b1381d51a7e6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "16ed2c7b-05ea-4614-8918-1668932ba80d", "value": "98304:s5TlYyccHHw3M8leE+9e+MqrMMCSyZCm7tsw:mlrpHOB+TTCHCWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473811, "uuid": "c11f6842-a434-4bae-95b2-8faf20b9db61", "value": 3287552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473811, "uuid": "ef07ddc0-1684-48bb-86ef-f1bd27d87a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "812625e7-5730-4f8f-9b8f-319c89b81977", "value": "SecuriteInfo.com.FileRepMalware.24106.2803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c1c463-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516065, "uuid": "e00ef2b9-d1e9-4625-957e-df94a6bc5b41", "comment": "Malware payload", "value": "4e7434ac13001fe55474573aa5e9379d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516065, "uuid": "5020ade8-348b-4c64-9ec6-2d639aca1a1b", "comment": "Malware payload", "value": "618070d597dd73c43ba5d4bde2baa93a4f6038e3279de3bafe688caa5c409a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516065, "uuid": "53ddbdb4-b234-4b9b-a7be-b31e98eda855", "comment": "Malware payload", "value": "53385e0fd7fc9c88080abf5b97cd5b84b31c876e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516065, "uuid": "f546f9d8-6f7d-40e2-9389-5ed0210ceea2", "comment": "Malware payload", "value": "525b1ea5d201b40884b17a4bde5bcb9f5c84711b83d0e09eab72074ecb1df9ed5e3e6344bb2f879799986782c7f6de15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516065, "uuid": "f0223f89-5a3c-4a2d-8819-15df150a0dd9", "value": "T10616FA7264870CA5CDC32BB890C772347F74BE76CA1A6A5A6E14C326FA635C05D1FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516065, "uuid": "ff909d15-d345-4484-a55a-9a355bb9e4bc", "value": "4d467283cf2bcd0813eae5baa1d3ab0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516065, "uuid": "7dc5a277-9ad1-4401-9006-74181de6b73d", "value": "49152:IigbvDVBZWFKrqU/G6daKd4Kmk1uLc+3IWz65hbk8oH7s9:VLKrr0k1QrDz65hbk8oH70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516065, "uuid": "f8e6c039-e8db-4b30-89f0-bba987e8dd10", "value": 4172231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516065, "uuid": "93f52ff8-e7eb-4dce-b20d-49e391115fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516065, "uuid": "2502e359-9752-4995-aac4-588ddb59754f", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b525fb3-6047-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752452003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452003, "uuid": "df3f30de-11c4-4c8e-8d5c-c3281aa1084f", "comment": "Malware payload (Mirai)", "value": "c90e72ff6f5e46a98a53e262ac506407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452003, "uuid": "edb4ed7e-e4e5-40a8-889c-75740ff6e786", "comment": "Malware payload (Mirai)", "value": "6203e0ee53a4dea03da80b7c51294336d3f9c3fd48a6f5fc9661f4ed34c20dc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452003, "uuid": "68d048d7-051e-4f3e-8265-eab08398595a", "comment": "Malware payload (Mirai)", "value": "395ff630f2acb35532bc464f592765ac438f7481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452003, "uuid": "a2b27151-158a-43d7-b9c6-824535f1d003", "comment": "Malware payload (Mirai)", "value": "f531fbc2617bff75465d876b9334d9262a7e26ae76a689a460004ac779d12fcb31d338a051c0084977a5cd616e8b47b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452003, "uuid": "6d707ce5-520e-4701-a309-75f3c1a70571", "value": "T14E8329D1F9459A22C2C545B3FB1F5289775A43D8D2FA3203AE388F90774B85B0E36E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452003, "uuid": "923a5507-0e52-4e8e-be9e-b67fe4ef0f7e", "value": "1536:B5eqLqo8Mkem9zISnrA/whKYrRYKwXA37lmVxOu84Wr:BomO3eiznrA/whFweAYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452003, "uuid": "a8c1fc0f-f723-4bc5-8ba1-d7d146cc032d", "value": 87480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452003, "uuid": "181e1e4f-0189-46a3-9d50-8fbb55237253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452003, "uuid": "453a121c-5b28-4f42-bd11-4d6036fce4b4", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c21477-60b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752497138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497138, "uuid": "647e5328-c814-4e4d-af4a-97171ca5c65c", "comment": "Malware payload (Mirai)", "value": "afce27c7adfd3dcd3b16f6c54e2e44db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497138, "uuid": "f5dbe67d-1a07-4a03-8f50-900ae25e7984", "comment": "Malware payload (Mirai)", "value": "6203f7c2020fa458e3fbb65f1eaf48198354b3cf1c49ba848c8e11e8662fc2d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497138, "uuid": "2fb0e2a4-9031-4a69-9432-4fdffc36efa3", "comment": "Malware payload (Mirai)", "value": "56b6c723af4c943d01715c62f555c23f84351a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497138, "uuid": "8aace102-055c-4f5e-a926-05d1beac81bc", "comment": "Malware payload (Mirai)", "value": "207bfed3aac7f1194b6e038327aa80bc807a0c860123150ee4242a51afcaaa56c883d029c1ba498af3334e989fa63798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497138, "uuid": "cd87ecf9-9db2-475a-9d54-6af931af8865", "value": "T178735CD9A8025D3CF85BE6BD94220F09E924231557D30F2BE5AAFDD36D731689E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497138, "uuid": "a34c0693-2989-4e9b-b9e0-c35c2ea6390a", "value": "1536:jvXzeOyllm0KfPKizrqw6agTLfKRslO8A5:jvjeOyODV6w7PROq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752497138, "uuid": "6715fea4-ed0c-433c-987f-ab0f2e4d5663", "value": 78808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752497138, "uuid": "7ddbe9ed-1cc0-43ec-a3ba-2311ba87f382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497138, "uuid": "16a627fe-e707-45a2-bb68-30622a367fb2", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b543ff96-6087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752479642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479642, "uuid": "9a7c8e83-84cf-4298-9d8d-84cb3019fd47", "comment": "Malware payload (NetSupport)", "value": "637631bfaa54b10f8ebe7671ef959ff6", "object_relation": "md5", "Tag": [ { "name": "45-147-196-90", "colour": "#0FA2DC", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479642, "uuid": "3d9ca216-1835-4337-8226-16b2ae2b47ed", "comment": "Malware payload (NetSupport)", "value": "62200896c34805252c0d6b0356e5bf534fb81870a6382398d13d7282d57dd775", "object_relation": "sha256", "Tag": [ { "name": "45-147-196-90", "colour": "#0FA2DC", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479642, "uuid": "7df154e4-cf81-4e93-a457-61fcff32d316", "comment": "Malware payload (NetSupport)", "value": "d19c537867d1f9a782aff9c20c37c8b38224af7f", "object_relation": "sha1", "Tag": [ { "name": "45-147-196-90", "colour": "#0FA2DC", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479642, "uuid": "4b7180cb-7ba9-4517-905e-c03788d41a73", "comment": "Malware payload (NetSupport)", "value": "268ad2664ba4d6c00ce15b3247ccedc686763e9a7d43371a0a2105152c8629c237b4f94724287a4fa9cb9157da1b8eab", "object_relation": "sha3-384", "Tag": [ { "name": "45-147-196-90", "colour": "#0FA2DC", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479642, "uuid": "fe2f5b87-59f9-411f-b961-ceacad245d5b", "value": "T1E2A53342FAA2B408B987493BC10D75DBC6236EC8BE65637F43BCF866275BBB0441558C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479642, "uuid": "01ce4c5b-5a9e-4548-8e31-174f441ec8b2", "value": "49152:zwpOhsBLCdAzBoEfXz2qRNGsIZT9l9scauf6ad:EpOKxAAzB3RMt1ld5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479642, "uuid": "43d918a6-13d2-4a18-b030-1a2f386396c7", "value": 2229814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479642, "uuid": "193c679e-8ecc-4030-a5f2-673882156103", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479642, "uuid": "c6233d3d-c14c-4036-8e6e-b618e11f07eb", "value": "62200896c34805252c0d6b0356e5bf534fb81870a6382398d13d7282d57dd775.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e54eae-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752503943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503943, "uuid": "845390b9-ca7b-40ca-a903-9e3e46c179c8", "comment": "Malware payload (Mirai)", "value": "4381cb14f8241731518d3f1015f2ded6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503943, "uuid": "6be29bf5-449e-4fc3-9b73-4d192182fcd3", "comment": "Malware payload (Mirai)", "value": "6232af383cc21593d4fea6eb90253cb02e48be87944ba2093991378cd44b832c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503943, "uuid": "9e86a3b1-3fcf-4f5f-8087-30c31c2a37a1", "comment": "Malware payload (Mirai)", "value": "ed13b775eac4402b99f2590c5aab15d5be53ad58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503943, "uuid": "ba28ba1b-5ad7-4459-bae4-c40cfb208087", "comment": "Malware payload (Mirai)", "value": "7c85ed20daf1c010052b2d37bf50e26b66c12f4f05ab5edf6a9a8962a856a216abf7b168fcb8a2db59d97b007b975886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503943, "uuid": "57d91a76-025f-485b-9bf7-8a730403f097", "value": "T1384317A6F9819B11D5C1157AFE0E124D7313077CE3EE7326AE24AB30678756B0E3B41A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503943, "uuid": "8548bdf0-3445-4d17-bb6c-39ec68cd2a28", "value": "1536:KBneYan4u+yiGcATrd73O6/hh+5lbIFHUIG6scYs:+aFcATpbThh+bbIFDHsc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503943, "uuid": "d617ff76-a518-402a-b5dc-b747b435efb5", "value": 59184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503943, "uuid": "3148bffa-6c6f-412a-bbfc-b21fcfbe447a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503943, "uuid": "c3ddd652-a20e-4ae7-a045-2f4ef95c8338", "value": "proxy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885e9d1e-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473554, "uuid": "7cf6a474-bf31-40fc-a248-1c7e91fcc717", "comment": "Malware payload", "value": "9d58281a899769933f0edbf7e668be08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473554, "uuid": "3fe33e02-93b9-40a5-9c2e-3bb21ab3589d", "comment": "Malware payload", "value": "6238ab4df9667b528e874139f44969bef22a1adf3cd2a32a71abe4318f67f4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473554, "uuid": "ab9dab27-95da-4a0a-831e-0ff1def355d5", "comment": "Malware payload", "value": "0d0905ebb53b5e5ad77b6cc382614efa6d0fdc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473554, "uuid": "4a3a92cb-5ea5-4fd0-a553-6ce79e39368c", "comment": "Malware payload", "value": "1b43ff4143db823eba0bf12c5089747f7155ebd9551e457ebcb8076b95aa08b28ac30d14050d38ce3b176bad7d1bb47f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473554, "uuid": "018e73b2-b94e-4681-bb26-561497508edc", "value": "T142663386F6391E95C82B823C5CD9283AD69FA984CC758E5E370847186FA3734D6EC335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473554, "uuid": "a71361aa-ddfd-4d50-8c74-1cf7393c6f2c", "value": "bef32bc3c601da72c39fe969ee4f6925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473554, "uuid": "f312f6fd-0efb-43af-bf30-71834dda389c", "value": "98304:NCRaHWk0aId90loXQ5EEC0fhRIgEEFTbdaw0+Nchvb2pviuk05YdS47U1/b4K:MMHWWc9kowC0fHjEoTbpYEpv995Y4b4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473554, "uuid": "6dd0317b-35c9-412a-99c5-b2f0712c7d22", "value": 6874632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473554, "uuid": "b3b3adde-8597-407d-a7db-aaa4b769cf4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473554, "uuid": "7178f99a-5f0c-4035-be86-fda991c385fc", "value": "6238ab4df9667b528e874139f44969bef22a1adf3cd2a32a71abe4318f67f4b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0bedbc-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504650, "uuid": "005cbf51-78b5-4806-a191-54cf054960c7", "comment": "Malware payload (Mirai)", "value": "a484fdb6dd068fd5b51eec29a1b52c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504650, "uuid": "ad99e0d9-9013-47da-93cf-25c60683c53f", "comment": "Malware payload (Mirai)", "value": "625a290053a117e46334965fee58d44e3173cc754559e3b0b51a268a59f2e183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504650, "uuid": "d4573abc-371b-4619-a745-969b3dc81df3", "comment": "Malware payload (Mirai)", "value": "f81ac01a0debd929772a221462141a829675c3fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504650, "uuid": "297385d5-bbe0-461b-b6e5-d989d7fe1a38", "comment": "Malware payload (Mirai)", "value": "03d3f5e0e46949f9f8725a172e29975195b70ebab3000f0c7671b1271eca22e793870d576a8f9a6ec54e098718cccd57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504650, "uuid": "02a3d273-edf3-465c-a071-02a898092702", "value": "T1D9C2C010D9484DF4EFFD5A788E25CAC577953F6A1AA2CFA0D0C9DF6008223672F5C658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504650, "uuid": "b24be583-4b0a-447e-aa65-e41928913b95", "value": "768:4KnqLiChP7gehg2alcZjn3LW6vq8/CxHr4uVcqgw09V:4KqL1hq2alUjy6y8/CxHr4u+qgw09V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504650, "uuid": "f1c80457-0783-4354-93b4-1101d0ccd80f", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504650, "uuid": "062d6779-04a8-45a6-9432-1612acbc50e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504650, "uuid": "fc80f6ac-08f3-4565-80e7-f6895dd7441f", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8c0eee-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485182, "uuid": "83d04374-eb30-4435-b7d1-9a03b9f657b1", "comment": "Malware payload (Mirai)", "value": "c4ea669222fa783255e6b78b8290b39d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485182, "uuid": "d779b2c5-075f-425d-bc6a-cb5784ed8146", "comment": "Malware payload (Mirai)", "value": "62a7a521586dacf46ff29cc3d921a034eddb104c201337904d065d287074380e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485182, "uuid": "469f2eed-1192-4796-bf2a-121e00da3609", "comment": "Malware payload (Mirai)", "value": "36dff422b163c1d5603a59ab250f08d995df30d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485182, "uuid": "ef6f23ef-c87a-4c81-9910-560498b51605", "comment": "Malware payload (Mirai)", "value": "a90bf6f3eeb034ccb1ae981323b5110c8364979377425e6edb44d63b1a663a466077df89301593745adaa2d14ce146b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485182, "uuid": "ce1cd9dd-1160-4e4c-a510-03f167ed8020", "value": "T14E53F891B8426A39C2D1577BEDAF548E3314A7D8D1DA3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485182, "uuid": "26536efa-4c94-4ae8-94fc-ad8287064d68", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485182, "uuid": "75c762c1-4549-414c-bf3c-48741db0dcc6", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485182, "uuid": "743554ef-b4a2-4ae2-8650-b758e6438a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485182, "uuid": "178abe8d-1df4-4e68-9124-b632f6cfae86", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcb93ae-60a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752491015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491015, "uuid": "79653678-6131-4669-9655-5ef5ca1910ed", "comment": "Malware payload", "value": "198a22c99f8731da0f4b9dcb0f50681f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491015, "uuid": "25c1d68c-624f-46ac-b9bf-a25a678856b0", "comment": "Malware payload", "value": "62c04cb952892d9ee4cf26d9867e3b97c8a268aa098ed80c9aee9ea2a1805422", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491015, "uuid": "2f076c8f-a165-4bde-bf20-6da3c5cb6f5b", "comment": "Malware payload", "value": "c4e6df4ec518f1ceab966591b6f950e8ce35f3d3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491015, "uuid": "f4ec9e9b-e389-4d88-976f-d5711b2e5652", "comment": "Malware payload", "value": "68da6fbd4d50e50dedd5734b91eb6ca597a5f9de3818f2da2b4cbdab4e726df82d4f0240bbd9ce7605b28506ef026f91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491015, "uuid": "641b5ccf-9a13-4941-a6cd-a6913352d6ff", "value": "T1E93188DE1444D16AADCA9E05F3B5AAAAF48586D314410FFD9F483ABC8C8EBDD7124F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491015, "uuid": "03550cab-2210-4c7a-95f1-16990502b3a4", "value": "48:SMScmMho9M/UbMQPMNJNS5Kz/1sMpqMuHu+5MlI7hDMoLMcDMgIg+jWMgan:SL7Dbfs2f7B7Jjh/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491015, "uuid": "95aa1bc3-2fb2-46b6-b40f-0082102c15d7", "value": 1837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491015, "uuid": "96b5f3d4-9fbd-43a2-b83e-ea6b8deb3fee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491015, "uuid": "45001fa6-6a02-4bce-9c0f-c2d8a4347f36", "value": "jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228e120e-60c2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504736, "uuid": "4aa320a1-a8b6-4d05-a61e-383f5cc10c64", "comment": "Malware payload (Mirai)", "value": "d40d969dfbd776bc43169a2b463540a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504736, "uuid": "516609a0-ff6e-4795-9a86-f842629a7ff0", "comment": "Malware payload (Mirai)", "value": "62e042c03889ae285c23b8195cae607cc8e4b388b8b5852b79ba55b7b75b6e86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504736, "uuid": "9dfe65f4-d49e-4d42-9885-423bbbc85e57", "comment": "Malware payload (Mirai)", "value": "1cfb2882b0cf80197ddda63f6abe73270ee5aa1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504736, "uuid": "a40f82b4-d5e8-4d69-b97d-e3d21bc5201e", "comment": "Malware payload (Mirai)", "value": "d5c9ca635af31d1a5e7658fa2c6dae8724f3486ef38ab8aa68b7fde4d2d54e83990d3aee1c1446e06ab8d9daaddceaca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504736, "uuid": "e0c92d9c-49d7-49fb-941e-1efc00d3ed4e", "value": "T1EB53F891B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504736, "uuid": "31109b2e-aa28-4408-bc50-e7bb323fb08a", "value": "1536:dn385gSW19bj2h1XBfpu2acTISDMSvhWy5lXf:dn3QxJp9ISDMKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504736, "uuid": "c8d2e1f1-722f-40c0-b80a-d1b77bdc9693", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504736, "uuid": "2b50ed4a-ae24-49b8-96f6-5eb57419de61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504736, "uuid": "8278ba2d-b4ae-4bd0-b4ab-13d1fc903975", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72959ca5-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752477812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477812, "uuid": "1f6dfa38-6e65-4404-bdd8-ee3925313dce", "comment": "Malware payload (Formbook)", "value": "3925f8e496399ba2008717b5efae93af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477812, "uuid": "b06b91a4-3318-45ea-b0ae-83b85be01827", "comment": "Malware payload (Formbook)", "value": "62ebdb98013112ee7d785d744e42ad51fd685a13191ebb22c72f3be33b5bf1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477812, "uuid": "5eb2eb9f-aa62-4722-a0a2-4efed47e0e43", "comment": "Malware payload (Formbook)", "value": "c528e3da2cf22e9eae417de185b3572b9f5439b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477812, "uuid": "5ae88c27-cf28-4af6-ae92-ccb1032d2255", "comment": "Malware payload (Formbook)", "value": "13a135ad4b58126ea93f69a8fe1f8ccf21ef77fa8683e50ed80dbbd18f70aa9e9c7e4d96763a6db3e261132cdc3246a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477812, "uuid": "fb3f8644-48cb-4fa4-86ca-feca08b1d042", "value": "T1F655CF0273D1C062FFAB91734B5AF6115BBC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477812, "uuid": "e734b632-33a9-425f-baee-333dd66a8049", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477812, "uuid": "e239a805-1716-4020-a7c3-de362b6d8e45", "value": "24576:25EmXFtKaL4/oFe5T9yyXYfP1ijXdaTCORrNx7+ftp:2PVt/LZeJbInQRaTCOR7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477812, "uuid": "89fa3107-ca06-4dc5-b653-a47533c32849", "value": 1311232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477812, "uuid": "c0b37dec-0ef0-4c68-8a0a-04bdc8806946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477812, "uuid": "18ef382e-5e69-4890-964e-ba2c0e70733f", "value": "147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d40784-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516578, "uuid": "f733fd7a-87fd-46b1-88d9-6d234eea9982", "comment": "Malware payload (Mirai)", "value": "20f2d820c7c9240f1001c52f30903510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516578, "uuid": "8ceb3b18-3dc4-48f9-b979-7f2745069015", "comment": "Malware payload (Mirai)", "value": "63bc1f26fa5963d5132b5ae18475e782163d06722e7e775e83da27d9d0cfb06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516578, "uuid": "26d70305-5b79-4109-9c9e-90c6f72ac938", "comment": "Malware payload (Mirai)", "value": "53d587a95ebafd9ffa5e99c05012209b6f76be62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516578, "uuid": "5f6e2c90-3d25-4a22-a1d1-36cf8729666e", "comment": "Malware payload (Mirai)", "value": "a86a31b4dd9c4d6dd90fe664670ad700ed1b78f5ef2fa29a6093f55eea2fda233af67f3a11e04ec14221dff3bc374786", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516578, "uuid": "9e65bce6-258f-49b8-8869-78995bd88030", "value": "T19DD31945FC415F17CAD622BBFB5D428D3B2A17E8D2EE320399255F21378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516578, "uuid": "b68e7793-38f8-420a-9e5c-29c9f16f9605", "value": "1536:GX8yRsZ2I0nWnKvhT7AdQD4VEhWTvyfHkCBK5qG40wqlY85lS8wyw4Rsi681T4q0:GXF/mK5T7B4YWrOHkC0tlwaNTfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516578, "uuid": "c51f3355-e0da-4de3-92d7-043197677fec", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516578, "uuid": "c0dbb370-f610-451e-a402-764b65354e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516578, "uuid": "5e29207f-a2c2-4842-bdf8-30d5f90f9b4e", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b07758-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494427, "uuid": "b75e7d25-0261-450c-823c-49f6f640f51a", "comment": "Malware payload", "value": "bc09cfa116cf46376ee4c1180cf8d1f9", "object_relation": "md5", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494427, "uuid": "c93104d5-b83d-46c3-9492-316b75f9f8a0", "comment": "Malware payload", "value": "63c62f1e4cdb8402d0ca7f1795934ecae2fb601c8c9aafcd8060e30129c47477", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494427, "uuid": "037d9283-c4c4-401a-b051-a66b33ae22a4", "comment": "Malware payload", "value": "0c853ac289f02134717d662f6d2ceed2b2e29394", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494427, "uuid": "eb47c206-e8e7-4eec-a598-6fcea5d96d8a", "comment": "Malware payload", "value": "a326f288f56d0270cd58e4a4d3a1a03db9f700e663b37cd3fa3dce1affa6b6e5f734659d4250d1741fdef0819ca2c568", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494427, "uuid": "a2544a59-3eb9-473d-8d97-83fe7354769c", "value": "T12D5301082AF486C8D7176AB493A541DD6D887BF0F5423C0F1B5D19A94BE43AF0B87E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494427, "uuid": "3f6136fd-617c-4c7e-b1f4-ec21ed10e19e", "value": "1536:0zwZZCpN66w+t+C1XMDy9qvBNuXm5/9G3Yq3+ZfSrSP:uieTw+f1XMDbvBf5/9GEdSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494427, "uuid": "af4b005b-f539-460f-90c2-a64c0d0c6eeb", "value": 62298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494427, "uuid": "8cac9b53-11c8-46f2-ba01-dee6b37d1b79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494427, "uuid": "ae95bea9-e8e6-4c30-9a5b-5dfe6786c54c", "value": "63c62f1e4cdb8402d0ca7f1795934ecae2fb601c8c9aafcd8060e30129c47477.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adaa0c9-6061-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752463062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463062, "uuid": "35da0359-f0e8-48b6-b5f6-956f8ba1c0bc", "comment": "Malware payload", "value": "d8a4ce0ce64843f7291f0b7dc500e7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463062, "uuid": "22f9f39f-fc80-47e3-8bc8-700864994bfd", "comment": "Malware payload", "value": "6410b4dce285ab40335bb44e9c89a79de458686464dcc9ea8efe3299272dab86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463062, "uuid": "3e107b23-c9b8-4f4f-8ff2-bcf4063e129c", "comment": "Malware payload", "value": "91729e571e823e5d37761aa682f03b9f9159474f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463062, "uuid": "3fa31859-2f60-4fc8-8fa9-6c0f11405f36", "comment": "Malware payload", "value": "2ca044b94b4513f737138b0de28be98f709e19050735f1a453225f31fe45d7aee6a4e2d8e224aa19b17376fd6c8d4fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463062, "uuid": "25f445fb-53bd-4cc5-9d3d-82478415c569", "value": "T1D59501D628446EB0DAEE4B39A27E7C1C88584C963E7A75BE3532F04047BDE8953319C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463062, "uuid": "57e45c86-6cff-40f5-a8d4-dfbfdc92385e", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463062, "uuid": "8c4c379e-1a84-4d60-ba03-852bfc4ea5cd", "value": "49152:zBYpYLCBnU+fXoxOyHcZz9iv6PuTcket9CEJ4d5awenOQUV540Kzz++BGtZUhVGI:NYFt4xgz9iv6IckeOEJ4dowenPUV540g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752463062, "uuid": "60968906-1bc5-49ef-a9d8-1a8cae6aeb81", "value": 1997904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752463062, "uuid": "a2c026aa-a2ea-42d2-b838-d349d31c75e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463062, "uuid": "277ab3d4-3993-4e2b-9253-df68b633d585", "value": "SecuriteInfo.com.Win32.Application.Agent.HJJDA7.15660.29377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae745d9-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513931, "uuid": "2c731f04-60c3-4f86-bc57-65513cdd5be7", "comment": "Malware payload (Mirai)", "value": "1c668cdeb941917beb125df47e905c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513931, "uuid": "78ae8cea-826f-4d81-b1cf-569b9a8d5afe", "comment": "Malware payload (Mirai)", "value": "650b5292f68deebbd6575baa723048990b47b0cd56daf69538978f9155bf4d66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513931, "uuid": "11c4529b-4dce-4732-b5f3-1a65ae64e0cf", "comment": "Malware payload (Mirai)", "value": "691b40ea5abe352a63c6ea629672b6253e6887ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513931, "uuid": "fd162d9f-7a30-4d98-ad3f-4624ee42eb79", "comment": "Malware payload (Mirai)", "value": "bddce8ed8b08aec6629fc03e3e93189468b696302293e9dc9394f44180881101f97abe51be6fe1801e8380fbb94fead9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513931, "uuid": "163a827a-e3bb-477b-825d-0694b634376c", "value": "T175B2D131FA09B566EA7C1D349DA8D5C3E35306D8D2FC2258664828BD7E86006947D3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513931, "uuid": "69004cdf-a8c9-48e2-b47b-b8a50d5af202", "value": "384:4Se+dgxgs8wo97ZINESk3UIgUyDNrwKXJBWmiv11RidWg6e5QahymdGUop5hvLI:4SeKgxtR55BUAs2/iv2P5Qas3UozBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513931, "uuid": "56e04dde-dff1-42c7-819c-b1cc6f77419c", "value": 25124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513931, "uuid": "99a55ebe-54b4-4e18-ae17-33cc12277302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513931, "uuid": "0fff0677-e839-4fef-b01e-63155c08b455", "value": "top1miku.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8eaec3b-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513659, "uuid": "33c30d47-0f45-4d6b-901b-83afa23c485d", "comment": "Malware payload (Mirai)", "value": "285ba8050f55b642a16b27ae5e0ed4fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513659, "uuid": "e191dce3-2072-4c46-8b17-9823cc1571cb", "comment": "Malware payload (Mirai)", "value": "656519f566896644144bf487c022994ef1870149a3a00c24a72b6ac351bdfb9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513659, "uuid": "de8cd38a-dfed-4656-9c39-7aacea41711c", "comment": "Malware payload (Mirai)", "value": "52a8f5675020e6d4fea252cdc16840d11cb993df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513659, "uuid": "5d5f58ac-6ad4-446f-b930-9880cd27012a", "comment": "Malware payload (Mirai)", "value": "c59cf7b88c6c57ba3e9e4d5a1c9c8352eba18897059f089346737c861ad09b6e3bdd7fe91a44a2c99e66218083661f0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513659, "uuid": "62b00924-2133-4868-9e4f-bec52fbc1967", "value": "T162C36B62E82A6F58D615D1B0B074CF782BA385E081475FBA2AB7C2B54443DCDF614BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513659, "uuid": "81d9db6a-c91e-4ffd-af12-22d83a51778e", "value": "1536:HcUikx+16EVWhoFXILCuPKSlFQwdQaL40bWaTg/vJxIJv:HcED2pILDSSpQadbW2gny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513659, "uuid": "9b21ad71-8979-4d41-adce-cd8d15c60d37", "value": 125764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513659, "uuid": "59286a2d-7d3e-4a51-bc4f-a2a5b3700d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513659, "uuid": "48b2b297-b177-45d1-8ea3-c740417d61a7", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8712ddf2-607b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752474411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474411, "uuid": "26399533-dbbf-4cd3-a323-0cc7475bc2b3", "comment": "Malware payload (Mirai)", "value": "694581baf1d9fc52e4f40409a38503f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474411, "uuid": "40574682-f1f2-4c76-8b83-9158062a9f39", "comment": "Malware payload (Mirai)", "value": "6572a78b0f101758a953515f5761389cc5bb3c20fde8be5e866b9f76fd9373f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474411, "uuid": "abf3d4be-b04f-49e8-bed0-6a2b83610e52", "comment": "Malware payload (Mirai)", "value": "a23bfa74cc97783d5da39fdf6101719838220cd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474411, "uuid": "eb252917-ed29-4646-bdd8-4c6a01982909", "comment": "Malware payload (Mirai)", "value": "13bebd8cf312e4176252ea46d410e05a55781572c814f7d16cda9372354c249b2334aeab4caf904d3e2bc7249c2f3173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474411, "uuid": "6bb9cf3b-249e-4f4b-a2d1-83c09239435d", "value": "T14CE319D7F900DDFAF40AE73748174805B530BBE244925A33326B397AED3A1991573E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474411, "uuid": "8e3125f4-e88f-46a4-a63b-d5274fcfe22f", "value": "3072:MjlmhLc9pfPR+/LWhqN5XFv7nV5jbi/LsIAygUbM:Mj9p+/LtNbv7kLUygGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474411, "uuid": "5bcdebf5-a89e-4509-b5fa-14ee84eec30a", "value": 151372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474411, "uuid": "d53627e7-451e-4594-a042-2595385c7aaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474411, "uuid": "79a655e3-1700-4ed2-a383-ffb036137dbf", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad77eb9-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752478095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478095, "uuid": "62ed56da-1dd1-447e-b914-87fa5149631f", "comment": "Malware payload", "value": "d48b41732c21c590a0dee6a414249bf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478095, "uuid": "124de1ad-cdda-4f4a-b8cc-8e6ef04ae25c", "comment": "Malware payload", "value": "657e20d5592eec7666308cce41f1d990aa8a25fde9da354dca922031c5192513", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478095, "uuid": "e9c8844e-9f5e-4542-a014-20022a4c09bf", "comment": "Malware payload", "value": "8c748f0f82ec82ea7367ae22cf2a5e15f60c1bf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478095, "uuid": "95cdf8e0-b38e-4f33-9b50-9ff4c63ee442", "comment": "Malware payload", "value": "31803d7d652e4c6be66172ea877aab0d735f3ff7af82ea50cde0006faafda1f4fcbecf6f194631c94103d8a707862f69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478095, "uuid": "a3cb06de-3f67-468b-a6c0-936a224889a0", "value": "T193C42241EAB7C0F2F65349320103E7BF8F33C9099165D296D742F661EDB1B428A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478095, "uuid": "40f41b16-6626-4a9d-868f-dcd7bd8f90bf", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478095, "uuid": "fcac715a-8787-432a-b89f-4aedbea4860d", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478095, "uuid": "5877fa61-3a03-4545-a2b4-f05699e6446e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478095, "uuid": "3c230eaf-a89f-4ebf-8445-ac8fcb9127d9", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5f687b-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752517178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517178, "uuid": "92763ef5-8c8f-4a59-8735-39ac68fc13ff", "comment": "Malware payload (Gafgyt)", "value": "81fe8975c395e52ee4746aa13c2cfd19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517178, "uuid": "3c779b50-7d0c-40f0-9fde-893c631e1281", "comment": "Malware payload (Gafgyt)", "value": "65f784e01b32917ea65e1c9fa83784c004423f9939775649af17459f2cc5a4b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517178, "uuid": "d7711f48-26af-4f0e-855f-c2d935792eb7", "comment": "Malware payload (Gafgyt)", "value": "fe71243df8c987843406ba0773f467ca0a9fbf64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517178, "uuid": "80e5f4ad-9f6e-4591-be7b-bca5a6e8881d", "comment": "Malware payload (Gafgyt)", "value": "805f779b34a54825e17d6c6f1bd06aac0bd69e0b36906e1d44e7e266d0a82a673d26ca5e543bff24332a2d4997d31a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517178, "uuid": "0292cda2-80d2-4183-addb-ba9dcdcf299e", "value": "T119240880EE47A0F4FD2709F14D17B23FC62067159F27DEA9EBE47A64EC239019885A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517178, "uuid": "88430277-66b4-4c23-b4ef-311677063efc", "value": "3072:VF8xdMt9wizEm9B5lpNHPhxtYmUkTK06uBqi0HhCSRGaI:wxdMt9ZwmVPNDEkTRBxtSRtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517178, "uuid": "90ee7727-769b-4633-b523-e4de2d1bbbd7", "value": 210088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517178, "uuid": "1a959cbf-e76d-414c-937d-39dd4c53cd5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517178, "uuid": "6dc4db27-ed41-4c95-a36c-45a272bf4a3c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6f17b3-6082-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752477243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477243, "uuid": "087697f2-ef50-4dd9-8cf0-d630b4d1f226", "comment": "Malware payload (AgentTesla)", "value": "88a10b2304f0446d2bf9511f2e3da976", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477243, "uuid": "58b27b04-6abf-4f85-956a-9fdf3f82f1ff", "comment": "Malware payload (AgentTesla)", "value": "6660d8e04c848bb29ce00aa71526a9907cb9b040eeaa2fd6d8b307400ca87147", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477243, "uuid": "fb88f623-ab09-44e5-a61e-d619455c233a", "comment": "Malware payload (AgentTesla)", "value": "6f3a9792fa991f251ecc6d8544abc3eea142f412", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477243, "uuid": "6e09a140-b4b4-4d63-a07e-93b2d5086736", "comment": "Malware payload (AgentTesla)", "value": "710899537197ce8b875a14da33f6b8a4efc719a4efb2896be9a179c66d13599ba4b7e35be134d6126674779c9b2c7c82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477243, "uuid": "fb04f2a2-dbf8-49e4-92e0-fa7030dea009", "value": "T181B533FC314B4F6D2B905F6A0A89A54B23BDB94526DC05FD41ECB7C03A9683626F40DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477243, "uuid": "f8d0a126-0dd3-4f06-a5c3-3c40d7c5c8e9", "value": "49152:2+QlA5i6nO04PFiGLT6EovwIz2a8KFQh04xE:2k5i6n8wy6Q7xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477243, "uuid": "dbceb71a-ec7c-4420-b695-34ae25f75b1c", "value": 2394806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477243, "uuid": "44d210f3-a5c5-45d9-9420-23abb322fcdf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477243, "uuid": "87c7945c-70e9-4f28-962e-7f1d931397b8", "value": "EXIMBANK HOI SO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e05b47-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513703, "uuid": "22480924-dea1-44b3-8923-40cf11c58b86", "comment": "Malware payload (Mirai)", "value": "c9edb4268c4bc097a124beb072659a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513703, "uuid": "2f4624cb-ec56-457b-aa20-4aaf47766479", "comment": "Malware payload (Mirai)", "value": "66b0308f336018ecd95a6b8dba15e5cb52e3e7fae161892e65306619482e78aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513703, "uuid": "5e17d521-2a36-4043-b7e8-842809de585c", "comment": "Malware payload (Mirai)", "value": "da095f42e4a7194ab5dfb27c1e2c3ddb07844b07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513703, "uuid": "5d818e95-f495-45ad-95c9-864b32816d31", "comment": "Malware payload (Mirai)", "value": "2d030fa2ef3895cf495f5ddc90a41141375818927f9dcc46a8fe2b6fc82e6e92a559f30fb7c5b3a1d3505ee644b1d46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513703, "uuid": "b8b37512-9b13-4c03-8299-4faea96f913d", "value": "T10013199AFCC24A3FC1C01379A6AE5A4D3721E3E4D2CB7607CE585B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513703, "uuid": "6bc25c73-3d5b-4383-9b5a-27bdf23d80c2", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCw/oOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513703, "uuid": "f46ac3f0-d7c9-4504-a520-75db174a4aac", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513703, "uuid": "1fe21c4e-38fb-4422-8a0f-65c2516115d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513703, "uuid": "bf29f25f-37a8-4437-9c8d-3a1750db3db4", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178a05fe-60c2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504718, "uuid": "a2a674f4-d993-4aba-a218-94f2331c616e", "comment": "Malware payload (Mirai)", "value": "311629d932f7890d7f0f99a1b2b42fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504718, "uuid": "4074dd5d-9ad8-45f2-a459-f275e1a87211", "comment": "Malware payload (Mirai)", "value": "66f5f9a5f57179496eea34ecd2ebb37c6add9a991c62861ecc9b71583d3471a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504718, "uuid": "c7b15abb-149e-4db7-a228-36496cabee7d", "comment": "Malware payload (Mirai)", "value": "951a9bd71fb3e7ac5c2e202bb78fb3348d6e0e14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504718, "uuid": "ea411152-2207-4523-96b7-b0f8ee83749b", "comment": "Malware payload (Mirai)", "value": "027db63504abc991fe6a21687e76b726fb2964907121b32fcbecae9e6f995678fdf61fdaae6605f624b3bd2dcf39eb2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504718, "uuid": "f2a3d206-9592-40a9-9b1c-04e7732ab49d", "value": "T15D630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504718, "uuid": "c1e99e63-a33d-4f7b-aa0f-d89dd01dc58e", "value": "1536:pOTAiIYaMBktkIwn8U0yaPBEyuSt8M8fhWtu5r36L:pOTAiLaMHA1uSerpeu5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504718, "uuid": "342e8a85-e747-47c8-95a6-09e0fecd2e71", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504718, "uuid": "9031e596-94e4-4872-a7a3-6d7c1f17aef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504718, "uuid": "6656f90e-6ffd-49f1-8d4c-79006518ce6c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0fb60d-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752477800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477800, "uuid": "a6023a65-454a-49cb-9680-601287b47992", "comment": "Malware payload (DarkCloud)", "value": "b02740f89c3a0c4d7e017199c73ed760", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477800, "uuid": "d24e01b6-a109-4d6d-b287-c2a83ac3258b", "comment": "Malware payload (DarkCloud)", "value": "66fffd734a0ffcc464e1edce9ab223df5f4e453f876537485b3f9d6d12ecf1c6", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477800, "uuid": "fcb67d50-f2ff-4843-a6bb-a8b301811f14", "comment": "Malware payload (DarkCloud)", "value": "b124a60ad3c5d08bc24ecaeacf2e4fa23f153eb0", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477800, "uuid": "5d157111-8e50-44a4-8843-0cb1334f3a76", "comment": "Malware payload (DarkCloud)", "value": "255c8fde97f7160f5d2ceb2b138e2efdb41e4198d25922fa0bbbfa1a9d5afd500c82f20f9dcd31a436aac8c48ef75158", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477800, "uuid": "f004b91f-f091-43e1-956a-bce742f703b2", "value": "T10C6423924C374039634FE9CB62463150B790B695F31B8F2F905D4B8768AE6E427D8ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477800, "uuid": "e629130d-cfc9-4c26-9acf-bc207ebb7a4e", "value": "6144:Nr+vmjUj3zoxxr8giPZPDhELAgx+3OO6E5AiSWtqXodpwyq5WwX4ffEnSae:eob+VC+3XF5AiSnXWyh5P40nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477800, "uuid": "d9a6ed8e-ddf9-4d71-a21a-1b888b4382bd", "value": 320241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477800, "uuid": "14963a9a-18a5-48ed-9c12-892fe58272aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477800, "uuid": "44852d7f-a7d0-4e4e-8aa0-1996df91fcda", "value": "art\ufffdculos requeridos.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d140fe4-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515438, "uuid": "5f5ee49e-b832-424c-8db1-481353b7fc68", "comment": "Malware payload (Mirai)", "value": "e58e94bc068b6e5a40473203ec7af387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515438, "uuid": "b722ff49-564e-475d-bdb6-cc803384446a", "comment": "Malware payload (Mirai)", "value": "673bf03c8d6b29828564f04abe3ee0d7c5f2f8798e80901d8aba65df0c00cf62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515438, "uuid": "23515a79-18b0-4f66-b667-328ea9cf8032", "comment": "Malware payload (Mirai)", "value": "75b73deb4f48175841a74096f69745400c14ffc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515438, "uuid": "94c4cf36-579e-42fe-a194-f4f9366aac4f", "comment": "Malware payload (Mirai)", "value": "8b3a871111a8bc8ad7902bbd2a34e03e00b63ac36b6e00260b03604311fdbdc6e5f1bb9fb1fed99b7881f8846ab82128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515438, "uuid": "e48f75d9-db4f-4074-830f-1da2bc7ad53c", "value": "T16B634932D8280E14E14545F030B9DE375F2355C362A32EF653A98268DC63D9BBA95FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515438, "uuid": "421e1eb5-e45d-4bcb-b68f-3284ecfe6a8f", "value": "1536:7asaCvCW3gDlR3rUGEjK3DvzfINha7smdMCx7g:7a9/rlRAq3fI/WMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515438, "uuid": "f3648f44-bf54-40b6-9c9d-0d5115630aa7", "value": 71548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515438, "uuid": "881a9ee2-5957-44d7-a74f-40e053b496b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515438, "uuid": "90910c91-cee7-46cc-b331-f52eac7d56d5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57148744-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485068, "uuid": "614350dc-13b1-4943-a921-8991fc90fd27", "comment": "Malware payload (Mirai)", "value": "03fb1f8b384c2ba05f465e06b43c9cf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485068, "uuid": "7ebb1792-8490-4292-967d-6536d0f99f1a", "comment": "Malware payload (Mirai)", "value": "6746c17642dd68527226fdf0df9f52dbee66394f4712fdee96cb08f45d04e59f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485068, "uuid": "c6915873-6440-48c0-bb91-62d4ae302b11", "comment": "Malware payload (Mirai)", "value": "1a03b33277a347c435c730740b0c1be323170742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485068, "uuid": "18a065bc-041e-4ca5-bca6-5be5a2bbbfc7", "comment": "Malware payload (Mirai)", "value": "40a079fb5b1d90a24bab606e1e8b39badc1b6eaf890141ec95316e48ef50a7e6f9c5af51413a79d000f9f9a6117137fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485068, "uuid": "09219f20-295f-4a4f-9184-e697ec265523", "value": "T1BDA2E0BDFB24C1CCE442847E199B2A6B065FF8A747D4421EAA05D0C701C39DE949EEF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485068, "uuid": "6bb9f920-f84e-4bdd-9357-4d150be50b68", "value": "384:pDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chJTNifHhBJhpExUC03uhHB3QJmRx0B:pDZ5Dw7RjFjcU+O24sDSNifHhrhpEguO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485068, "uuid": "bd4a1680-7156-4fe3-8cbc-49b824223ff8", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485068, "uuid": "0bdc569a-dff1-4f7f-a911-2e060eb12dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485068, "uuid": "96d99e4e-658e-4230-8e7f-cd22394ec87f", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bca6af-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485119, "uuid": "db0166ff-9781-4af1-872c-eeda2666c514", "comment": "Malware payload (Mirai)", "value": "936656d9e857d75884003b6a20b0d0cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485119, "uuid": "fb361d9d-c937-4b9f-b7ab-3c6e13b74fcf", "comment": "Malware payload (Mirai)", "value": "674acaff1ae8206e389883dcb8eefa89cabe81a60fee024bb8dd14a6777b6446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485119, "uuid": "a67a57e2-bfa6-4bc9-94fc-0446099c179e", "comment": "Malware payload (Mirai)", "value": "adc5bf724de0ec5050a2acfa221918b2c67c278b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485119, "uuid": "8c63dba3-3308-41ef-8767-a964a4689ce9", "comment": "Malware payload (Mirai)", "value": "013f72872dcdbac5d14b33fd4a85518d2aa3e972d83a22519fe503e0bbb7e3b8583bd3292bea58413d1a8e516913df34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485119, "uuid": "d9515831-d756-4601-9ad4-1fef524054e3", "value": "T1EB4302F3E561B8B8AEA028B1C14CC4CF69784AF6435A99929614455CE6CB1CF43EEF43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485119, "uuid": "f2da33fe-f16f-4a9e-b0a9-8ebc84ddd403", "value": "1536:VUJEHK9bvjJYvb/xJ6ZuvhYVH+MlefaJyLFjeWYun:OJEq9bvjJYzJ0Av0H+Io/L8WYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485119, "uuid": "c993a8f3-f118-454d-96b9-ddb5d3f0ac63", "value": 60600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485119, "uuid": "d7212acb-a254-48b7-8842-a3d397a857a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485119, "uuid": "b795a67c-a04d-4f87-b002-ff6c296fb0a8", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90358d8-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473689, "uuid": "b7a5ccfd-0b64-4c67-9c59-2ffcbcf22a76", "comment": "Malware payload", "value": "9eddbbbb959f212c1db623f7c5ea951d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473689, "uuid": "7df0ea98-46f7-45b6-89ad-525b92e8efa8", "comment": "Malware payload", "value": "68c3ba3a653b7b0f5e50fd31594216d19bfb7beace1f3ca7a2129446a1842e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473689, "uuid": "a072aada-c852-4139-b3f6-29f7cb09d492", "comment": "Malware payload", "value": "7ad5f9c55f8179a0169ae61e6191078910fbeb25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473689, "uuid": "eda84c13-279e-4814-a9c3-4e5a76634700", "comment": "Malware payload", "value": "f2754f7c61664a962330456ecc9289533b196b2cef4d974eec3ead26fbefeb38bad3aef27efe6f0f5a7dfb0f0ec30032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473689, "uuid": "01907893-095f-4565-9f33-9a30b061b29e", "value": "T107C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473689, "uuid": "94f62101-c1c2-4fa6-90c1-83fc13fffeb2", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473689, "uuid": "d6bf7801-8896-41cd-a244-0315260daa4f", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473689, "uuid": "c63f621e-572a-4259-9fc1-c9e8e2e18ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473689, "uuid": "1a7bc30b-0ce3-4108-b570-b8e3ead465e2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62dfb37-60c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752508044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508044, "uuid": "252e40d1-cb52-477c-9b3e-538c5bc09e79", "comment": "Malware payload (Mirai)", "value": "c319ed31bef704c3f4e5cfc71f30f68e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508044, "uuid": "e9fd8d12-16f5-48de-b207-bfdbd2ea0d41", "comment": "Malware payload (Mirai)", "value": "697d6b1a38da1b4904187548478b7858fb099202f4ffc7366ee2bba1994bf6d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508044, "uuid": "10264ae6-4856-45e6-9e56-1241b2465f89", "comment": "Malware payload (Mirai)", "value": "cf8182452e27127e6de43e9724a9e88f4808c4fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508044, "uuid": "e6ac22c4-d707-4ec9-9f71-ecc7ba1a51fb", "comment": "Malware payload (Mirai)", "value": "c3eefe3b365067e325f08e1a574756e5d06c3d5ef3957504b58225e50422f768a2dd68b0f990e5d10656ea8423a53b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508044, "uuid": "1193bd43-b327-411f-9140-3f23022f05aa", "value": "T1D333F17593E4ACD387141579391CA18A985A137C77F0B0231A7129A9EFC6EB30BEF243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508044, "uuid": "960742d4-4688-44d6-b702-2beda17e04be", "value": "1536:ICoqsGR4fD95ul7AgQmjZEDUFL9VE8amFZP7R3r:loqs24upjnjZcELJ9ZP7R3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752508044, "uuid": "598bb7d6-d420-4843-b735-e504af0f1143", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752508044, "uuid": "07c5de54-5039-4438-8e05-b6c1e3448d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508044, "uuid": "8693e562-b44d-4753-9efc-2b351f3ac981", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e061a12-60a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752490206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490206, "uuid": "b4ed33df-7955-4447-ae71-85bfa3f20816", "comment": "Malware payload (RemcosRAT)", "value": "8468d9d6f884673e68f496f022b0a95f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490206, "uuid": "0387af74-a41e-4bd7-ba15-40bbc9fb6139", "comment": "Malware payload (RemcosRAT)", "value": "6981d8702172dc39f302bdeb4917c0eb49f7c37b2a90bee41f64ccecc7e9497d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490206, "uuid": "b368a345-0acc-4258-a3cb-18298952df62", "comment": "Malware payload (RemcosRAT)", "value": "38f7494009a4a2150235b68e36507b1a4a329280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490206, "uuid": "aa4495df-a95d-4c98-bfe3-aeea17abad4c", "comment": "Malware payload (RemcosRAT)", "value": "b4805c92c4bc5263023ba52518fb3183f1d73b7d2dbcce0eecc2e16397d8269ebfbd54bccb9d6127eb440a41a5e37f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490206, "uuid": "d7412fda-b8c0-44d3-8564-87fee1df9a62", "value": "T19C55D01373DDC361C7725273BA26B741BEBB782506A5F96B2FD8093DE820122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490206, "uuid": "476ec5e2-9b6d-4044-ae86-754f1e2c7e1b", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490206, "uuid": "8dba647a-9606-4b47-80fd-d1088cc67201", "value": "24576:Ttb20pkaCqT5TBWgNQ7afu60Vy6ss/DKlvXTFx6A:QVg5tQ7afu3DDKdD/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752490206, "uuid": "52aa5668-fa64-49ab-a59c-03dfe4dcad24", "value": 1334784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752490206, "uuid": "79798420-c0ef-438f-a964-352fb2311127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490206, "uuid": "99d543cb-7467-47ae-930f-48aacacf3d48", "value": "DHD98778900003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaab307-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492085, "uuid": "2c201c3c-b36b-4b15-b81d-dcd2d99f56a9", "comment": "Malware payload (Mirai)", "value": "1bc631ee50d75465eaeb7fa5d90f0a56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492085, "uuid": "f6bd10d6-84d8-4d6f-bfce-f65791e0c9c4", "comment": "Malware payload (Mirai)", "value": "6a5601622d21d8aca8a181f144cd46f44b733dbf75b98bf11b9050c71325c704", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492085, "uuid": "1c77ec9f-1024-4d62-bb53-b1dd97562f9d", "comment": "Malware payload (Mirai)", "value": "5f5350a520986bb8a31477c4329b5f6aa0d923ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492085, "uuid": "4a2d00df-8d86-4c79-b6fc-f563259f7d73", "comment": "Malware payload (Mirai)", "value": "a405d6db75d5587244e223c1de2862cb182a42d6cd2ff22f48116e7ed691df338ee2f648b30abbbf672373929c250c12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492085, "uuid": "3ae2d571-c1fe-4e13-9fca-12da76cf4079", "value": "T194637C62D4650A98D2CA42B07128CF354F23E6C052937FB716B6C3BAA057DEDF506BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492085, "uuid": "8dd64ab8-bbd0-4503-ac7a-d2e3c92c8328", "value": "1536:d/z0piXjtaa3F0gFw0Fs3Qwb2wM4pzKfnMKSmyxcPC998503:d70pizgaV0g20Fsgwb52f11yx0Z503", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492085, "uuid": "e0ec69a8-243c-4c43-a035-3bfa85db73f9", "value": 67200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492085, "uuid": "d25cfe64-53ee-40f3-b0c4-8c6a8ec466d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492085, "uuid": "c21b2f33-31e6-4b33-bfec-80f246330346", "value": "top1miku.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1313dfe-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504653, "uuid": "f8af8c89-d741-4051-a0c3-fed1911e073d", "comment": "Malware payload (Mirai)", "value": "5e7d1384564c9c292bda70fbdeb532f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504653, "uuid": "58027e62-10df-4da3-8822-30ca9ed0a2ca", "comment": "Malware payload (Mirai)", "value": "6a6b11805bb80f5e165eeb6c8c89b40780c5b25e24af9108699ed4b0d3c20e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504653, "uuid": "937ab176-6d18-4b18-81aa-4ac54fc193ca", "comment": "Malware payload (Mirai)", "value": "96769a507dd6ee7085339001ea749bbe923973b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504653, "uuid": "f6aeac14-dc56-4814-8ea6-a185510f1f2d", "comment": "Malware payload (Mirai)", "value": "179664d73fdffe48c138d1dc95ec5ee9478fd5fb246e8587e90e45edf14714334c8b5175cb6f1fcc120adcd8f20e8800", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504653, "uuid": "a31e9bb6-6067-4950-8144-bfec8399544a", "value": "T1B0C2CF6027673A71D279DA389E61804737C78AF2B5F062613D181E91FA52D42B3BC1DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504653, "uuid": "b31e5fab-e280-4254-bade-f77c20f96db1", "value": "384:vXNSIfjdxuZ1DUofVOyPqM3lveVNDtrJFz9NlArg34lDMOwcstWvkPhymdGUop5p:RjKX934v5rDz9kaqM1csvPs3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504653, "uuid": "10c9a182-627c-42bb-a4a5-53e9ef27aeb5", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504653, "uuid": "66ca86f2-b4f0-460d-b08f-bde555fbbc54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504653, "uuid": "8a81bc08-cacd-4a72-894c-6696911f3035", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728506b0-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496710, "uuid": "a341d4a3-5412-4821-a2fd-ac2b9a1a5638", "comment": "Malware payload (Mirai)", "value": "b2b19e7a819f0c5fed876f3e3a86ebcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496710, "uuid": "c9921003-f4ac-4448-90ec-3c7c02a85c4b", "comment": "Malware payload (Mirai)", "value": "6a8472adae078eb7b94932a178bb394282a7bfbc2c79fcba916fb895854c3988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496710, "uuid": "b859f4d4-ea5b-4769-a2ab-08d613dbbf25", "comment": "Malware payload (Mirai)", "value": "2ff52f51689090969d0ad37660768a8aa816d217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496710, "uuid": "4653ba81-9795-4e23-b863-af5862f2a494", "comment": "Malware payload (Mirai)", "value": "25d01ecd6e006e6fcc6fa540aed51807772166ad100416cba4395612cba47dd2ea1e647ce6eafc56ec400dc9cd698e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496710, "uuid": "ee219caa-a899-401f-98ca-bce29de3bcd5", "value": "T11D630891B881A626C2D1177BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496710, "uuid": "daf16242-c13e-468b-837e-9ab7be4d9291", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496710, "uuid": "7977df77-ca6d-409c-85cf-302a49adb257", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496710, "uuid": "b3b34c4f-6c21-4f63-b6db-12947f97a9b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496710, "uuid": "17238cca-0126-4406-9500-bf55edf1ebfb", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d24d94a-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536966, "uuid": "bd396184-cd3c-4a31-b07d-77417e2fd239", "comment": "Malware payload (Mirai)", "value": "3a2c0798a987965fbc409b0390849f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536966, "uuid": "fbcca41f-4943-4830-ad0f-eac1d4785412", "comment": "Malware payload (Mirai)", "value": "6a9a5ae0f1063e6b96e3306fae98237cf63557d086b0abcc4de7ecb3bc447fdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536966, "uuid": "94f8dd46-8afe-44ab-8061-de6c5c062f2f", "comment": "Malware payload (Mirai)", "value": "d629eea073c19c54db4b626cf40f2efe841edecc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536966, "uuid": "cbb014b9-371e-44d0-98cb-5d12e7a62388", "comment": "Malware payload (Mirai)", "value": "ff4b988e77684135129867bbbf4470e2ed4c6edfc38e1638a7b42a584e2e2eadbe44d79d07ee11056a0438ac2c069d89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536966, "uuid": "aa639441-f5af-4cf9-a51f-f9382e4011ac", "value": "T196B30945A941AF11C5C325FBFF9F41493303AFA8E3EA3211C9245FA4378A9DB0E67616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536966, "uuid": "1b444f69-7f91-47ae-a71a-2f44faf465af", "value": "3072:BbIciJuDP1+21M1KnuP4roNaqmt2T5jf6bq0J4iBYF6nGXG:BIFJcNrGO7ENaRt2T5jfwqXiBYJXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536966, "uuid": "101cee02-d6fc-4867-8e83-9ed1adcc6be7", "value": 118140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536966, "uuid": "d3dbce21-9af2-45b1-892b-cf95cbb9542b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536966, "uuid": "e0052580-4447-4609-bf51-6873c87ae796", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93118d8b-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752477867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477867, "uuid": "b39ca146-95cd-41cf-a695-eb585fb2d4fa", "comment": "Malware payload (Formbook)", "value": "e266865e13bd152e1beabf572aa09e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477867, "uuid": "43bcfb3f-9baf-4a4c-80b7-2d78164d5fc8", "comment": "Malware payload (Formbook)", "value": "6ae17339b8a76cb12268e292ad1bd020e9b02acad06d868472bf00926bb83821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477867, "uuid": "3bf64593-a462-4695-88b3-3843c0c57629", "comment": "Malware payload (Formbook)", "value": "a27f4062ac9189dc4819be4ebca2f0ec6302a623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477867, "uuid": "0b0e4864-9e72-4233-aeb3-c8643d13d445", "comment": "Malware payload (Formbook)", "value": "d01c90ead28e2a57a7ebba95684083a152eb557af0a3d405e32ea22afd071e20d731d7307c9890bec9388990ae337fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477867, "uuid": "0b2be0e9-7077-4ed3-bef8-b2790addb118", "value": "T109F4F141B836CD15C4660BB42760ECB0037EAD58B811E3139ED6BEDBB33774166D1AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477867, "uuid": "a5e48481-3f69-4e48-b169-0a17ff76bfd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477867, "uuid": "a34c2467-6890-4d98-9394-96225a875798", "value": "12288:pU1/3plPNiW9DFN/1H3OA2BgRyP1kmlRh1yqom7abeKSg4yLoEAuOCN0ewo1+ZsJ:aF5lPNt9DjJ+pBmyPvzyyWday8FlCNLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477867, "uuid": "6c62fd8a-128d-4fd9-bfda-cc53aabd93de", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477867, "uuid": "6a7478f0-d1d0-4491-aec2-999a636f6233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477867, "uuid": "65543de0-3ac9-4456-a27e-9a29e25d3eb6", "value": "S205556-08601785-00006.XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a19118-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493122, "uuid": "adb6aeef-706d-4083-9802-671954b4d32c", "comment": "Malware payload (Mirai)", "value": "bab934c636535da7cb5d90b6845f8048", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493122, "uuid": "73462114-2e20-4353-80e3-87e7891a176f", "comment": "Malware payload (Mirai)", "value": "6aff2423f5dcecb806c33b06e5c7f66c50c7312b4a6e9bfb42f207003fe46865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493122, "uuid": "a381fe54-e97c-4bb8-a81f-bf4f5b98bef1", "comment": "Malware payload (Mirai)", "value": "3f9598ae2e1bdd1375115319bbfaddd50881b0f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493122, "uuid": "bf51aca8-1bfa-4b2d-b28c-76ce2c71ad9f", "comment": "Malware payload (Mirai)", "value": "20b4b8ce0656d50f771967a3361f98cf655293759c597c8521da1e7b64d87faac9a9b001533154256b7258227d2b1d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493122, "uuid": "a39fcd5c-1851-4104-968b-613828df46d1", "value": "T1AE042A46EA414B13C4D627BAFADF424133239B9493EB73069528AFB43F8779E4F12506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493122, "uuid": "3209a078-6d47-482a-860b-a26e82789c78", "value": "3072:VZstHR5lxqBin5yqMw7QiKabniacA22mSePCWEO9B+otM/R8wp6p:VZhccqMiVKabniacAjm2WEOjntM/R8wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493122, "uuid": "ff2bd031-6594-408f-87ad-bdfc6b96f9f3", "value": 186684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493122, "uuid": "fbe4dd8d-fb35-4ad3-930b-84542002683d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493122, "uuid": "41e26647-bcc0-4501-8229-97e3efbcb8ce", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cae6842-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752481077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481077, "uuid": "f4600ae4-4228-4439-b120-65a49c9a9c5b", "comment": "Malware payload (Mirai)", "value": "8a0ebcbc6e30068528bbc067f84d1c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481077, "uuid": "56b1af9b-221a-4ba7-843f-a5210893bcb6", "comment": "Malware payload (Mirai)", "value": "6b0e6f953784f65f2aabf020848d2b631e020c1cbf98907d5066bb1dfd519dde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481077, "uuid": "1c9f295e-0b98-4173-a712-822981e41436", "comment": "Malware payload (Mirai)", "value": "2861dd22a7b94363d7c892755da8b918949650fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481077, "uuid": "20e089ef-8b2c-41e6-9178-121095184198", "comment": "Malware payload (Mirai)", "value": "c18136c92c517de3d2b93c7fa4afaa52dc99b4f45605378e25c95fcec113331bd1d58f0bd0cb52b909775dbe9a0be7e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481077, "uuid": "8e2a554c-09db-47fb-987e-aacb2d18c53f", "value": "T17AB3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481077, "uuid": "a3a39243-ca80-4b9a-b52f-59bb43619f01", "value": "3072:R/4tNF9U4vvXKw6J73x8UmkiSFxfKxbXe:BUNFK+X8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481077, "uuid": "736d54a5-cd9f-4bfd-a38b-d9bb14d1b779", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481077, "uuid": "74fb0b1c-9ad5-43b0-98a1-6174011033aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481077, "uuid": "bffa1bf0-acac-467a-add7-d3911c0ca801", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec74259-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481081, "uuid": "e364ee8d-1453-45b1-a7ba-533e75ef3641", "comment": "Malware payload (Gafgyt)", "value": "c97b7530bec39ea2adecf3be106ba941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481081, "uuid": "aa6aa2f2-08a0-440c-9a7d-ddb88df091ad", "comment": "Malware payload (Gafgyt)", "value": "6c65f8994be09f056bb43ee696ccfbdedcf1846d1bda42728d1ed5af1a4225d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481081, "uuid": "5d9779ba-e7e5-47c0-893f-2d97b57f8826", "comment": "Malware payload (Gafgyt)", "value": "6c6767962778259af8c88863cc36991accd84723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481081, "uuid": "6e8efd7a-42a1-4f0e-ab77-07ab4e77b07e", "comment": "Malware payload (Gafgyt)", "value": "d9f47e1948bdbe882f46eb947b0728df0940807e997b0926c02493d90d94b753391a23a977b0d06277c07da5d33d6de2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481081, "uuid": "73c77203-86fa-408a-8f04-2ec755e5d354", "value": "T1D3733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481081, "uuid": "617d8e05-4a3e-4ffa-95ec-0bb5479d4362", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzM8MmLI2VOCjXUfJRk:45omr0xKFn6J+OTMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481081, "uuid": "b5b4134c-4a75-478c-a31a-ccabb5efab21", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481081, "uuid": "24cc4cef-a8e1-43e2-8670-e41fe79b09f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481081, "uuid": "e5b651f2-aa05-4caf-88ff-f0d94356912f", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ced1c2b-60a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492916, "uuid": "d2dfba71-e233-42dd-b14e-23507678a32b", "comment": "Malware payload (Mirai)", "value": "c9d7b226296c9343c3e30a71217c5318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492916, "uuid": "cd6dcea0-01e3-48b5-b9cc-15a0ab208a81", "comment": "Malware payload (Mirai)", "value": "6cb49510f4208db8def1eeec43394e3ae3a3706354c92c0998a8a9ae9e0e76f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492916, "uuid": "5209a5db-c914-4c7b-9f1c-e6f1839f95f7", "comment": "Malware payload (Mirai)", "value": "74e1f6148e2be9e7450f9741f3a27f00bb18cdd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492916, "uuid": "97b55557-6d27-4660-bb45-8c943a86f06f", "comment": "Malware payload (Mirai)", "value": "0ed319bf8bc3b6f692ae2703d43b82e72e7bbcc3ae205fccbada66372b08b160dd970fb8fac75eca057d0da3ffb6b3d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492916, "uuid": "112bec47-d5a8-4833-8a32-c48b252367db", "value": "T13004D806AFA10FFBDCABDD3302E90B1239CC955722A53B753674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492916, "uuid": "b0d2a184-320d-4a19-8c67-7214b27334c0", "value": "3072:hOv612uIu+volC6lv9UWS4PGt1KUB72tPmTdI:hB12pu+vqAPtcUMcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492916, "uuid": "d6d4aeb8-91ca-4af7-baad-7adf0a4066c8", "value": 181892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492916, "uuid": "d8471b8d-88e0-4854-9aa4-e655002a6f44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492916, "uuid": "76761580-9072-4443-8f84-1bf530658d66", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6fd8eb-60b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752499785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499785, "uuid": "2e93584a-5947-42c0-8f33-21212bfb950f", "comment": "Malware payload (NetSupport)", "value": "ecc1014a24e45562fa70642176f8ac07", "object_relation": "md5", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499785, "uuid": "d6100ff7-82cf-4645-891f-f4eac5fe436a", "comment": "Malware payload (NetSupport)", "value": "6cf242ba40dafb4bac0956e6841eabf47f7e9f724948dd145bbd558388e527ca", "object_relation": "sha256", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499785, "uuid": "58e141bd-5ca8-438e-8855-dd1b809c05c4", "comment": "Malware payload (NetSupport)", "value": "115504d6db708dff9ac9feef2b33fcd350c50b3c", "object_relation": "sha1", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499785, "uuid": "26c992f6-3a67-468d-879c-5d40c7e40ecc", "comment": "Malware payload (NetSupport)", "value": "22d9c4df719ec3c791338beb57b471014d71fada1336b015e0e9d00eefbd71c264137bbe5c074b5f980cd0c1f559eba1", "object_relation": "sha3-384", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499785, "uuid": "534e2d6d-73ac-45c5-8efe-a54057b975e3", "value": "T15AA5335B6630FBDAF42E51F521CC66204636BCE0A5D5F198C33893B92F70EE1AF20856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499785, "uuid": "149c3995-c90b-4f57-8fe5-2344309765e0", "value": "49152:Qz3hpHNIsvPIWfhCA2caM5SAdjltCQC7V0OLjNLS2BssB+Y7D:Q7hoWPRqzM5S2UG+LSassn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752499785, "uuid": "99e0e925-393a-4e10-914b-e3cf7e8593b0", "value": 2247325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752499785, "uuid": "9c7665f7-27c3-4c71-822f-cf30d4a8c9a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499785, "uuid": "013d0cfc-5d1c-4654-97dd-69bf231169d8", "value": "6cf242ba40dafb4bac0956e6841eabf47f7e9f724948dd145bbd558388e527ca.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727237ee-60b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752497139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497139, "uuid": "798183c7-c018-412b-8908-1cb5063da95b", "comment": "Malware payload (Mirai)", "value": "ac5b57f3fb5ab9abf27c3895c6b1a0ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497139, "uuid": "b76b72c2-9c02-4165-ab02-abca4ef0075a", "comment": "Malware payload (Mirai)", "value": "6e26f9645d5bc7da8f59ec81f2d78d0bfff8a7304cb6ecd37f1e3ee073e48da8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497139, "uuid": "772bd321-4acf-4866-bfef-d389c32b88da", "comment": "Malware payload (Mirai)", "value": "3780e26ebd6eb6c1c382d40ce5852ae2d00e51a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497139, "uuid": "d95d79f4-fca7-4239-85ba-4583b250deae", "comment": "Malware payload (Mirai)", "value": "87b9499e72b6f8a1a6f2b192c277901cab157d6928aad9097ec8a8525da2adc82d40ed8cc327fb2ea290850553cb27fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497139, "uuid": "8598a2f2-5dc7-4d35-b413-cc8379505b4c", "value": "T19E1100FA40A8A0162A88AB54B05B897D6ED7F7C0707216F1E13FE4E794CB2903710F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497139, "uuid": "65262cde-d0ec-4096-80d4-f669cfbce6f8", "value": "12:3J3lTL2QlTL0aLQlTLqNIQQAQlTLXvK2HQlTLhKAQlTLfHQlTLJQlTLU5QlTL8H9:3J3l7AKNIn/KP8Vsm0Wc0UosV9TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752497139, "uuid": "ab4cd4cb-a4b7-4d52-a7d8-5c9a2339e569", "value": 1078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752497139, "uuid": "d217745d-0497-4913-9e27-c6010d66107d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497139, "uuid": "0f144a5a-ab19-437d-b0d3-520cf6ea3457", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6409598b-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504417, "uuid": "48371fb0-55c6-44e3-97e7-be049d19a7c5", "comment": "Malware payload (Mirai)", "value": "aa3d0e2349c856777664cb9a1e3bfa39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504417, "uuid": "20b36b30-8dbd-48fb-afc1-4122f27042ba", "comment": "Malware payload (Mirai)", "value": "6e425c183e177ee950d8148c6d316b6f9060175d68a48e9b545cb93df230efc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504417, "uuid": "bc93f9a9-5121-48c3-837a-3a94c8a1fc3b", "comment": "Malware payload (Mirai)", "value": "4498a1c63895b01a0babdb5320339d4fb8056e6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504417, "uuid": "243e6836-f414-4de0-9cc5-d8408b1e7330", "comment": "Malware payload (Mirai)", "value": "131686bc75077af4466e629196ef39e2082f3aa59024f95a9a13e84cf4ce0f9e49d15a9da2f504da0f7b34f69f1205aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504417, "uuid": "ba699496-7c0c-4455-b9cd-baa4328c2151", "value": "T157E31956F8818B11D5D255BAFE0E128E37231B78E3DE72139D246B707B8B87B0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504417, "uuid": "1b0bbba1-88de-4917-a756-d1a6db694e32", "value": "3072:N6fkpJ9cHTSAJ/krieeNQw9ejtFsZWYaaYDBSyhZx+mCW8Q0iVITq:N6fkpJ9cHTSm/kriFXUtFozaxVhZxr/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504417, "uuid": "4c2dde06-3fcf-4bd7-a300-7578346ac18d", "value": 156220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504417, "uuid": "42b6fa26-1e61-4008-9648-053ecc31dda9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504417, "uuid": "48196e1e-a9aa-4f63-964c-6dda6be77c8b", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e237fa72-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496897, "uuid": "8b6a8c6e-2800-43ab-a883-8f01480fc941", "comment": "Malware payload (Mirai)", "value": "c273f287456d016e70f2dad586631be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496897, "uuid": "51f93784-ae80-4122-a185-125db80ab3df", "comment": "Malware payload (Mirai)", "value": "6ef4996c767182ee28ad87dd18f48015c6b84edb2017b12c1fc0365f7465175e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496897, "uuid": "273c9520-bd73-4f24-8a68-62f565871132", "comment": "Malware payload (Mirai)", "value": "1362f231fea469d8e10b7f1d296420298ad12ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496897, "uuid": "bbce7180-a4a6-4d67-8eb4-f65d6fd802f6", "comment": "Malware payload (Mirai)", "value": "7bf915e1089cc7c18c0448409442bffff9175cd1ea89fde54f6f7c2c2a6b1b0ec8209e3493a05523d45c1db957584f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496897, "uuid": "ed66bcb1-598f-46f0-80bd-667033362b3e", "value": "T11D835C3169392A26C0D0B97E12F74758B2E21B4E25E8CA1E7D730E4FFF51A5064136F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496897, "uuid": "42a0a032-5ff8-4b70-912d-1d5d951000d7", "value": "1536:KYHpONKUq1et03jRIpwXp/ra/SjPsIhJWsjM3wlMVjeQn:nxVJTsIXzY37eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496897, "uuid": "39a5b7a6-db7f-4a69-acd1-b719f420bc24", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496897, "uuid": "515bd00b-4047-4053-bb76-1524f047b5f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496897, "uuid": "a4c970cf-c1c1-4887-8476-d768f908002b", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c2fd4d-60a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752493764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493764, "uuid": "39c81c34-7776-416b-b6f7-a868a8dba1f9", "comment": "Malware payload", "value": "6e650891dafeed48a2f0cd84046d3e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493764, "uuid": "1d1bbe2d-25b8-4fb1-bf41-33c5c8a7faa5", "comment": "Malware payload", "value": "6f50f21c7008be58f2c37d8ce5df135c11d0fe0df5c33a6f855902cf710f2b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493764, "uuid": "daf71159-3648-476c-b462-fd42d1aff62e", "comment": "Malware payload", "value": "d029a97ddce982030f53859c499fcb72539d26e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493764, "uuid": "3352d501-8307-48ef-ad45-2506f4465159", "comment": "Malware payload", "value": "3c68c2ddb54d67608f8b931dbbb7833a31f059d8d2957137a03c9b630d35ce13271229230c05e8ec9c4a6875fbd62cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493764, "uuid": "96f1fb30-ad2e-4eff-bcf2-56e2574c876d", "value": "T13AA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493764, "uuid": "edc7f4b9-8538-4a99-9a17-f8abceec21c3", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493764, "uuid": "7afd7985-1ad5-420a-b4cb-a46b999feed0", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493764, "uuid": "2139f367-1135-4cff-a5bb-9915d0cf412f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493764, "uuid": "76eafe07-bf57-46c1-b0a1-7a971a248434", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff02027-6071-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752469916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469916, "uuid": "ecc8f764-57f4-453d-a4cd-17075985cb51", "comment": "Malware payload", "value": "0380d523ebbc8b6cdc8fd50b6ee651f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469916, "uuid": "b6392c44-b4b8-42a1-add9-84439eba4c69", "comment": "Malware payload", "value": "6fbe4775e2cca56898cea528bb491eeb7631dcdd162289d4a0f4f455bbcbe7f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469916, "uuid": "b800fe06-8c45-474f-b5ee-272e008c81e1", "comment": "Malware payload", "value": "3b0185411dd72038278b3f909f5f2a1f560f67ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469916, "uuid": "be291f43-1756-472b-beea-bdd82cab3f00", "comment": "Malware payload", "value": "2c4f8b936029d0e8cad670bb67c5437fa3f4f095ab394a8982cb287cc303027df4f505eb58274b6c7efde338d056744e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469916, "uuid": "8686d929-3fff-4b7c-b57c-257ae3c27e50", "value": "T1AEE401037308A756DF4BA83A82CBFD31B7C2799153D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469916, "uuid": "b7a0861b-259b-4205-b49d-2c41c82b3dcd", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752469916, "uuid": "e5084e6e-ee3b-4798-a4fd-b01b42422ff6", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752469916, "uuid": "cc99975e-8632-4bbb-8769-795a9bd20202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469916, "uuid": "099d01e7-583e-48cc-99ee-bde63a878885", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebc474a-604a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752453405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453405, "uuid": "42c60ba8-b9ff-4f74-bbb9-f527189a1677", "comment": "Malware payload (Mirai)", "value": "2eba15d09247eff2b0988e73a79c2cfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453405, "uuid": "614288fb-a834-4250-8636-7417f8bbf930", "comment": "Malware payload (Mirai)", "value": "6fbf042ed983ae8c97cbebebf3a5c92fb31013c1afcf5f0b66471c992c51f5d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453405, "uuid": "02dd23c8-e79d-41b9-8c47-a7c667460791", "comment": "Malware payload (Mirai)", "value": "505a469bec94dc033c41768dfa6eb34afd831ee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453405, "uuid": "788ea188-8f46-4ca4-a1ba-2f5bbe7f3e6f", "comment": "Malware payload (Mirai)", "value": "b0abfa484b0b7aaf13340f763a1f2c6124f7d9a89f97c52e187409239052824f4ad1c49015046a3d8dd59e7919dd8a2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453405, "uuid": "2d9c3556-34b1-4994-8ad5-b620747d07d9", "value": "T12D533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AE226F4137CA82B1D77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453405, "uuid": "a3326658-5cc8-423d-ad91-aaed139db0ea", "value": "1536:IapoONyFPLHwMMW7wTu9EgNHo3N2a10v:IapoH+uEIHgNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752453405, "uuid": "71554e12-61be-4902-b9e9-ef0196748e51", "value": 60780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752453405, "uuid": "d9b25aea-4608-4005-a573-537756a6a72a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453405, "uuid": "a20da0e3-fe29-4172-bd49-41df4b7f98b6", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa4c88-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479997, "uuid": "a62241e5-943e-447d-811f-3d6bad2298bc", "comment": "Malware payload (Mirai)", "value": "700b0e44b0797ed19a2c89fd207e7dc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479997, "uuid": "5941d847-7563-4d29-b1b9-e2211d705da2", "comment": "Malware payload (Mirai)", "value": "6ff0097d9df2e1faffcb66f7600a8d5a8f409222eeddeaaba1a5361902b6a0bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479997, "uuid": "188da0d5-df9f-428d-ae89-7b4dae71d170", "comment": "Malware payload (Mirai)", "value": "f069e72e523ba4f90be2842748da2f37f45f5da0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479997, "uuid": "770d9d85-9357-4fad-8576-4ccf8864d88d", "comment": "Malware payload (Mirai)", "value": "1cc47b6ac868bbb763fd1c8543826df351314ced94653dd65a8d1ec41c826a4ed2cd775f0db547b0f5d6de9e4c5a8176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479997, "uuid": "cd55da2d-d67f-48bd-a35a-7015f2a43564", "value": "T1E053015028521E177D304DBD097F4FC7B7269BE8C826B9A2B2B45A2E8DDC9C0D246789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479997, "uuid": "238127c0-84f4-48e5-b9d7-b67ddf7aa494", "value": "1536:bEexVOlvJBkEzInX6QldNJ0ZMf2L6K6RyO/EMW7:bhwlvkjXAMuLf4yP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479997, "uuid": "e8eb5ab9-6f10-4e45-8f4e-bf204c7a41b5", "value": 66488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479997, "uuid": "74a901d9-500f-4dab-a447-94795cb41198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479997, "uuid": "6ed4e5f4-416f-4406-91a0-a7e5a3447009", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495ce03f-60b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752500077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500077, "uuid": "9444ae34-6d75-4df6-9e55-174929617d0d", "comment": "Malware payload (Mirai)", "value": "3da2d13abfd6008626674cd5aacc497f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500077, "uuid": "74b2f2f7-dd28-4d01-b941-41e346562ae3", "comment": "Malware payload (Mirai)", "value": "70346d3bf6389fbe88df0cdf9a28a90615e2d90d1b1a584aeec044ee8469cc48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500077, "uuid": "413f1627-87b8-448c-aa9b-f3303a822ab6", "comment": "Malware payload (Mirai)", "value": "fcfb4b122b8f2d4ae07685218419987fad8ed92e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500077, "uuid": "48aae49c-07a3-4392-a4a2-ab96e2799808", "comment": "Malware payload (Mirai)", "value": "c2a07254f18443e2e031f70728689a12217b1f1dd59e685c0ffe86c0a0a29399e73c65ca6d343996276e67ef3a7b3d56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500077, "uuid": "0e611bce-7ca6-4fd5-a011-4858c8046bfc", "value": "T13553F2BFB4831BC6CBB226354B1CC8970A05E4BC92EE171F3254A26955C28D337750AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500077, "uuid": "2d69c8ca-52f1-4089-bb8c-ce3d47c03cdd", "value": "1536:DBN9aaua7RrBEh2KIFi9c901+AAcLRR1duXVUzoydqN4:DBNgjYRrSUK79c901+CLD3cIoLN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500077, "uuid": "11001d79-2594-4174-b643-fcc3af5f27cb", "value": 65664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500077, "uuid": "bf22fa3a-71e3-4458-aceb-ffe541651fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500077, "uuid": "6c150ff7-41f5-4aaa-b99f-85b8f16018d9", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681d88c3-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528475, "uuid": "61bb1622-2cdd-4504-8b88-4b25d05e39b1", "comment": "Malware payload (Mirai)", "value": "9e196ec2f12615949acac4d4241bfb79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528475, "uuid": "6054c7dc-110f-4c4a-9e1e-5a600fe24183", "comment": "Malware payload (Mirai)", "value": "706f1e9cb5d99acc4f7b6be3fc1d0f494bd89a00597e122e41d98045e63399ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528475, "uuid": "3a8d9423-e3f0-4017-b8d2-945b860a6372", "comment": "Malware payload (Mirai)", "value": "1a188dee181b16e7b3db520fe99fd86ab865b5ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528475, "uuid": "1ce8e97e-3d7c-4348-971a-5fae5659c9dc", "comment": "Malware payload (Mirai)", "value": "69464745a2723cf55760c270e6361b7a408d52767bf7f537577b9eed40a51ded719352025de825c21d2493e4bd0eb423", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528475, "uuid": "fe61a00f-f2c2-4eb6-abc5-c599de736d72", "value": "T1FE531267890368BAFB537E7BBAE04EC3F60D8B727199547821153098F5F55223CA12CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528475, "uuid": "85825e67-3692-48ea-bb72-a33f2cd6f916", "value": "1536:L7XduYshWhq/HIEy6Og3Nwz9hAycX/TLSM5Tfv83KJGTb6R4w:HdpssMPR9w4ycXbLXTX83K0Tb6Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528475, "uuid": "86b48dc4-16dd-4d17-8592-cfca5642ddbc", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528475, "uuid": "7cd37e8e-b6ac-4813-9cc7-7e2f2a003d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528475, "uuid": "c4605cf9-6acb-4d96-8da7-658d66b1813b", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5336d71-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752482702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482702, "uuid": "ca8dbcb6-3e16-4e4a-8618-b9278daa4f33", "comment": "Malware payload (Mirai)", "value": "78ab724383704dd1e565b0ae585253a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482702, "uuid": "b25252ec-e30b-4fa3-8039-841bfc10dc1c", "comment": "Malware payload (Mirai)", "value": "70bd09c009948e7ccf8a756e50c3a0d072513751d12aaad10efaad191cfb4c10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482702, "uuid": "7389a261-36df-4c9d-be58-d59dd7d5e326", "comment": "Malware payload (Mirai)", "value": "243567840999fff453bda1bb95ab06bc7ac2763a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482702, "uuid": "dea6d3f1-57e7-4df1-a05c-5f6d62f26263", "comment": "Malware payload (Mirai)", "value": "ee808d042e1ef99e569385c78205207f4ecb3ccb5c1aaf0db2cee4f84b1fc367008cb384ea4a9c2b50ec9cc071bef011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482702, "uuid": "5afd7921-6e37-43a0-a347-6521b9be6c85", "value": "T1D373D70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482702, "uuid": "9a611db3-ef1f-4483-8e1f-17f7b10e4898", "value": "1536:bpxe5qoct9fdlQBI6rkEnUFndlBotYG9CJa10FDv:Fx3oANdzrndvomgC4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482702, "uuid": "171cadb4-5d1a-47af-8995-ad9141255b39", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482702, "uuid": "37d843b3-919e-4d09-8cf3-f32fb341a4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482702, "uuid": "1640e16c-dea2-4015-85b2-7368a22aab7a", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1af7c2-6059-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752459924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459924, "uuid": "3cf3cc32-8887-42ae-80b2-d7101d8db64e", "comment": "Malware payload (XWorm)", "value": "c6d5952282a199e1c7b422998894756e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459924, "uuid": "b53f1d0b-1e1c-44de-b82b-37f9928d1e40", "comment": "Malware payload (XWorm)", "value": "7106da0e49f6991229acdf83c1efb6741d266cb9b5497965af1a8b1eb28b14d6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459924, "uuid": "9f671880-f771-4cd5-8e65-f5aa5ae06c44", "comment": "Malware payload (XWorm)", "value": "b190f3057690ce73e72bed36e0efd9f605dd40af", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459924, "uuid": "9f1936b0-0b6e-446c-980d-6036f574a401", "comment": "Malware payload (XWorm)", "value": "0d3862ccaf4b35da9e45c13b3643ee58b691eba293a3e502addf0957ea409edfaad421c460e7ab02f6594df08d5afeb0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752459924, "uuid": "426f30fe-c686-4139-a79d-0c740a0576f2", "value": "T1A304C53DCAF1ACC0076F70D05A2D3B4E105E6B93B7B91B2CF5C148A92954996EF37268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752459924, "uuid": "4d09a2ef-b706-4879-8347-9e6eaa247c83", "value": "3072:TahdXZh+U9uzF3/ozHQL3pUlb9wcRf0BzFOw0U9BDi/DLF5hKBbpFEWdrzYbj2y:+h1PNNLhtDJMBb0U9BDi/DLF5hKBbpFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752459924, "uuid": "a4136673-b8b4-4a3a-8483-5120d42b06f0", "value": 178453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752459924, "uuid": "1b32acd4-e04f-44b3-b767-7c02df838a6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752459924, "uuid": "c2ed15cd-3e58-4101-a017-9235cd3c1987", "value": "Gef Industries Price Enquiry.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805d6e4c-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485137, "uuid": "a42df21a-1ec0-4409-97ee-c58e16f80780", "comment": "Malware payload (Mirai)", "value": "d725b7c857d3eabb9b171c5d2a1d253a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485137, "uuid": "0601bf3a-e61a-4145-ba7e-6717ee91d103", "comment": "Malware payload (Mirai)", "value": "7149a6812d17d30379616f37ec45641d5995a0dfa47721d527902b45c7f78aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485137, "uuid": "1edf1438-2031-4d2d-a299-8cc7fb0bc466", "comment": "Malware payload (Mirai)", "value": "274cf463c4185f579ab42002aaa5646a82ddd3db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485137, "uuid": "d9b01355-d133-443f-ab12-603d5c13adc4", "comment": "Malware payload (Mirai)", "value": "a2ea915a7d1adc515d0502b794b19c775b17f1406746886223d1004ff9a81e20a60250320a42e5d50db4bda75bbd2144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485137, "uuid": "3c36593f-c18e-43d1-8c65-68bea837d83a", "value": "T1FF93D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485137, "uuid": "8e28e191-ff9e-410d-bac5-6da9530ad7a8", "value": "1536:NF2GXYZ8a8BnwEvLNPENIdhs9WZx0ZCufqNhK:NFjXYy4Ex0whK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485137, "uuid": "04371f60-ecdc-4b8a-8679-5381a9d0ede2", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485137, "uuid": "ae71a749-cb83-4319-9c21-06a90ea7460f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485137, "uuid": "c30a59b1-6cf3-4646-8e67-67420fdb38fa", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c13e5f-6078-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752472981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472981, "uuid": "68532b56-f954-4293-85d4-ae40d2eebe87", "comment": "Malware payload (Mirai)", "value": "b6282ac004d4cb17e814440d96132e9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472981, "uuid": "b684bd22-9205-4b6b-923f-4cbaad14b2ef", "comment": "Malware payload (Mirai)", "value": "71888c198e8fd8fcd8f1d38b7334d33eb63845ae957817fa006a4240e04109bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472981, "uuid": "7a9b170e-f12c-4279-830f-5a24b853ad06", "comment": "Malware payload (Mirai)", "value": "f3af84d95957a41b4514913435a375ede711c088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472981, "uuid": "101bb6a3-ce5a-4636-925e-8de775327a97", "comment": "Malware payload (Mirai)", "value": "ae388846224c7e64de03ceaa79009f1588190cb70f5281580c7f750245a46509d94e84bd981431d25ac112a9ec0b3844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472981, "uuid": "3b4f046f-2835-4afa-b0e6-0b23fce93d61", "value": "T1BA04A91E6E224F7DF768873447F78E21975923D622E1E684E1ACC1101F6029E642FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472981, "uuid": "6e5e1ee7-4e89-4052-b8c3-ea5e4e7216e2", "value": "3072:T0Cgf3EjmTHBRvNdATp8+Sk8s6KV7cM+Uh:off3EjmTHBRzap8Hk6QcfUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472981, "uuid": "2ed04151-6a78-45f0-8d4b-02d675072803", "value": 177644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472981, "uuid": "83f7a067-aaaa-4c37-8564-696465e14d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472981, "uuid": "52b53167-b6ef-45e4-a4d1-5bc723f4bb15", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a44ee3-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479998, "uuid": "ad20e9c7-98e1-4df0-8a07-0ea9463d31c3", "comment": "Malware payload (Mirai)", "value": "ab195a0b1e38cbce7b74267fe1cc0428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479998, "uuid": "b75c2c2d-80b5-4b39-953b-6234978e9c72", "comment": "Malware payload (Mirai)", "value": "7196fdb42f127478c84560a1687eede33e0eba72dc617cd0a5ea53555a265c54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479998, "uuid": "e676f740-4086-4d01-9dea-e0f65b72ab64", "comment": "Malware payload (Mirai)", "value": "401290f5b5f861d8e35767886fd4598f4a2f0476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479998, "uuid": "bcae4fef-2796-4010-a9a8-24747601af1e", "comment": "Malware payload (Mirai)", "value": "591d6d4f9ab71d0bd21faa17d5a4b0f816d1ab7f86117d2fd9e6a1f365f045164f90f2ef9f47005750de134ff7682634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479998, "uuid": "df4723ff-5448-4955-95de-231711b5116e", "value": "T19D03F1DFC5A7CB86D4FC3136852B391241A042F94B80CE5268D46AFEEB60F5D3E1925B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479998, "uuid": "d44a04cd-81ff-4df9-a5fc-4e291273b8e3", "value": "768:9QhWdIEvXV5Da0GqSB++wG1SuVmxVCgswBYaUPnbcuyD7UHQRjm:9PvXa0GqS2I8YgswBZUPnouy8Hya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479998, "uuid": "04170f2a-d72d-44c8-ac13-494a4d0381a8", "value": 38236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479998, "uuid": "781f1c04-69d7-4241-a41b-5371757f01fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479998, "uuid": "86315829-59b5-4ce1-bd2b-b81a34472728", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444d0446-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503934, "uuid": "4f9ccea2-1d52-404d-a1db-ba4638a143de", "comment": "Malware payload", "value": "2ddebfd7142df0abda7da84fd1964550", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503934, "uuid": "65e8328a-68a2-49fb-bbb5-87c51931f664", "comment": "Malware payload", "value": "7219f462857e20403543f902b5ffa3cc13039034c28776d58a9c8602f4d8ead0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503934, "uuid": "6adecb1e-36c7-47b8-8334-837f24cbaa9b", "comment": "Malware payload", "value": "f4e0b9489208af66c53f560e3a65801fd3d57f76", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503934, "uuid": "b76e6606-175c-40f9-84c3-544034a51a4d", "comment": "Malware payload", "value": "c4d2f8fb05ed29934d58b55f2454d011f19a1f6fc3ab49c0c8511ed24620fa0662c22c0d2bf5660d1d11ffcc17e30e3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503934, "uuid": "b0e96bc7-819e-4674-97ef-e97825227628", "value": "T1EE11F1EEF0D43015C5FC8E816076CB597888EAD622400F6ADA8E64F5BDC8938B252B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503934, "uuid": "7a143fd2-4416-42e8-a73d-9b204d930017", "value": "12:sTLYTL/tCw5TLTNIbVTLgUK+TLTwrx9TLTTLVoTLNTLCETL2TL8TLj8A:s4H5zNIB9K+Kz1otZWcQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503934, "uuid": "0603e59f-cefc-4c9a-9501-5f47d82fb2ad", "value": 966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503934, "uuid": "5fbd13ab-6a54-4587-b88f-4dd5e165c1c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503934, "uuid": "3ffd37ac-6135-4c6d-a741-5292a943bf3c", "value": "wproxy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6963990-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513655, "uuid": "fd8aa51f-8b87-4b6f-ad00-ef1249d7c931", "comment": "Malware payload (Mirai)", "value": "0e31a9d19ec7441aa6b586ff1065322e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513655, "uuid": "8447e688-a96f-4b12-b781-daa53f2a767d", "comment": "Malware payload (Mirai)", "value": "729589a58233c3228b00da1aa10233d0713f5e041392ba4c54ba7b789b7e2de0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513655, "uuid": "d523c935-210a-4022-a779-b12df7d04618", "comment": "Malware payload (Mirai)", "value": "57314cbd4473f351e762c8c2770df4cc41875f9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513655, "uuid": "e287ca17-0a03-4254-9f54-dfa158b3c53c", "comment": "Malware payload (Mirai)", "value": "75f17da12db7db9f493eaa77a2c438050c8e45c651ad3105ba2256a3e9fce53ee0d3dba4927a9043b8dd60aea2c03e98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513655, "uuid": "f9086e60-1e32-4d4f-97ad-6382c53841a6", "value": "T19C832ADAF800DD7DF40BD67654270C0EB930A3C10A925A3777ABBDA3AC761A53817E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513655, "uuid": "edfe9521-8a70-4f42-8da2-0b3b86adfa0f", "value": "1536:XN7Bj+A5kGIJylZT94JRWHZbwOOtEf8Z5IwNR1QbQfDBm+TXulXwVoL/T8:XNMOZsIh5OtPl+bwNdBVu/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513655, "uuid": "cd5fe1df-4823-4b0f-96c6-129043ea77b3", "value": 86112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513655, "uuid": "8288e6ec-e232-4678-bc4f-ef23c73c1ee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513655, "uuid": "0343fd7e-9e62-4e38-94a5-878336a01481", "value": "top1miku.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06a6a32-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485191, "uuid": "c1009aa4-457f-495d-a7fa-e5a206c50dad", "comment": "Malware payload (Mirai)", "value": "9a6dd1d11b8e67a5ce8bb9934077c383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485191, "uuid": "ef3f032e-9b55-4059-9113-68191eb2308c", "comment": "Malware payload (Mirai)", "value": "730de199446522671f299147b89d9e1297687cbcfe14ae5032bbe1ff7169a0e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485191, "uuid": "69491d8c-e687-4171-ae50-2d235d1ed538", "comment": "Malware payload (Mirai)", "value": "a346f7334ddf4bae0b5cb85938a7913c0ff6b553", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485191, "uuid": "8529a2af-0a44-4796-899f-bb59f4e1067b", "comment": "Malware payload (Mirai)", "value": "be792ef7f0fe96f1cd03441505b258f7a4b08d002668c0afeaafb59013a360fee1b3a919fe7a8123b087cf6697712ab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485191, "uuid": "20666640-f509-419e-a9f1-e260cd3c3527", "value": "T17B83C74E6E329FBDF9E8823457B34B20635923D623F1C589D2ACD2051FB024D646FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485191, "uuid": "74a7d531-a22a-46ab-8dae-0bc370c35a39", "value": "1536:/p3P9KcSttrQDQnrkh+hvT0e9VQD4/RoC:FPdSttUDQn4h+9Tc4/iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485191, "uuid": "ed995c30-7cdc-4ca9-8fb6-971603e4f18d", "value": 85884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485191, "uuid": "5a7347e3-b003-46ab-89b6-926f742a1030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485191, "uuid": "787ba77a-086c-43fe-a2a0-20560c78ea94", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fc30a0-6069-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752466515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466515, "uuid": "c2ddf16d-8b5e-4bef-ad2f-bab73cd90481", "comment": "Malware payload (VIPKeylogger)", "value": "377040e118660c8f763dd0f2b5e97e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466515, "uuid": "09a744e1-c337-4c14-9946-3e8edcdb24a2", "comment": "Malware payload (VIPKeylogger)", "value": "731250bf56804235645eda6c028fc5724dad802a1d89cc4b94e1c40509bedbd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466515, "uuid": "f07d6c91-0d03-42e1-a5a1-c26796c7d05e", "comment": "Malware payload (VIPKeylogger)", "value": "3df6bc071091aef98e2c9a6f90ff63576df2c1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752466515, "uuid": "5eda09ac-53ff-49f6-9440-7e3960075f6d", "comment": "Malware payload (VIPKeylogger)", "value": "e1ccee828c5a7d33d75a33257906888525b07a75b00f15954b88faf2f1cddc0bb23fe564c4184cd743db48146b833052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466515, "uuid": "b201c437-73a3-4f2c-b87a-4f41b3905314", "value": "T1B9923B84D6EC4533C6AC223A287B174A03B5EA73F492EB0F5DE4D69729063D484147E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466515, "uuid": "695daefb-6779-4677-b932-16cfeeb775e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466515, "uuid": "6ba48c07-c9b0-4ba4-a571-7807675d137e", "value": "384:bNBm/ztvTFrVlJRcsEvk/aiOZ8DlsECuRp:TmLJGJv8WduRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752466515, "uuid": "1b4cb550-6e8c-433d-8ac1-08e57aa9ccfd", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752466515, "uuid": "9c28aa01-6f7f-4558-92cb-fbdf5b7c7885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752466515, "uuid": "b6f2a4b9-871c-42b2-9110-89f07dabcf8e", "value": "Purchase Order 110241.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049359d6-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752473333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473333, "uuid": "5ed55e89-9f11-480f-b340-6b8f668a9ac0", "comment": "Malware payload (Mirai)", "value": "b9b90aae97d6a22b7764953a67a9ec07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473333, "uuid": "1002d63e-5992-47b6-808d-8990dc965506", "comment": "Malware payload (Mirai)", "value": "740653d7a9aca7178facfbc397c6f5bfb83119fae53f21cf12ed73ed409ac336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473333, "uuid": "4d37d2aa-3423-4df7-ade9-a0d3c9b0fe6a", "comment": "Malware payload (Mirai)", "value": "b565f0f1bdcf07ea49b9e52734206b8dc02b9dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473333, "uuid": "466c1322-c692-49e3-83f8-5a408598123b", "comment": "Malware payload (Mirai)", "value": "a1d4d0a48857b7bb2469b4369be7cff9c860eb33bd7b8e3341d649963b3bdcaae0936f8b1e9ea12bc95da0b63da9c387", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473333, "uuid": "b7cdc8d1-abd6-43e5-865a-98679ea87385", "value": "T15D938DC2A683D0F5D96641B1543BE77A4732F4396119EB87D36CAD32CC91980EA1B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473333, "uuid": "84a14dcb-efb3-41c2-b4cb-6339a894a330", "value": "1536:DRti4Aj4YHPqh8pbbek1tY8mfDsBuLppC7wMd2uiS9FV+1:DPiNUh+ekHY8mfIGCEMfro1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473333, "uuid": "f4f3b3f3-7e0b-47bb-8f3b-f6c75e279e6c", "value": 92360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473333, "uuid": "e18e262d-e0dc-4a3a-8cb1-9a0406a75952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473333, "uuid": "72d000bd-ef9b-4220-992e-68d79f635110", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2702049-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494670, "uuid": "84237ab8-2993-4122-9325-61fb28c5ec83", "comment": "Malware payload (Mirai)", "value": "5ab34dc7f4f2a2aa1d53919164d21913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494670, "uuid": "52bc2324-1210-4726-8045-a5a7f6138c3b", "comment": "Malware payload (Mirai)", "value": "750bd54389edecde2db38199ab6d1e6e64028f06453b50055ed2fae8309fc13a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494670, "uuid": "b861bc53-4114-4b25-97bf-9bcff113f222", "comment": "Malware payload (Mirai)", "value": "069d02079982b7625e2801d2e7b6af5934f7f687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494670, "uuid": "50e8ee23-5eb7-423f-803c-de0e85896dd1", "comment": "Malware payload (Mirai)", "value": "b13e944a20bd1305db6b4904766925bb95ebd9c4576fc7a5534e7dc709e569b31db6561573d90c60c960c06a3affa343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494670, "uuid": "12095a68-3471-4bf2-bfc8-a04ed1fcd9c1", "value": "T1D6730A85B9819B25C6D513BBF91F018E331657E8E3DE73129D201B607BCB91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494670, "uuid": "53759974-e9d8-45aa-9210-2595cb7e3d6d", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494670, "uuid": "0ece68c0-754f-4a58-aa9b-3519000447d7", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494670, "uuid": "19ec0c63-177f-4ed3-a659-7ce2d99ec688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494670, "uuid": "8d2168ae-cb75-4451-8909-4684c99c368e", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ae89f-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485085, "uuid": "6e26166c-8411-44c1-a929-8571cf437d3d", "comment": "Malware payload (Mirai)", "value": "fb36485276d6bfd74af85624258a46b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485085, "uuid": "cf7529db-d1ac-45f0-b8d3-f2716ab1bc09", "comment": "Malware payload (Mirai)", "value": "762dc6d520a090ae2258cf3311a0c0bfb0a1d14c7963c2c18d2c4cd8c57f04e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485085, "uuid": "98b4040f-9b0b-4546-9ff8-85d94debbea8", "comment": "Malware payload (Mirai)", "value": "1693f570127e727c88baa117e3e72565d47a120b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485085, "uuid": "95ffd9cb-ff0c-4b27-b901-894c9259c5e1", "comment": "Malware payload (Mirai)", "value": "bdaa1d5f190ff6c2046dbdd65f76c40013e5ebe26e8b24b5a967f84b4667f10700ec8ae5db63098d2986aa561412cf4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485085, "uuid": "c6abf911-6e97-4363-8d06-79f092a8889d", "value": "T19F83199AF800DDBDF80FDAB74463490EB931E3910A931B377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485085, "uuid": "c12ae5e2-0315-412e-9ea0-9d5580db224e", "value": "1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7Ikn:4G5hLsd9lJP4npeqp+psrbIkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485085, "uuid": "cdca71cd-d88a-46e3-a09e-373b84ce5da9", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485085, "uuid": "8a593bf7-a0ff-4e3b-9600-3c41ebb014c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485085, "uuid": "223b91d0-653b-4524-9806-1ac4b0863fcb", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a795cb31-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480049, "uuid": "17eb1458-1224-4572-bb53-6c45c6ad63b6", "comment": "Malware payload (Mirai)", "value": "5edcf975cfc4356f8cb3bf8d86e66034", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480049, "uuid": "a11ae28b-bc29-40a2-9df3-a43111044008", "comment": "Malware payload (Mirai)", "value": "76672623a8d34b96bafcafee68cf48f0c6c5b2d2e7968b3662ce31b972ef8461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480049, "uuid": "dd93584c-b1c1-4829-99cc-71384876aa01", "comment": "Malware payload (Mirai)", "value": "c0ee43a0232af857ca5d2c2fd9ec052eea9e7116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480049, "uuid": "3f0fabfc-eef5-4d62-9223-20a6ad07586a", "comment": "Malware payload (Mirai)", "value": "55a2e4ce27f5c6a1d1c303940e1384013b844fc2a03abd3b5c9defa84bc2b4ee0789096f79994900bdd714687a72c28f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480049, "uuid": "09105af8-b9cf-4829-87b2-d7f120cd2b8e", "value": "T11A932A56FD819B21D5C102BAFA1E128E3313177CE2EE73129D186F21778B92B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480049, "uuid": "00969e2a-529d-4cfc-b17d-df14a9b94d39", "value": "1536:j9fnF9YzeUK0/V5F0Qi5hk60GlCJ5EHrawHuSVVzIUXi9BZapJ37uRY1ik:jfyzeUB0QiovGgJuHrawnsBZapJ3iR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480049, "uuid": "f91119b6-2930-40a2-b9cc-22ff7eb15b4c", "value": 91952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480049, "uuid": "2551e16e-c222-46c8-a31b-d8840ee8e617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480049, "uuid": "ec83e44e-ba5f-4b16-a4f2-3b75648cc100", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a74a3f-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752517254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517254, "uuid": "8b18af68-ba41-49d6-9526-a1e1ec1b3f04", "comment": "Malware payload (Mirai)", "value": "8de3a794e728a90b2508e05fe19fb5c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517254, "uuid": "3457ccca-5a0a-46f2-bef8-ac558570ae5a", "comment": "Malware payload (Mirai)", "value": "76be35dcb50304c6e66a8463c9486b813d0f9aff2a12b4715f93166ea80acd75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517254, "uuid": "8e76d66f-5eff-43d8-bc0a-058bc2408063", "comment": "Malware payload (Mirai)", "value": "bef35ecc8ad3b2acca846bd9cc9360a2a96c9eca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517254, "uuid": "dfae99f0-8489-44f6-bd4c-946d807d6c4f", "comment": "Malware payload (Mirai)", "value": "6ca3466effad9434dd87e779bc8d2f7bf943849cce1ec41bc4425b95946251b3ce3b5fae9c4ca95c2d4d18cdcf6252a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517254, "uuid": "38cfd663-ea35-4b6f-a80e-3b068db122ad", "value": "T1C683C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517254, "uuid": "7f8907f0-fedf-42ad-aa40-c79113edd124", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAPgR:x/8RHTgMcJ0fmqJZOpkM/4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517254, "uuid": "ecff4cc8-62e7-4f44-9ba8-c291173c5265", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517254, "uuid": "b87e92ad-d8ec-491a-b594-99dce314e236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517254, "uuid": "01202d2e-6b53-4e02-960d-bcbfc282a018", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9681f819-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536714, "uuid": "f6602a9f-7fac-4e4f-b0bd-878edba66d31", "comment": "Malware payload (Mirai)", "value": "94a999b67256e192c0e777510c88ffed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536714, "uuid": "145a79be-7af5-4bfa-aced-a1b52b83d86b", "comment": "Malware payload (Mirai)", "value": "7747e13147c2e864923c9c8529f91c08dcda058fef56b70d8269e2f6caa09021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536714, "uuid": "4b3d4aee-2076-46c4-acf3-064818cf6f9a", "comment": "Malware payload (Mirai)", "value": "082cca829daedc084066a7bab8d8b0b52087f07d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536714, "uuid": "8bb6af9e-a0f4-47f9-908f-938d42f01606", "comment": "Malware payload (Mirai)", "value": "239c219d42bf2ae89d992d72defe64d863d5cd3589c7a57506504f688691dac90e4839c5fad27233b6a37c5c42c69fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536714, "uuid": "d9bf5cbe-283e-4149-9208-ebff89debdd2", "value": "T127B3F707EF554EBBD86FDD3302A91B0634CC459716A93B7A7A34C928F60A50F1AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536714, "uuid": "446b21b5-6eeb-4345-8788-07cd10d26608", "value": "1536:VuUCX9N8f0syj7XU29oifcm2LASHZu7CQxUPtO8yDWas:VuUg3I01jPX2LvHACLYq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536714, "uuid": "1264e4be-8573-4d92-9dce-0f20e6fba9a5", "value": 109864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536714, "uuid": "c2cd433e-4ccc-4e2d-8f3a-d21b13f41488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536714, "uuid": "87a81e14-f47b-4a0c-b6c8-ab5a6688dcf5", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2b74e2-60f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752527918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527918, "uuid": "c72cd9cb-bc9b-4c0a-9b21-17400bab2011", "comment": "Malware payload (Mirai)", "value": "5f5cb5976c54c5ce472f07cb2cf10f33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527918, "uuid": "2d2ca954-3982-4831-83c0-5783434676bb", "comment": "Malware payload (Mirai)", "value": "77671fc1342f7f97fbe03a9a37855f28333758915b40a6fee29775a691a4dabf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527918, "uuid": "d5bee755-3c68-4e03-aaf4-5f9873a5586c", "comment": "Malware payload (Mirai)", "value": "f46289f8e4a94fd30ae32741b9452d36c4909df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752527918, "uuid": "b9c7c36f-db31-4e6a-a64e-7e316992352a", "comment": "Malware payload (Mirai)", "value": "fc1a246ab3086d5d985ad5fb6288199e5ea940c3e30b0e9c8bdaf1ef379f9b35626144eae782a552e6bd1dab8f588984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527918, "uuid": "7608460b-f066-4560-81a8-d3b6050f7cbf", "value": "T158633951BD819A12C6D1227BFB5E428D772653A8E2EE3303DD256F2137CB81B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527918, "uuid": "355de136-6c58-4350-b906-a3bfaa1a2299", "value": "1536:t3mhXqB8/JYhE+N+fVPOzeCRoQHu5rH+Oo2+LiHCK3kH0:t3m/mhE3ZeeCRowk2iii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752527918, "uuid": "c6464be6-956f-46a2-b71d-df5db6f7fbf8", "value": 71532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752527918, "uuid": "058be4e7-8f98-4012-bc0b-6eb865d8169b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752527918, "uuid": "b33b7a54-4d6e-4e1d-85b4-3a2ffd788d46", "value": "SecuriteInfo.com.Linux.Siggen.9999.13510.549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5510d17d-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485064, "uuid": "fefbee8a-684b-46c6-bbf7-2efcc42d804d", "comment": "Malware payload (Mirai)", "value": "8abbdba1621403474192f60c0c13fd6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485064, "uuid": "0dc0ddc3-2b7d-40d1-ba2b-b920b8b1104b", "comment": "Malware payload (Mirai)", "value": "776dac14824df560f18fb3f0772640bb5fbba9f0c213cd778ec1bec525824639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485064, "uuid": "1f85be54-f228-438f-a6ad-3fa6201e561b", "comment": "Malware payload (Mirai)", "value": "4772a7f1f50147c1d7ff91e39c2cd50d1ccdda65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485064, "uuid": "c37618f7-58b0-4d99-b621-468ad2bb92e7", "comment": "Malware payload (Mirai)", "value": "29362b5a406902e263b81132828ce361a0e487cbb7b0053d8403ba090e5605dcf3c347c31e247632400a97a68425e683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485064, "uuid": "a6c58776-03f3-4537-8afd-7de4eda6e0b9", "value": "T109E2F150131B6CB5E1B06437AC98098B7B2B2B7D78FD345540589FDC8A862CB4B3679F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485064, "uuid": "e449c1f3-a805-4909-9afb-ff91b7a7bd1d", "value": "768:pEKkUgXgGM24v7YrhMYm3n7lQ33C9q3UELdV:dksGZnle833L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485064, "uuid": "247d0050-09a0-4798-92f9-b40bab47e8b0", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485064, "uuid": "630d4795-fd26-41f0-a08c-1252d7211442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485064, "uuid": "ea97b9a2-33fa-4c04-846c-a1420494f2af", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a334a6b-604a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752453210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453210, "uuid": "c44a8f1c-0195-4483-952b-cfef42b032d3", "comment": "Malware payload", "value": "cf6615cb2b9ff86eda8b0549eb3890d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453210, "uuid": "83e14d50-2d0b-45aa-a6ce-3b83d7dc57a9", "comment": "Malware payload", "value": "77e6c905f8bfed5870e2f2e473f852134e71da70ceb35c6ed8377923a7f33960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453210, "uuid": "ac4fb0a7-e887-447c-959c-5920d0c154c7", "comment": "Malware payload", "value": "1c3c31c6815f4748ad45f40507ad604dba8d8a90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453210, "uuid": "6153d2e9-0939-40fa-8ea9-ac58a81faf87", "comment": "Malware payload", "value": "2fae317394e9782abfc92045be6c59d77b3c56c7ce3635f1ec06c93eb3e64313428badedbc86da8a8ba98346f1a72577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453210, "uuid": "85ba2c52-25ce-4aca-b29a-90f3b6519a03", "value": "T1BBE412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453210, "uuid": "8bf9dff7-f7a6-46a1-90ff-98c798a686d4", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752453210, "uuid": "8de7be0e-9c02-4a95-b9fe-dca59d6b86a6", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752453210, "uuid": "89ab30fa-90ef-4dc7-a647-712685dc5f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453210, "uuid": "b2f76977-8057-4162-99e2-3ea4d2d14a5e", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7153a08-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485202, "uuid": "7de0d558-8999-481c-ad3e-5ef8080cc95f", "comment": "Malware payload (Mirai)", "value": "e9b821845f117c40755836f220d655c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485202, "uuid": "36a38e22-25bc-41ea-9101-84f45bdecddd", "comment": "Malware payload (Mirai)", "value": "7889a019616a9841a855244464893495403650e86d3d5084233f83f1e6be96d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485202, "uuid": "b428002a-6a2d-4743-8b9c-84280db67327", "comment": "Malware payload (Mirai)", "value": "5d28bf056beb1663d2a2050e97e3111a8902bfbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485202, "uuid": "88d21961-f33a-44ec-9a7c-ef0378688fa7", "comment": "Malware payload (Mirai)", "value": "688adbe7c4f5151cea0e6cf4066530a3d6bd722b1d15c286c5c46b9ce7923401a09686afc128ba4b38b08a3de8e0ecb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485202, "uuid": "78dbae33-2763-493a-94b7-c75d9bfeefeb", "value": "T1A8A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485202, "uuid": "b3077f16-bb93-4ba5-827d-d9bbb81651b1", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj6jNYK:5ZzjJa1rZ62yqPy/ULWzj6jN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485202, "uuid": "fa3fead1-6f1a-4061-b232-408e57701464", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485202, "uuid": "c156a1cf-9505-4300-ace2-cde7066c8c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485202, "uuid": "a9abf119-4d55-44f8-a744-82c9682e4df9", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06eee54-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504652, "uuid": "73a677b7-c7d6-4d25-874b-07930b0d1982", "comment": "Malware payload (Mirai)", "value": "8b530774bdcc2cfb2be1bbabd2f7f5bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504652, "uuid": "91b9abf4-ac5c-4512-a87d-bbdb4fb7b180", "comment": "Malware payload (Mirai)", "value": "789e2bf6facdc211f41d9e0aa06afcf5f2a9afe1daf3cad34ea649ee6db01af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504652, "uuid": "580e49f0-8ab3-4560-8328-28e2872a8a10", "comment": "Malware payload (Mirai)", "value": "0ee561d1ea4316fc9d21ba67d927a90ce43f0d5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504652, "uuid": "4e20c6e3-10dc-4a16-8b20-d6afef427498", "comment": "Malware payload (Mirai)", "value": "eafe934e04f70821787904e03d882524a5922d14e49c9b52d0303ba17c04fb3f07997bfa558ae2e8e03a02a719467002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504652, "uuid": "e4c5450a-d712-464b-9d5f-1becee377d98", "value": "T15033F1126704DC23E6F5F9F66FD5088DBC9C2FBC876F692222A498A441931C547F8E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504652, "uuid": "d8dfbc36-fe67-4f34-88a4-7a18aa3cce1a", "value": "1536:NP+rGKDZN103JdOSB8RWML15J6RN2y3hcWtr:4rLvICDlL1z6RfFtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504652, "uuid": "0a8f733b-28d4-4f12-83da-72dbff480fe9", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504652, "uuid": "afb4fba7-e062-4bea-b002-2d7c6f05b9eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504652, "uuid": "66c9f8c6-448d-4ac3-992a-6893c3362292", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76a5d6b-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517468, "uuid": "a0aedf20-3154-4da4-871f-8f9338f8a131", "comment": "Malware payload", "value": "f92c3af5cf80aeedb8930145f1d8fdde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517468, "uuid": "edafd7d7-f67b-49b8-bd0c-b43d661eae3e", "comment": "Malware payload", "value": "791d99e25c2fa3f1157a5fe6b2b56fe492d80deb6bcf6e37d49e5b1ee24ad41d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517468, "uuid": "b1deae62-3828-437a-b931-7012080bb97b", "comment": "Malware payload", "value": "03f96533402568780fd4b75cb733a3ec2056c3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517468, "uuid": "4b8f6e35-3be4-47bc-af72-45a3628d5266", "comment": "Malware payload", "value": "bf6dc051e8c3c09bfcc036fd54a511e744a5ba3f210500b2b2ecc0e6fca28822e45d9de3bda683ef7a472c8482a2bff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517468, "uuid": "5e7e449e-4024-4844-ac9b-52d6282e231a", "value": "T13C242B41B8409623C1D319BAB91C4A8C331F2BB4D7EB32A5DCD51F382B86B594E3A7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517468, "uuid": "a406425a-8f69-496a-8c54-0e5e40cb2a70", "value": "6144:Zl2+Fw/q7ZOBeeaaSHLJ4uh/oMpuf+ueWxD:PtF3OB9SH14i/oMpuf+ueWxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517468, "uuid": "956eed7a-aaf1-43de-8056-f8f26fff1192", "value": 226488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517468, "uuid": "a9bb789a-2942-416c-8a7e-e3051862bf90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517468, "uuid": "7224e2b2-a327-4661-8a1e-6f8656441e09", "value": "narmv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837fd0b8-60c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752506187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506187, "uuid": "511ca74b-640e-4135-9dd7-90ca18aef4a3", "comment": "Malware payload", "value": "4fd47beaf3b7bfa5b1eafa15a36daccb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506187, "uuid": "693e1764-89e3-4a5f-8486-9aedd2a085bc", "comment": "Malware payload", "value": "793a2b5cc8362cace4d4661b9478576fb150accb60ed898b431a60e1aa25a717", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506187, "uuid": "f24320a8-5113-4e4e-b089-dcd0efddf59f", "comment": "Malware payload", "value": "1afded6472518a293e4cabb37422292e6b686cfc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506187, "uuid": "80fbc41c-de72-4c01-a2e6-3041644c6cfa", "comment": "Malware payload", "value": "3c36ba97e25cbb04fa10c34ab5548feea3f50eb5716a3be37da021b4f816c286e47719dfcdf106100f7dc031a114a195", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506187, "uuid": "053bc3a3-f1d4-4635-90ff-a14dd0e9dfba", "value": "T13E2181CAA0B00AB08E51E92B3356949574F997DB76CB4FA99CEC3CF9404EF447009BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506187, "uuid": "7569a280-1a0b-4c65-b37e-5755b973edda", "value": "12:j0F89a0F8A0Fec43f00FON9h00Fxl0Fu00F81F20F1zE00FLb0FkV8ph0FXv0FU:gkfUec4V29Dcu98fRE9E5CkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752506187, "uuid": "01a5e6fa-9069-4ac7-93ba-e8c183d58eb6", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752506187, "uuid": "bfcda807-6513-4e31-a332-2343df79c488", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506187, "uuid": "54ea2196-bfdd-465a-a558-dd6ed715e06b", "value": "yoyobins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591d9cd9-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485071, "uuid": "b33bc79b-472b-42ac-98a4-04e8612ad130", "comment": "Malware payload (Mirai)", "value": "fead155fdb69c5d3f31f3eaaf7c6bda5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485071, "uuid": "e80cd427-ffe4-44f0-9702-abdfbab3dbeb", "comment": "Malware payload (Mirai)", "value": "79a4b5d5da3b329e2166d51b2dc8ce6d3b2a605b5a4957d6667a570f1a9b6e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485071, "uuid": "3ca80fe2-247b-4383-9113-4cd03dc1575f", "comment": "Malware payload (Mirai)", "value": "66cc4d212c0499c63eee6439140b8b429f136d10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485071, "uuid": "46584125-1445-43f0-a895-8e2c6444ffab", "comment": "Malware payload (Mirai)", "value": "a2b279c07a9ddee9f27bcb57d35f9a2f718e9fd2b09264fdc9b46be3cb3d7cccd2e2c2572c33dc08bbd94460f89a8090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485071, "uuid": "9059f703-3906-4530-8591-788b6fc0992f", "value": "T1EBC2E1A1E1F63EC6F7796EA02E64C2C177B04E9EB7B7CCD2255C9F0904A62174705AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485071, "uuid": "04a0b4b9-3cab-4513-8c13-bf6be1862d6b", "value": "768:LG959yM0HWubJsWDYcGQV4uVcqgw09S0a:TM0HRJswYcGQV4u+qgw09S0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485071, "uuid": "b9e88005-a720-466f-8bc2-05a8b7794a05", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485071, "uuid": "d054cd06-9932-4513-8ab5-076d5a179ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485071, "uuid": "9fdfcad9-14c2-41b2-8cd5-cfacb85083cd", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5cf148-60cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752510333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752510333, "uuid": "0719fae1-13e9-4615-be7f-2deded81848d", "comment": "Malware payload (XWorm)", "value": "0862a5a5e96f63ca8a1671038b85e4b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752510333, "uuid": "18c1034d-89cc-4366-8c5c-5b53a8c0e8bd", "comment": "Malware payload (XWorm)", "value": "7a750c94069e372d47b5d6250995a3e8f17db77b0340acae7a3204c68c08e4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752510333, "uuid": "07452903-f5cd-4eb5-8db2-afa9d05de23e", "comment": "Malware payload (XWorm)", "value": "7988a29472ecde462846c25b977fe8c9d2ebc506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752510333, "uuid": "6639e4f9-51f9-480f-aa2f-3a75e47c3cf1", "comment": "Malware payload (XWorm)", "value": "2c410455c41c42dbdd359db4a5617680429cb78a35384342ef6a13de8045c436d4dfd8c8a44afa59588caed6c714c0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752510333, "uuid": "a8674c8b-cf5d-4213-acd0-0fee446835a9", "value": "T16F537B287BE6412AE1FF9FB05EF13153DA7AB6232C03D65F24C5024B1613989CE916F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752510333, "uuid": "b57a8c94-8116-4d2a-8c5e-6e88895b40a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752510333, "uuid": "5d887ab0-1eee-43e3-8f12-4f62be631fbd", "value": "1536:DE89oUeI/1tIYH+kb528tHsJGmcVOHOSg7X7hw:DEajeyH+kb528qYSHOT7X7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752510333, "uuid": "0d7a19e2-829f-4b71-8fa7-ada4d1abf487", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752510333, "uuid": "5d4b1526-34d0-4dfe-8979-84b359acc8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752510333, "uuid": "e9fd3e02-0863-424e-8129-682372b4b467", "value": "0862a5a5e96f63ca8a1671038b85e4b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7479c432-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752477815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477815, "uuid": "1f4999dc-6ea7-48a9-a5b6-5d82f76c8b94", "comment": "Malware payload", "value": "c45a95dc7ebc8c78217cd996a8f6dda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477815, "uuid": "c49f60eb-8cc6-4ae8-979b-b1b21356d58b", "comment": "Malware payload", "value": "7afe577759914245faa1306e68006b662c180bb10cb80001441b2e042bac8232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477815, "uuid": "27fd3942-7226-4a82-a441-b7d375daa714", "comment": "Malware payload", "value": "7e620d9e832f2fba5ab017c2ea2b46a4e17d5a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477815, "uuid": "0a24102a-66c3-4ab8-82c8-c0f6c6a3154c", "comment": "Malware payload", "value": "1a32f7ce87dfbfa2e26a6fc5ef12c12e25b627695023111eda81dbbced425bc55afe3b9f1c4bbe79acc9b1e398cb5558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477815, "uuid": "67879b40-0092-41ae-92bd-e0217ba56edc", "value": "T11552E844FBB8D627DDEB0F358993B2711677B7791806CB2F18CA159A8B223409592723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477815, "uuid": "b7a68eaa-6938-4863-9873-c8c5c31e352b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477815, "uuid": "9fee709e-ee16-4503-b05e-cc58a476eb88", "value": "192:P7XMMHSWaqn3sdzHpumXaiAuKN/t+kVuzn4MsaMHq0MuF+cg:PwMHSWaqnavXaiA9/t+km4NBbgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477815, "uuid": "fc2d0611-13f1-4df4-9a08-ed3613d3be0a", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477815, "uuid": "f3fab657-96a0-4816-a0da-3e17581a190d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477815, "uuid": "113acf0e-1922-4b7f-8545-40836f746ff6", "value": "245728928762524562827654252678928762544256782276542456278276542562782.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9b0788-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752477861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477861, "uuid": "c5576f9e-8af2-4b77-872e-ee25219b2ec7", "comment": "Malware payload (DarkCloud)", "value": "55ceabe00b841f7fba30fd6613e30cb2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477861, "uuid": "4e482213-aab0-4cc0-8bc6-98464b29943b", "comment": "Malware payload (DarkCloud)", "value": "7b9545ff887d497969ef8b638bcdf57f9e1a86bb45b679f66e3532a2175fd8d7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477861, "uuid": "f2028252-d35d-49f8-bfc8-0708a2ac8bc2", "comment": "Malware payload (DarkCloud)", "value": "452becdb62a3d994d8e83e0c23498427db06bc2c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477861, "uuid": "b5e8b9f4-8b2d-43ab-958b-62e569350dc4", "comment": "Malware payload (DarkCloud)", "value": "8c8691e96537da7db4e2442cf40a2547dc4a17c90943ab7cdd4c028ea7ec1b4a3130402797213eac45e1fc85e210d877", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477861, "uuid": "8cb7f401-2197-4756-9f28-8d2d9b2339d9", "value": "T1AA55AD136F9DB260C2725273BA15670DAE6B7C2D3EE1F45B2F9C393CE930121521A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477861, "uuid": "959bcc89-7ba7-4757-9303-36e7a161b47e", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477861, "uuid": "61c1cce3-60dd-4eca-9dbe-62e993729f09", "value": "24576:3tb20pkaCqT5TBWgNQ7aXJ11MmrAFFVZeVg6A:0Vg5tQ7aXT+muw+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477861, "uuid": "e24d7c65-bc70-4262-a044-71fbd75135fd", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477861, "uuid": "5bc877bc-730c-44c2-91fe-f2970e4011d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477861, "uuid": "d7a23c81-4070-4b7e-b391-13e80c42563c", "value": "QUOTATION-ETH002341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8aaac3a-60c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752507216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507216, "uuid": "7df13572-014a-4ca2-8ce3-b7fb8fb449fd", "comment": "Malware payload", "value": "ffa26446eb0e978e158711faaa8bbba9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507216, "uuid": "f362c018-3e12-477e-8afe-2d10fa35104b", "comment": "Malware payload", "value": "7bf2673b3c4a742a551f59f985ec173b9039a23853171e3347af4b76b1651c6b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507216, "uuid": "3daa2d92-8386-4dd0-a697-92fc20553d35", "comment": "Malware payload", "value": "8d126b1c1ae30807ac412f646ea5012f1cea2dcb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507216, "uuid": "0d612800-3b3d-4122-9fbd-f646c758b018", "comment": "Malware payload", "value": "df605a745b8bbfa1f43a7ddb11ecd399d977ca599853bb0b5a629769acb8f2d31c4c7133b25280b43be903a9b33708b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507216, "uuid": "87d18439-cc89-4f02-a393-7c5e5416b9ff", "value": "T192A012EE6410A304C50CCA091052C4603101D1C51DC405B148490537404C6287050552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507216, "uuid": "04fd1ee1-9668-4d29-a0b3-ad88b78a2186", "value": "3:LMFrIdW6aWzSIT7+mbjVn:LMFrIdjjVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752507216, "uuid": "4dd4a845-0210-4d41-894d-67822fdc6ec9", "value": 85, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752507216, "uuid": "ec11e00a-9669-4a57-a9fb-d4678f5b00fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507216, "uuid": "490b3bc6-255d-49bd-9bfc-a9bcdeadf262", "value": "vigor", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec70679-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473565, "uuid": "731b78b2-792e-43d6-b973-bf683a3e48fd", "comment": "Malware payload", "value": "d4a02411c5753bf500be3235bd37f44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473565, "uuid": "a7d86765-0cf5-476a-a30d-7d5f02eba3fc", "comment": "Malware payload", "value": "7c08638f45a29bcfbef2bae6543c66b74e51df5598464a8bf0cb3fbf9c749c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473565, "uuid": "4c60b99e-e8e1-4321-af90-715773664cf9", "comment": "Malware payload", "value": "50149356943700959546919f656dd101bbd3aa96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473565, "uuid": "81ce02b6-de6f-4e74-bfc5-c9ffc69b97ba", "comment": "Malware payload", "value": "246c56c8aa1a93e91379af05cfd023d89eb6aada4af34030374014da5eacf8611e49d6ceccfc28712b173e7daddc3075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473565, "uuid": "d1c9fb61-ffae-49b0-811b-72f51aecd18f", "value": "T16BE53392B5BD0CB3C920CB306083653FFAF8291E75E16FD59B587618CF4271398AD692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473565, "uuid": "61fea0bc-6189-4e2f-b75b-0723068501b7", "value": "cfe6413c63a2cebca46865400da44306", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473565, "uuid": "5d7848d5-001b-47df-8a92-d03182e39b9b", "value": "98304:kGgG4N7762eZDpuNcAtWl6fXWTpwMUw4D+9QNDC:OG4J7G/nA9JMUw4D+6NDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473565, "uuid": "fb0f1afb-73e3-40a7-8d6d-e4953b898dd1", "value": 3306384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473565, "uuid": "464930d3-17fa-4bac-ad93-c51b13d293e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473565, "uuid": "e371ec53-2718-4608-882a-7c69ad92432d", "value": "7c08638f45a29bcfbef2bae6543c66b74e51df5598464a8bf0cb3fbf9c749c7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84abd238-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkTortilla)", "timestamp": 1752477843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477843, "uuid": "b3682c04-9786-4a67-b5b4-f272da4879aa", "comment": "Malware payload (DarkTortilla)", "value": "a035c87cecd8a38e5c8e0b2d4c01122b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477843, "uuid": "80ec6050-53aa-4b1b-906a-cd8e67da0fb0", "comment": "Malware payload (DarkTortilla)", "value": "7d209386ac121c6b641c2ad2062b62cf667c179f6d6132b0f74fb1308928734e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477843, "uuid": "485d816b-342d-489d-b48d-5d782f988983", "comment": "Malware payload (DarkTortilla)", "value": "cc948b5dff32306b2a9916bf2fd757f6eaa2d30d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477843, "uuid": "48b7fe50-fa9b-4067-8a60-b41c8dc604fb", "comment": "Malware payload (DarkTortilla)", "value": "3718c369095b0072528aa18f9a27b2e5d9758a670eaee962dfbf34cb112535743ffbaa4bf8c572ecb5d11efd7dcb5594", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477843, "uuid": "dbc753d4-b493-442d-9382-1fd4e7b81a4c", "value": "T14C1612952B956D80D13D23B054B6A69053B2B2CBE933C37D1689E3CE2B3335A7B8135D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477843, "uuid": "d318c158-32ba-48c3-a34f-7419b1f67536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477843, "uuid": "18866a00-d138-4726-9bff-b40b4a475a98", "value": "49152:ghLSNbGkMpK6M65gT3pT2rU+a7xPsNytdLz8eNN3IOJ3htXoWocoZ53tynAt6x:YLdO6YR+a7xPsNAfpN4OJ3nPo/3tyQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477843, "uuid": "3a711d36-fc9d-4ad4-a265-6e7cc3e2c189", "value": 4189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477843, "uuid": "3731bbac-ffd0-416a-aad2-52bdd8c16cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477843, "uuid": "a9a166ef-c370-4d5a-89f3-89f21295a672", "value": "JUSTIFICANTE TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c74be5-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516393, "uuid": "0ab49d2c-33f6-4f04-adec-d3a459460ce3", "comment": "Malware payload", "value": "ae7e18a62abb7f93b657276dcae985b9", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516393, "uuid": "b9bd9cbf-3b5b-46d4-b947-c99a0c166893", "comment": "Malware payload", "value": "7d514021c472e6e17f587ed30555d3f120653e6c7f8dc25d2331514b92ffd7bc", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516393, "uuid": "984a8397-53b3-430a-a418-34bc61088f95", "comment": "Malware payload", "value": "0bdde2951dedd6791e8d51a1e197c9b167286f2c", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516393, "uuid": "69da2bfd-825d-4198-a547-8282d83866da", "comment": "Malware payload", "value": "e76ba95e641f70c86fc0570bef5ccd7d6b28cf1a00e0b6a2d935b1378605b89655154e2fc988bf6709f0f306e7e236c8", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516393, "uuid": "8a296680-0c14-4fd0-ab8c-6ec643bb88fe", "value": "T178159D41E720BDDFFF4155785D883B3D9A0A26DC0F7C34AD7D8A0845B9B34A9A601B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516393, "uuid": "487e75c6-a4dc-433a-a665-ad6dc71d7438", "value": "12c108d3839179b797c5f5561d51c698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516393, "uuid": "93b21164-33a4-482e-b20a-35a67b220194", "value": "12288:xVYF1aOsXa8YQmCu154m2h6IqtkkiofjzJaVKwi0aK2avMeqxga79:IF1PsKXQmTC6IqtbiofjlYz8SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516393, "uuid": "6f57587f-5d6f-4734-8796-cf96e8bccae6", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516393, "uuid": "794df2a7-4228-4097-8171-bf403953fe91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516393, "uuid": "82e1feb1-650e-48f9-9538-56f1999f7786", "value": "mpr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93b18dd-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480051, "uuid": "d280b135-b6dd-4996-9115-0d28b72b6948", "comment": "Malware payload (Mirai)", "value": "f602f39a8daccc0a385bdc422e399530", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480051, "uuid": "0e3ffc92-40cc-4039-a6c5-5d7d97bbbddb", "comment": "Malware payload (Mirai)", "value": "7d750869f9970a37a91b752b266043dd51e513d5058631786ea54503b3652917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480051, "uuid": "446b95ea-0221-4b44-9823-735b659d6be0", "comment": "Malware payload (Mirai)", "value": "484261130cb6bc89790918877ec3de7a1ca98dd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480051, "uuid": "36eb7f97-6010-4cfc-ab93-7f07f6fec5e3", "comment": "Malware payload (Mirai)", "value": "5e99869bf3bc953e3b13b948263f765723a8ac3a645a542d4650f576c7d0ffefc647b837cb47fd4ed6636ddd1bdc0d50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480051, "uuid": "6567fa33-44d9-4795-8ecb-4f53fd5082d1", "value": "T199833951FD814A62CAC512B7FA2F028D376717A8E2EE72039D196F21378B91F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480051, "uuid": "6c88bc9f-7f91-4593-a553-eb85607afd45", "value": "1536:wcvjnWlb7mHbjPrf/UzVmNdKCc766P40SFc/IvGm3:wcvjnWlbaHvPrf/UMbKC/vxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480051, "uuid": "e05ce486-ce94-47f1-a93b-d6a532713bfa", "value": 83764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480051, "uuid": "8d9f6176-a9e6-42a5-bc94-6a45565dc09f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480051, "uuid": "a2631795-1ab7-4cb7-b3b5-333e4bfe38bb", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5399daa5-609f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Arechclient2)", "timestamp": 1752489786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489786, "uuid": "046dbfc7-90a5-4c3f-b3ae-fdf6fb185d35", "comment": "Malware payload (Arechclient2)", "value": "37bd12f086cca4d2c8155cb457b53f07", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489786, "uuid": "6e865a60-2050-44b2-a135-fd7dd7a22846", "comment": "Malware payload (Arechclient2)", "value": "7dc2ddaac0f6c54d774f6b336fa15a249fd0d5e74a903e7ada07cc00772c8341", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489786, "uuid": "bceff538-1983-43eb-a039-84db57f37288", "comment": "Malware payload (Arechclient2)", "value": "ba694632305ac14aeca71e80cae468afe73bb86e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752489786, "uuid": "d330fbca-5237-4700-9d59-063fbbfbe133", "comment": "Malware payload (Arechclient2)", "value": "7ac2cb40ed02daed82c91196332f843167020d9c16fc85f46c0e99998fbd7b3e518e53404547ad00a90fc7e5ccc98cc3", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489786, "uuid": "8bd00ba8-eea7-485f-8fcd-096d4b1ef920", "value": "T124D533610FA0E007F241B639F6B467EA8EA5A0F5F7129D64630177A1FE2735B23C43A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489786, "uuid": "f2116cec-e3f0-4006-a879-0a36d74f57fc", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489786, "uuid": "39035da5-21bb-4f5b-bca7-864f12c08c5b", "value": "49152:lLNTdKDSqhQVb05hJRvbaiDc3Tdcvu7ZiJsIyF6+Ab8nkN/XWMqf8qNTFMN6n:lLNo3QJiJRvA3TdcuxFBAOIPWlHWNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752489786, "uuid": "4bc56d32-3ceb-4c0a-b1f4-ea2cb7a7e19b", "value": 2936104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752489786, "uuid": "30b6df3f-8a0d-419d-b9c0-ac4b016cca4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752489786, "uuid": "3d13b4f1-2adb-4147-99a5-d627d0879b19", "value": "XMouseButtonControlSetup.2.20.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e1ab25-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505141, "uuid": "df873b23-f4d3-4f05-b563-f8915281cf45", "comment": "Malware payload (Mirai)", "value": "757ceac11312a8ab69e5ca5800073d26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505141, "uuid": "41f4df1a-528c-4fca-ae1a-03574968f099", "comment": "Malware payload (Mirai)", "value": "7e2b5a5e95c36c05a0a4069649ba46202fc8fd20eab5c7d92325804bbe1dee83", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505141, "uuid": "9d2ef403-d19a-4eb8-8752-579e8beda2fb", "comment": "Malware payload (Mirai)", "value": "07fd76b60e0f29fd28470d25af3e57a62e1c684b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505141, "uuid": "29c469dd-617e-4614-a7aa-ad1f00b52388", "comment": "Malware payload (Mirai)", "value": "3f93343cfb6679dd6d71accbb209ce6593d14a73d7688e6d0f2ecc4f6f2e3cf43fb51b032586ec75330055897d30f203", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505141, "uuid": "edca32b5-6104-4caa-85ec-618cc70e12de", "value": "T1F5E06DCFF42BA3620802EE85FD660E04A885E3C4206AC709A5DAC47B84E8B40B835F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505141, "uuid": "12e65684-5070-479c-9349-a67f646fcae1", "value": "6:LyTJ+5x8tzNI7ZvSC8tkNLsvSC8tEUAsvSC8tqlvSC8t6a0LKilvSC8toanIF:UJ+r7RxZ6x3ZOxx1xc0LKexlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505141, "uuid": "5431a079-bb9b-4059-8920-4f5f819893dd", "value": 406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505141, "uuid": "8e50f423-bd70-421c-878e-c42363fd5c9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505141, "uuid": "a2523aff-9728-43c9-bbc6-3ccc7294ee3a", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18539e98-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493123, "uuid": "20da0e10-5cad-47e4-9508-6054d76898b1", "comment": "Malware payload (Mirai)", "value": "21f322174743d8d0b666a414baf1ca4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493123, "uuid": "7cd9b86d-c352-40cf-b136-5707e17a40fb", "comment": "Malware payload (Mirai)", "value": "7e7cf43767665755334a73a56ff260b1af8d18c3f639aa680734df338ef6c20b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493123, "uuid": "e92402e2-2650-4393-92f1-d9bd7d2a7d16", "comment": "Malware payload (Mirai)", "value": "fb9baa61add7a0f71ac69f0c9d7445d008740ef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493123, "uuid": "7087d48d-63a8-47af-8981-94924370b025", "comment": "Malware payload (Mirai)", "value": "1ecb9490144cb71feec37ae15e7e7b7680dc7e4b9a208882260ce78eb99418bb6cf6c9c8ad8dfdbaab49e581bf07637d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493123, "uuid": "ad930874-776e-4dca-9332-3d0bb53d2ddd", "value": "T122D32945FC515B13C6C662BBFB4E428D3B2A17E8D2EE3203D9255F61378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493123, "uuid": "be8d21d9-b29d-4631-850f-73936098d6e6", "value": "3072:UQYqqNV+ooCRrmW47JRNj/ixCsSy7Mo8f:UQOzqW47rNj/mCs3wo8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493123, "uuid": "18e9349a-8710-4c8a-8463-996e3c343acf", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493123, "uuid": "fdae6357-ee9d-4ef7-b3f5-c161e73d09dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493123, "uuid": "780c9d02-f490-4700-80ab-81411c349137", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecab844e-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1752473722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473722, "uuid": "f17e5454-1ead-4a86-8ae9-5a652c06e36b", "comment": "Malware payload (PureLogsStealer)", "value": "319478d839aefde02ac90252e2bf110e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473722, "uuid": "e00c85d7-9944-422f-adc5-9d820ce068e9", "comment": "Malware payload (PureLogsStealer)", "value": "7e8a5ab5b3880028eba6dfb8eb5fe248bd06b8487ce34cac630bfa90fe38be88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473722, "uuid": "dfcbaa9e-1bf8-4e44-a36e-f06c67dc6958", "comment": "Malware payload (PureLogsStealer)", "value": "c12000c43d8cf25d15cc0e948d7def9b4ed96d1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473722, "uuid": "131c3823-e462-4d75-ae81-c045a513b5fa", "comment": "Malware payload (PureLogsStealer)", "value": "4aaca66ceb2ac363eba64c194a0ecf11330f4a899ce383cc61f954e9cd79c906355f08aa654d56c98a5ff3dc59dffee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473722, "uuid": "a1fd6c5b-8aab-4429-950f-95cf3bc85b13", "value": "T1FDF533807BD1D571C5A319720E3A6702B9BD7E30AF658DEF97804A1DA9308C5DA31BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473722, "uuid": "007ebf9b-03a7-4535-a028-52d27a9793bf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473722, "uuid": "ac2a69c2-b9c4-4d21-8101-ec9da98454de", "value": "98304:FlOqXT3RjS+TDxlV8UJCF0yFe0WOeJkefD58QUC:7OqjxTrV8UJqY0b4L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473722, "uuid": "d8bba657-6c6e-45c2-a9d5-77811582a515", "value": 3364198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473722, "uuid": "b5c3c078-009b-466f-bb97-56d78d8fde40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473722, "uuid": "097ca7a0-fdf7-4d3e-9808-80af1195576d", "value": "index.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0e7f1a-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480058, "uuid": "d277e1a4-20a3-46db-8927-1ef656bbc7f2", "comment": "Malware payload (Mirai)", "value": "1c88f285ea921fb6d52dcaa7bf1e9fba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480058, "uuid": "f564a345-389d-4ad2-b302-210dc91022d3", "comment": "Malware payload (Mirai)", "value": "7ee5658827e211aecae595fe079c40a4c35a6b2f801dc7e24e5f41803f99d064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480058, "uuid": "19866bc7-a13b-49a4-8909-fa12416ea7e7", "comment": "Malware payload (Mirai)", "value": "7cb7655a10551168d6ca775b836f8e3002b71f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480058, "uuid": "25fcf765-df69-45c7-bb3d-118a0b7e4fc8", "comment": "Malware payload (Mirai)", "value": "e7c4607ccabaaa18731da2a11fb62126e7c20701065ce93f3c163f3d82fc91cb5df9d24b04834d448a5eb1717bfb89e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480058, "uuid": "6ab6a2ab-d58c-49b3-8b93-f75b27cfa66c", "value": "T174042A46EB818B13C4D227B9B69F424533239B65D3EB33059918AFF43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480058, "uuid": "f597c6f0-7236-4e26-995e-9722a9527ff2", "value": "3072:zHCCltu9GZOvZaQsViVUojpobf1oIbqjH4KFnxXM/98sfcrm1wwobY:ziCPuO2ZaQsViVUupo5ooqz4KpJM/98s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480058, "uuid": "7dc999a9-132b-4b4e-b5a7-5a1ef4188367", "value": 173609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480058, "uuid": "46151485-6b76-4431-9c25-ed9376066f51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480058, "uuid": "3ae3765d-b4dc-4a64-a1dd-6121359381a5", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837e127f-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479988, "uuid": "674bc92d-d0a3-4147-b533-115e7e3284e7", "comment": "Malware payload (Mirai)", "value": "a560ea05c656202a25e659a3a91d3bdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479988, "uuid": "36665464-a259-4064-ae25-77fde5319219", "comment": "Malware payload (Mirai)", "value": "7f0652634262fb2d081e4dbc35d45cfcc8cac0e061862fc7ceadf3ed6cb107c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479988, "uuid": "2d499fce-2a99-402d-a5ea-a9d79c7132f5", "comment": "Malware payload (Mirai)", "value": "faea454ddbddf434bd21b0b5216f9e0eb6cfcd1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479988, "uuid": "6db87606-15d7-4b51-b55a-ef25f9343584", "comment": "Malware payload (Mirai)", "value": "3f23f3c375a26f57be1b92ae5c4eabc4387e888dba202d2ed026fea70212d270075b7194b22de49b50215cebdddcfa9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479988, "uuid": "f01864fc-0468-46d7-9cce-e83425654096", "value": "T1BB618EFA03654E3F6CAAC9D3B2E84504658164AB56CE1F759BDC2CB83E8CEC93D41642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479988, "uuid": "6d47dc48-f700-4303-a90d-2fb158e9d0d4", "value": "24:ItQVGVxZsQVhV2bhQVAVXkQVlVqlfQVnVQmsQVLVUTQVCRVCGgJQVOVZ6QVzVcnd:i+Js5/D/u1K3L8J5pYdMBgJshk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479988, "uuid": "2d1b265f-3df7-4707-ba84-57e38e58a344", "value": 3344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479988, "uuid": "420091b8-dec9-4cd4-ac1c-5a5a28dfcce4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479988, "uuid": "52f80428-f5e6-4fad-a928-224af4810e8c", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e20b5ed-60f1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752525023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525023, "uuid": "bf4d6898-a56a-45bc-8dfa-d3c6df856bed", "comment": "Malware payload (XWorm)", "value": "c2eac887f79a5d813957fe79d4809393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525023, "uuid": "6c248c10-0c75-4c9b-997e-a3e0f9a29477", "comment": "Malware payload (XWorm)", "value": "7f6eacd84180c9f8e7147154d02ad0154718af1ea0780f5cd9775823912f30fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525023, "uuid": "98b1348a-e0f8-4c18-b5bc-6c12403c00ae", "comment": "Malware payload (XWorm)", "value": "918ad8b1ae27ca184e036a0a4318b645290ab966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525023, "uuid": "6ee18f12-0274-43e6-8437-aeb934b5476d", "comment": "Malware payload (XWorm)", "value": "05439c0fe20375c279401dd17e4a593e5a7511a5fadec0134785231796f597fbe46bcb88b8657ebd3db1a2134a054167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525023, "uuid": "dc50091d-57b0-4ecf-b37a-d0dc6be07c0b", "value": "T18A136D447BE5463ADEEE6FF519B3A2060731F5039913E78E0CC4899A1B6BBC0C911796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525023, "uuid": "a23335a0-4520-4089-98c8-16391031be63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525023, "uuid": "5dadf86b-3d5d-43a8-bf50-71ab39d2c445", "value": "768:QeHUrTYj/U2CG0u00OZ8F7KGpClRAERXyFi9OH6UOCh1F/q:PHU/O/U2CG0u6vG7Fi9OH6UOC7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752525023, "uuid": "f5a23f22-6b3d-4682-af80-8d95fe88a055", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752525023, "uuid": "a8b47263-0c6b-4d8b-99b0-d7c75300b7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525023, "uuid": "b3e87923-e12b-4a5d-b8f2-aa63a4ff0127", "value": "7f6eacd84180c9f8e7147154d02ad0154718af1ea0780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48d626c-6052-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752456958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752456958, "uuid": "d1cb590c-cf00-4d71-9937-34b6de300e67", "comment": "Malware payload (Mirai)", "value": "44f913a73a3e646226680da078cd0951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752456958, "uuid": "5b4817ce-d2b9-4916-951b-f7e0a9bd1e20", "comment": "Malware payload (Mirai)", "value": "8011a08b66c570b89e0f0c119025b4911cf7407daca556d597d437ed7d212e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752456958, "uuid": "a095dc4b-2467-40cd-bf73-68753ad4cd78", "comment": "Malware payload (Mirai)", "value": "a84e16c0d67b987fbdac382f715cbb3a2f1f360b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752456958, "uuid": "baa34117-5bce-4a15-9f50-b0de331c0b7d", "comment": "Malware payload (Mirai)", "value": "cd4e32ddac9580225554a2c48b5c2845ce9688a62f2ae2209da188b8069616a75a6c7de12ebbda3756b9d08ba2aba558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752456958, "uuid": "7934133f-8dbb-46da-8bd7-bc526f0e4b97", "value": "T1DFF2192375760E07C0E13A7A31DB1B5A36960BC8A794D6AF7D631E26AD613101C13EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752456958, "uuid": "67867a95-b2c4-424f-a1d8-adbb1df9bf04", "value": "768:v/shVvXoBvMvIrb1gNKgTCFZKi0UWFrwYH:v/shFYhYKbOeD9JWlwYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752456958, "uuid": "296169d8-9459-4f35-968a-5427694685e9", "value": 37424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752456958, "uuid": "7bcb03cb-8a49-4a83-ac06-787c58b6ab9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752456958, "uuid": "48b2e93b-db39-4708-82f2-b5220ce8168a", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f39e3ce-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485081, "uuid": "ce023b5c-a5ec-4886-a437-d711d7ac8142", "comment": "Malware payload (Mirai)", "value": "b9d63ea84e1b3262857e78be4abfc325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485081, "uuid": "3fb8304f-fdf1-4ec6-b9ba-3e74159efafa", "comment": "Malware payload (Mirai)", "value": "803ac4370afd7215f3c403d06762708558f23db922030a0f17834462bd9359ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485081, "uuid": "9108f7e6-c9e2-43f3-8271-57a52e4d365e", "comment": "Malware payload (Mirai)", "value": "98ff011351896ec08b399038211195a5954db2d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485081, "uuid": "046c3c66-2870-45a9-b38d-f7584667a489", "comment": "Malware payload (Mirai)", "value": "d90eb45828095e34748ca0a75b46371c3b9e13885f532a218bcb7bb0810bb81fdf6535fb719be826e3db0947057caadd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485081, "uuid": "e0b045e6-801c-4dd0-ba90-40e124eb9d69", "value": "T1DF5312668803AC74DB537D3BB2F04FC3F60D4BB2B4D9647921916098FAE58623C622D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485081, "uuid": "acb9eb99-01c8-455e-9ad5-b4867e74276f", "value": "1536:O7XduYshWhq/HIEy6Og3Nwz9hAyMLSM5Tfv83KJGTb6R4u:QdpssMPR9w4yMLXTX83K0Tb6R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485081, "uuid": "28b55d2b-90bd-4d78-b7b6-b257de827194", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485081, "uuid": "75ee86e3-4316-4a1a-8ac8-7d6dd1a0919f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485081, "uuid": "d928b9c7-229a-48fa-9211-9b56ec8d1713", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6222953b-610b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536196, "uuid": "9a47eed4-adc8-4aa0-9562-5f4b85e6506f", "comment": "Malware payload (Mirai)", "value": "d22972a5b436f69a2d2b211371c99abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536196, "uuid": "1f96b4c2-6586-4cd6-a3b0-96a5e7648e0a", "comment": "Malware payload (Mirai)", "value": "803d2e1e74420266021d316c0e9a732db58e554a04f1bb0c2f894488f1677eb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536196, "uuid": "ec102d06-42e2-4329-8a2e-e1f73806f933", "comment": "Malware payload (Mirai)", "value": "d1deb4ee0b7e64c625e416bdc1b99f3f01159a09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536196, "uuid": "a236f54f-ce7c-42b0-adbc-f60515b3d48f", "comment": "Malware payload (Mirai)", "value": "c83da9cdebd54c348b71c4bde7a38c19e7901590a3253332fb9b7baea97f8a3d1d90ee73099e11c4e2ecdf1351ebf516", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536196, "uuid": "0b410a6e-96be-43eb-ad7e-fc166ea6ab9d", "value": "T185330951B31D0543C1A32E70363F2FD1EBABABD122D4E245312F9689A0B2D336946ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536196, "uuid": "994ec3bc-d3f5-4a12-94e0-cca4e23894b5", "value": "768:xJnweEvlEjVTEpGM9/7hltAo9Jnt6pFOXtfpPmwvIW:4eE9Ej1EV/1lGo9JttXth/v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536196, "uuid": "4114df64-0241-48a4-8a02-6186282f4791", "value": 50864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536196, "uuid": "e4bf1b63-b55c-4477-862b-d53dc50a1e5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536196, "uuid": "e0be3881-0b71-40af-8b77-d9b24a233159", "value": "fsociety.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d23fbf-60ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752501420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501420, "uuid": "a47f217d-9044-4309-a7be-eb301cf0c53a", "comment": "Malware payload (LummaStealer)", "value": "a6dc758c92b738f161ea21051797cd17", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501420, "uuid": "9f49ef95-e222-46eb-9b1e-d2e3f715ad59", "comment": "Malware payload (LummaStealer)", "value": "808403a48b1606bb545c041c08db690e8df0992311b06b4dd3c71878d383a378", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501420, "uuid": "f2feba5b-3f56-4d8a-9689-98c9a104b52f", "comment": "Malware payload (LummaStealer)", "value": "d2b07efd7305412ce25e87c066d12947048055ba", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501420, "uuid": "04c1695b-197b-44de-b93e-7d564fcbb4f2", "comment": "Malware payload (LummaStealer)", "value": "6ac1055e12bcfc48fafe68b9ebda54d8b2eb6568999089b249dec75af2335a79cd83862c1189fa4bc9cac95d11ba408a", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501420, "uuid": "674599cb-e520-4d73-8330-b3c99c65178c", "value": "T186B66572974458AD0C27B16221441EA2E7B158053319EDA943B9C42FF772ECB27BF29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501420, "uuid": "b278a80b-6afc-4ab2-bafd-fa82a5759c9d", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501420, "uuid": "6fdbeff6-99f2-4293-82c9-273826f1cbc1", "value": "24576:90a1o0eE8ZGYmaT/TGbJmZPoACwaMItLyspO4+mdbpHmY7ahd9z+jam:9foTEXYmaTi9mZwAmx/Y+bpVa7x+Om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501420, "uuid": "5f87ab7f-144c-4376-b702-19ac3c620daf", "value": 10507195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501420, "uuid": "56f24d4f-5ddd-4153-9bfc-e4550711e98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501420, "uuid": "9377ac53-b0e2-4fa2-88cf-1315b9034d42", "value": "Latesten-v.winx--Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc0dcaa-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504406, "uuid": "fd04ee62-e970-4d78-a149-da6da82ced6d", "comment": "Malware payload (Mirai)", "value": "1d7816b5254950b8cf5dbd5d45cd570f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504406, "uuid": "06c9d123-cc3a-42fc-a68f-cb355da9810c", "comment": "Malware payload (Mirai)", "value": "80f832a99f277cf83cd3e9868e7346011a88d0b60641380964d9b65534904b54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504406, "uuid": "f5b6e368-0865-431a-900a-7bd4fb31406d", "comment": "Malware payload (Mirai)", "value": "fede1f5ac36baebf871b15512b23969bad19afb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504406, "uuid": "2f586475-dc18-4bea-82d9-dbc89cbc0d78", "comment": "Malware payload (Mirai)", "value": "d303e620e795678deb945b3b61a1590950f6152a4eb819fd77698210c4a8186ca4e1752a3ea0d23a670d3d0344fb1a9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504406, "uuid": "b042e10c-3793-4888-87d8-7038d4c93170", "value": "T1F06494797A22BF2FD7B892310BF62FB4D31511C237A1D241D27CDA149EB128C589E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504406, "uuid": "4bd6e9af-5f2a-48b3-b61e-11f9983b7138", "value": "3072:p9xIbKK31SHdJyz0lJuy34pVNo7q1+RbyIrogr3oLyPc7vQN0UNFnpa9XiV1Fxt9:Bzj1KBupGi1Fv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504406, "uuid": "9bd483c8-058d-411c-a0b1-90a261130b81", "value": 315700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504406, "uuid": "221db19b-42e4-4572-a24c-e26b87dad975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504406, "uuid": "ccde4f47-6565-4b3f-8b20-8e25130877ff", "value": "mipdbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdf798d-6087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752479546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479546, "uuid": "62cabf68-d66a-421e-bf1e-428a4b4d8f1d", "comment": "Malware payload (Formbook)", "value": "f83fd74b2a23f2a25c385aa1d69dd77c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479546, "uuid": "0cec1a41-9e78-4de9-92d0-5607a3dd952d", "comment": "Malware payload (Formbook)", "value": "815776611484dd435d3cd49bf04d1ba9b550a287a3cc31bf67ae26ecd5f2000e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479546, "uuid": "a36dab82-f9ac-4f39-9226-60438110eb54", "comment": "Malware payload (Formbook)", "value": "5e049aa4706fc5ce1e79215746ba918b5443a25e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479546, "uuid": "fcb3fbea-93bc-4a5e-87eb-1c688ed9753d", "comment": "Malware payload (Formbook)", "value": "9354e52add5f3c631df18009af37eef3a6b3f5803226264f6351cc3980a0686a2e7e1a1c77ad2116c3226c0bf65cf871", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479546, "uuid": "b447b12e-42cb-4ba4-b522-5f5e8d340a99", "value": "T1A5E2DA09A90C30E51E26D384E7628534DD185D269863BD007E9E59BBF3EBDA0E4723F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479546, "uuid": "490d049a-10e6-4ea4-be76-aada13524041", "value": "192:J99AcbBqhRdLikVZb8suc95iiN9R2QGTt8XXbB7OiB95if7hl9RDQGTlAyP3Xblc:J9ovws39NdOiB9Yre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479546, "uuid": "436eb521-a67e-45a1-947e-a1900afc7ed6", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479546, "uuid": "d38f3afb-6d34-462c-826b-f56c3a908ad6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479546, "uuid": "a22d3fa2-8137-449e-b51c-af8dff1b383a", "value": "TC70395384UDFY58485UFHF484RDU38385UFUF848DDFDHU4U384858DHEU48584DHEU48484.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1024acc9-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481083, "uuid": "95f24760-ee68-4e71-a2fd-9491b7c4dd56", "comment": "Malware payload (Gafgyt)", "value": "72544f672397fa3c0eda2794103f6e29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481083, "uuid": "3e03ad5d-b743-4981-8898-02dda5f99477", "comment": "Malware payload (Gafgyt)", "value": "8162e5e89183a9d238b7d4f888d3d11ae99cb69d854eb0daf272fce1335bc8db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481083, "uuid": "62eb5b61-8047-4ee7-b85a-95838b9fce68", "comment": "Malware payload (Gafgyt)", "value": "67fd2d7dc9a1d412aa6cb55fdfba4fc8fb26140c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481083, "uuid": "58f36c4e-08ab-4341-883d-765e0792346d", "comment": "Malware payload (Gafgyt)", "value": "0c4e213ae29d155879d9d57f4b8da14fb138d21351d3caac2104c1f02f7ef3f63a8edecd10abe1df439c08fc294bfa15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481083, "uuid": "c9d9b033-bd31-48d9-bd65-6ff4653e2035", "value": "T1FC930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481083, "uuid": "4bd0682f-1fb1-4245-a1f9-9a0940d99cdd", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36g962f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy36MNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481083, "uuid": "5d338aaa-deb9-42dc-86d6-e8b931c1dcd2", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481083, "uuid": "f2386e9b-9438-4e22-afb6-cd61a332d9e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481083, "uuid": "cf550225-31bd-4c17-955e-fe40a0e6c609", "value": "i-5.8-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5107d26-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752478031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478031, "uuid": "faf17ec2-ef76-4393-9b00-808e682ec130", "comment": "Malware payload", "value": "f675c4bb84e4c5a602345158ee704475", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478031, "uuid": "109d2e3e-6586-44af-9e7f-8949e58944f5", "comment": "Malware payload", "value": "8180e8a69131dfd76a8e6f93d522551ecd29eefb769e82bce9631a6778bd5dcc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478031, "uuid": "c0b1f588-7850-4c02-a63b-d15e89b90157", "comment": "Malware payload", "value": "4f009ee4cff56c68435f943154e83e4d59b57521", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478031, "uuid": "e75a7ac4-bfab-4abb-a460-11bc0c51b9dd", "comment": "Malware payload", "value": "9c14f0e07c668765b2204e1f2a72b961063376f99e54667c12bf332558603466b4f6e81ff2215d15a0c5e574a200c89b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478031, "uuid": "307201e2-47e2-452b-8a5a-02fb6aad4e1e", "value": "T1685633D213F9D46FC3B45F97952B920DAE607B8AF7744FB5AD828260A27D181701F30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478031, "uuid": "1665903e-f201-4244-83ac-20e70f489db9", "value": "98304:RNz5//u1JzloMTtNmZWxe6sIap2U3fT3iDep5oq1wRIuz94ASlnJTp4tWfbnEU5I:6/vhNaX6K8QryDSoowRIiCJzbLzXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478031, "uuid": "52f0019b-6d78-4f30-abdf-a628ffb02f27", "value": 6014080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478031, "uuid": "555f4192-fd8e-427e-9307-b1f974575fc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478031, "uuid": "1a73ae98-1024-4e74-9644-53643829d29d", "value": "\u6728\u9a6c\u6837\u672c-\u4e2d\u79fb\u7cfb\u7edf\u96c6\u6210\u6709\u9650\u516c\u53f8-\u836f\u54c1\u6d41\u901a\u5168\u7a0b\u6570\u5b57\u5316\u8d28\u91cf\u7ba1\u7406\u5b9e\u8df5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d37eee-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485111, "uuid": "2ceb19f5-fea9-454a-a30c-7ba93d2a67ce", "comment": "Malware payload (Mirai)", "value": "216749552617e3d13096ca3608e3b6c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485111, "uuid": "2862d549-ee67-4c15-9a2b-b8da793a8778", "comment": "Malware payload (Mirai)", "value": "81f97d946fe4f4b4b8d8d58259e2066495a19719f1df9a50c7b3ab54379f2daa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485111, "uuid": "a20c9b5c-906e-4697-8e63-90a7cf30d289", "comment": "Malware payload (Mirai)", "value": "698f1215a857071ff09d4e9f7babc0f9aa511467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485111, "uuid": "f5df8a03-795a-4c46-868e-110b6fb112c8", "comment": "Malware payload (Mirai)", "value": "6cc41f4a6ebc5ed47558140f3001653a246a2bd4002a63deb50812948f72871afe1d75eda422743065edaca733e25187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485111, "uuid": "dc0d82a9-4843-46ab-9441-1c7f1033acd3", "value": "T168538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485111, "uuid": "c1aa119a-94f9-410a-9e54-69a5d38e9cf5", "value": "1536:zag/Vdf5F1LwtkbQOoQ3veifs3guba/qzCEZaCw:zJzf5TL2QfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485111, "uuid": "488b0ad3-4661-4ef6-a9ce-85619ea8c04c", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485111, "uuid": "111900f8-ca88-4bae-84aa-526bc68336eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485111, "uuid": "cf55ebd6-d286-4b31-a1c7-9858e2d3bd85", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217948d3-607a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752473811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "fdbb6ad1-3776-450a-a2a5-8dafd1730ec0", "comment": "Malware payload (Formbook)", "value": "6c34006ae9572e557b4d89491b628c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "d0553c4c-d1e8-40e0-b2f6-063d2498d7c3", "comment": "Malware payload (Formbook)", "value": "81fd502ef00b50fc5bea4f97f39daa4d0d820d268850801179a694da3632f248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "e68277f9-909f-4469-9ef7-6dbfe2cd2b56", "comment": "Malware payload (Formbook)", "value": "443a9f5b59a996dd94bc03f1f9e6ce99e429cf99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473811, "uuid": "984d1c0a-fca8-4958-a0b2-79392fea8700", "comment": "Malware payload (Formbook)", "value": "0c142702bb6283abd9257e5fe8d6c6324e0de059b3f9f814baf34fb85ed5d27e10933740e5b4c8fa43e1f7ccc0ea27c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "9186b59e-5a50-496e-972b-9f12d4a4498e", "value": "T10345DF1373DE8361C7B25273BA257B01BEBB782506A5F56B2FD4093DF920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "7976b90d-84df-40dd-a747-874c87dfe0c6", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "a115d921-735c-4799-8512-634f83761fc8", "value": "24576:Btb20pkaCqT5TBWgNQ7aPZkw2feJoPqKr6A:SVg5tQ7aPZ/o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473811, "uuid": "f77f49eb-2a10-49e8-8e33-9d2e4606b11e", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473811, "uuid": "356f4c1e-fd01-4889-b9e2-7f00c2ff13f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473811, "uuid": "01d790e4-9ea2-46fc-819b-cbe019f65c72", "value": "DOCUMENT OP441608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674b64e9-6058-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1752459325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459325, "uuid": "f45e531a-3b74-45ee-befd-4ad1c94f352c", "comment": "Malware payload (PureLogsStealer)", "value": "d16509555e7967e14fdf519c97dcbdb2", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459325, "uuid": "6c5cacaf-9118-49d5-8eb0-60cb5f7dd685", "comment": "Malware payload (PureLogsStealer)", "value": "825f1b7fd19c8adaeb5e47c1f905621ffaa25f97c9da1f4cbc4295d1abd67b2b", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459325, "uuid": "7de76e10-7d9c-41b9-a850-62ee6115fe5a", "comment": "Malware payload (PureLogsStealer)", "value": "0708a004666f973d72de764685d3c17bf0e05abd", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752459325, "uuid": "5f2f8361-db4b-454e-8eb7-b5be9ab98d9b", "comment": "Malware payload (PureLogsStealer)", "value": "48ad4c40eb3a34b5a422d93d897131017db67127c353a8bd469cc7768cbb5a2f781a660870eb35aafcd5f270d92cbadb", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752459325, "uuid": "286ee5eb-afde-4e9b-ac86-c92705eacc9f", "value": "T116D5AE9D84B09C926064FF34EA85F7C78CE943852A2B0B520FE595967342C43FEA3776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752459325, "uuid": "0d9f9cec-107f-42de-895d-82f889eb48df", "value": "24576:I1n571z2t0+qBXXA9we77BGI1MRoclbcJ60hHdCToARKY:iBnRCNWo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752459325, "uuid": "be87cfec-c6dc-4d68-b389-ecbacdf9b960", "value": 2878548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752459325, "uuid": "bceb2b1a-6456-42a5-9988-ec486b75a677", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752459325, "uuid": "8834b464-cce1-4195-8f1b-ea1a2f08a16b", "value": "MKC Seal 3D Drawing Picture 200pcs.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5d90d2-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481078, "uuid": "6ff37821-100e-4d6d-86f9-5fbf7b595d02", "comment": "Malware payload (Gafgyt)", "value": "670707a497e4dd47de6020a64b64a7ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481078, "uuid": "49d9f80f-0320-4ccd-b1ae-5f02c4745dcc", "comment": "Malware payload (Gafgyt)", "value": "826bc99897b7ed1b8a1b618fb47231b0b0c1a4f65e9c3318bbf16dfd9622c99d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481078, "uuid": "64995c07-95e8-4fe8-97ba-46bcef3423f4", "comment": "Malware payload (Gafgyt)", "value": "ee6dcfd73dc356c1b6d3fbdcf84b331e4980d634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481078, "uuid": "886081b8-f400-4e96-87c4-10d21329043b", "comment": "Malware payload (Gafgyt)", "value": "61bd96a83f41c957d78582a6d07d96a569f88fe52c5b1e8f605a835fc7b0a0b532053b140329860e76d6f427481c203d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481078, "uuid": "6a27f5e1-a21f-4da2-af73-bde799744076", "value": "T172931A41F9408B27C2D227B7E78F439D37366A54A7D7330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481078, "uuid": "91412ddd-d7d4-46c7-8864-3483fbc903a1", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvbNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGbNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481078, "uuid": "837adace-1352-43e7-992d-55c9dc68b4e9", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481078, "uuid": "2d3b20e3-a38a-44f7-9563-af78492b7c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481078, "uuid": "f37a4489-1981-47ce-931a-8cef82473fc8", "value": "p-p.c-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec5643a-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480061, "uuid": "0da9f9bc-d5ab-4980-b199-88f1c9f60b21", "comment": "Malware payload (Mirai)", "value": "d5a8496e7c232ebd79f22d40da269f4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480061, "uuid": "d120b4f5-c22e-496c-b062-991429928f6a", "comment": "Malware payload (Mirai)", "value": "8280d6a2b651dddc73c98144aae5cda5b95eb36d9ca2d7704ca4ec170b745dd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480061, "uuid": "5bf00ea2-96b0-4f80-b09b-e4fd6ed9c051", "comment": "Malware payload (Mirai)", "value": "79af19ff7183e04fb20d82747f9d26720f80f276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480061, "uuid": "3be55bda-95e4-49ee-ad45-1dedde119f63", "comment": "Malware payload (Mirai)", "value": "58e9d001b43ed279c809ef7de487e920269c620ed72f5f45f177102dc7fdccd8b400c6e7fcddeb123079cb782b5d0ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480061, "uuid": "cdfc4824-9fb1-456d-8cf4-34420e892397", "value": "T104232A96FC928DAAC6C0577AB62E528933A377A5C2CF3303C8185B5227C650F5D7BE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480061, "uuid": "fdd359f0-ed99-4fd3-a888-9e4459d58fec", "value": "768:vaqRtqOYTV7T557bz2iI55dqNjfovxxXO9SqiyZ0oUIMsBNCVFTgnRzk:zMTVvf7fedqNTovSkqiyZbgH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480061, "uuid": "9599dcd4-828d-45d6-af03-b83f2310dbe1", "value": 46992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480061, "uuid": "41a471e3-99d0-46ef-9328-c75095110338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480061, "uuid": "98abb058-440d-46eb-ba5a-34bd7262e9d5", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58f4886-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516579, "uuid": "45ed324d-937c-4a2f-b844-c77abc5ad3a0", "comment": "Malware payload (Mirai)", "value": "de56ed2ffb3c90996c59b199cb474db2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516579, "uuid": "b35719e5-7130-4230-8ba5-45fb029874e2", "comment": "Malware payload (Mirai)", "value": "829270cded018479449a0af948f0a452a0c6cbadb8890f7c11d70117d3e76b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516579, "uuid": "f5dd781b-1f3c-477e-8aff-34c57abbf0c0", "comment": "Malware payload (Mirai)", "value": "f67b7c23f2ea87a6ee2653e119f3f749921955dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516579, "uuid": "ba31cea7-3cb4-417d-81aa-d5cab6cd2620", "comment": "Malware payload (Mirai)", "value": "815c23f9ee0fb0077336736943de73ca943c983b52ef3235fec2535b7e6cdd9086cb436c3464c2c831338fbef0bb62b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516579, "uuid": "1e571670-501a-40e6-a610-702db67ba6fe", "value": "T12683F9B5F8419E12C2C251F3B66EC68B3E2603D7E3EA31825B255B217E935970E77C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516579, "uuid": "c80f4db6-30ef-4d1e-b602-ec5d334a6960", "value": "1536:lLfzyGSbfUkic2YL5Of3bty4I/JOA+vU:lfy1bskZs/ICU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516579, "uuid": "f213f4b7-8773-4d44-890e-563908f558a1", "value": 83320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516579, "uuid": "79d20292-d194-42d1-b5d9-9b271a12a1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516579, "uuid": "c4abe221-0c88-452b-a18f-88cd38a5973a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2883013a-6062-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752463515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463515, "uuid": "f9034117-5fce-4b7c-af2c-d346a082817e", "comment": "Malware payload (ValleyRAT)", "value": "832bf959fd59078d0c45664868a5e494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463515, "uuid": "a21cc3c8-a9fb-4d45-aa07-7c127d23fe80", "comment": "Malware payload (ValleyRAT)", "value": "82cb89ece25c4d366517a3032a821df6f84b7096323f9aac64d2f4e4e1ae4982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463515, "uuid": "a8e43950-af8a-48c3-be6b-020e09fb9056", "comment": "Malware payload (ValleyRAT)", "value": "c6c2b3ec19df7591c831c4fa4c135ca62ef53600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463515, "uuid": "7dd5a84c-b566-4106-975f-57a4ce25269f", "comment": "Malware payload (ValleyRAT)", "value": "13e8c38c02232560a3e05e7e508a3ee5ddfc410166383fa07597d5df316bcf990ea4ca64282d25f25deada4934abc366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463515, "uuid": "031874e1-b85b-418c-bf5e-478ff199181d", "value": "T17AF5AF17FC922CB7D0AAA235896291817A21BC453F3253D77E90F3782FB2BD06A75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463515, "uuid": "64886909-f01f-49c0-adb4-ae77a165fc24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463515, "uuid": "34d81e97-20c3-43df-8815-410a1dd55f83", "value": "49152:X3V6+7mJUHnQvjI2vlvyPMOVRB0NDWQzffT6sb:X/z66PDVH08QzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752463515, "uuid": "c970af72-bf9e-4480-8cdc-4bb50ea9828b", "value": 3335680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752463515, "uuid": "5bff1cfc-5475-4e17-9e98-2a30b382b582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463515, "uuid": "e2741f36-5e04-454d-84ac-f519eaf7b343", "value": "832bf959fd59078d0c45664868a5e494.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7664ed-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536965, "uuid": "aac6c8f5-164f-4423-8320-388ea62f223c", "comment": "Malware payload (Mirai)", "value": "4245f1ea515e8b6ff76d59d983033332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536965, "uuid": "9836a322-a3b8-4ce8-ba00-a8b9c3e144b6", "comment": "Malware payload (Mirai)", "value": "836ebe84be24135db3b71b6d3c653923169cbfb3e33a44ed4af5c00f24fc0444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536965, "uuid": "ce2fed35-33b4-4574-822c-d86f972bf042", "comment": "Malware payload (Mirai)", "value": "c119dcac33b84a96097c851a7635247e60bbfb1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536965, "uuid": "a20116a9-b14e-465a-8fa9-aa90cf04b63d", "comment": "Malware payload (Mirai)", "value": "17f9c5f13a9bde66805ad6685d3e28afd009da08a5860624ad1edf630ebe0183c9ff84b82a86b04988329379296720dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536965, "uuid": "90f7e0d5-2516-458d-8005-e9e13b8b3b4d", "value": "T182F2E174D1D84FE2FD9E8EF022A097D67FEC1F4B1B128CA331028F95DA02511999E9E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536965, "uuid": "c2a17a74-1a60-4aad-b56c-8ec0b14d8876", "value": "768:teDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2yo64uVcqgw09A:tCRocD0Lu/PWUWr/iuxV4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536965, "uuid": "d8036fbb-95f5-472f-9505-a15cd62f4597", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536965, "uuid": "cd189e78-db98-49ca-bacc-f4377e5a699b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536965, "uuid": "2e02a3fa-852c-4710-9f01-140e7f3b6f1c", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64afba1b-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752504418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504418, "uuid": "5410217c-7cb9-4fab-95e9-a04a3dfe5a2e", "comment": "Malware payload", "value": "85b02ce09ea30121ed801d7137555f45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504418, "uuid": "573e78c1-73fe-45ab-8ccf-3e7d84783533", "comment": "Malware payload", "value": "8406757ba3346f7b91b72e9524acd7e1e44a21834021165603b624c2765e2fdc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504418, "uuid": "d896ffe6-a731-4f4f-b6a4-db98cfd1453b", "comment": "Malware payload", "value": "323287e45aacea2ecb9554562151cef49b8561c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504418, "uuid": "8472b62e-d040-4b6a-9fae-9d805e6cb51e", "comment": "Malware payload", "value": "0bf94081c95ad29fffebfc0e8ea7e39a916b53fa0b78083f66e776bfe269c535e448cb97eb362990a77d01582785d138", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504418, "uuid": "d8f5aef6-c0b9-4b96-8256-716b98315ba4", "value": "T197E07D541052E840EB9CCD0833AAB2C49843706B33C00F7CF04F6D140B39900301BF0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504418, "uuid": "771eb076-27e3-42c6-b301-d14b235d7d15", "value": "6:QxP7W6jJR59uhoQ8N8dVQURdVQq76ZSTmqMcQ:EnOholkzZRbyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504418, "uuid": "adf87339-b9cb-4adc-833a-404fbfa5f477", "value": 302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504418, "uuid": "2a3b2c0d-4bff-4b72-8906-4669026f3b37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504418, "uuid": "22ee023c-895a-4a42-8635-ade4db1a57a4", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79fc3b8-60d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752511107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511107, "uuid": "8838148c-42ca-4fc6-9170-add4be6f4dd3", "comment": "Malware payload (Mirai)", "value": "d07d9c5be4263542feb1e16c76131c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511107, "uuid": "2a749c65-8c91-4cc4-9030-f6107cf125ab", "comment": "Malware payload (Mirai)", "value": "85d5ffa97106b07d85c9b1a74a8d1249225a40741d81c7f8af64798bb2473723", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511107, "uuid": "d62d51cf-d04d-4e19-b931-c68f4739d178", "comment": "Malware payload (Mirai)", "value": "4c518ba46bbcb6f1704af03d373c6b7da04d84e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752511107, "uuid": "99ab31f1-854d-4705-8ba3-8abb5e22fb6d", "comment": "Malware payload (Mirai)", "value": "5d78941c0015090bb668be5de470b4eb4247188a5bba472679e0e85fc0040c61631e9a0185748f02675131d1f7b8043f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511107, "uuid": "1a853b8a-5edc-4bed-9114-786d165445ab", "value": "T19EB3AE87F74714A0C8264BF007C74B9E6E232221CF5BE9E76C1E263A19794DF1A1A7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511107, "uuid": "dd111d36-80cb-4c3f-855f-136dd86e148f", "value": "1536:ZNjRbfRxT7DpcuNHDNItHmX4AWBcKTworqCXlaRojkRZrgx8Fugmfy2/LWHT:XRbTT7Dpce6mxKxk0qCX2oYRZrggCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752511107, "uuid": "db217a71-cd68-42c8-97fd-8bf0a972b7d5", "value": 116392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752511107, "uuid": "60819a1e-26f8-4250-b967-ee31705f8caa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752511107, "uuid": "cdbff156-0dd5-4d27-b16c-1344cc3cfa29", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78875711-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752477822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477822, "uuid": "0fa46fec-647c-435d-a173-9bc6e102c39a", "comment": "Malware payload (AgentTesla)", "value": "cfdad49744349e6bd63e46cfcf5384ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477822, "uuid": "b19ac878-37ab-4887-b9dd-fe0ebdc03969", "comment": "Malware payload (AgentTesla)", "value": "85f0df12788fb83928af7c24022447312c0fb590c4bad7a205d533e96ac67f22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477822, "uuid": "0be44a09-d8c8-40f1-8443-8127939a3b21", "comment": "Malware payload (AgentTesla)", "value": "c43c4c184ca97ae0f79e3035fdce47da00e3009a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477822, "uuid": "42047acc-0fb9-4881-8536-0bba589f9bba", "comment": "Malware payload (AgentTesla)", "value": "df1e4604329dc3c7fa4b6c619b0232ec9e9dac2c7cbcec9e15dd8ebe97a996229b3a476b5d4387ca29c947ef750bb262", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477822, "uuid": "3f322b52-97d4-4a68-852a-aee90fe32b0a", "value": "T1A105D02172A5EF42C5B943F81560E73147F26CAFE43AD30A1CC66CEF3979B850A11A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477822, "uuid": "d377741d-88dc-43c3-a436-cf9ed2ea41d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477822, "uuid": "44b2b505-8b8c-498d-8fea-5c1b8caa3077", "value": "12288:HWA2G1bBt+YMu/3DXUYUizTrCLrGaPlgASJvWMxHjuyojGYmt:HcYMITlUizCLr6AMd4jGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477822, "uuid": "149b4540-2775-4061-b70e-1da52c1192b7", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477822, "uuid": "8aa15dba-d9cd-4722-8db6-1d9ff1420d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477822, "uuid": "fb2dbf50-d1c1-4955-91de-815f4eab6117", "value": "[CN] Inv Acc-XXXXX8392-030420252215469621)(Customer Account -XX0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80513e92-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516061, "uuid": "7e80f1f7-fb5c-4125-85e7-d0786d8442c5", "comment": "Malware payload", "value": "a065c2d25096957126b9739f95810a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516061, "uuid": "01766095-0f09-4f44-a1d2-8e7c8f9cf35f", "comment": "Malware payload", "value": "862f29aa00bb4ee33729bc6699990dbdf9ef890b8364f8288b173cb1ca5d6787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516061, "uuid": "a5730bdb-cb2c-4960-880f-79c48920a6e0", "comment": "Malware payload", "value": "89c591228df334c3a974ed7b96e2060258171b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516061, "uuid": "3b4e7524-cb2a-43b3-aeb0-ce4bd63a1b9d", "comment": "Malware payload", "value": "7de2a605b091f151bd53ddfc67180f88200f9d8baa4157ee204fb44de5ba92934eb3dddd26c31607c8e962f1537d4bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516061, "uuid": "36172a2b-d567-431a-933e-294731c8b45c", "value": "T139F5094369DB0DE5CED677B4A5C36335A738BD71CA2E1F2B6608C23129536C0AE1EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516061, "uuid": "16aaa9e2-9fed-4379-82b7-aa413dbf2d50", "value": "1d777e8470ff334cbcb31f05cb06860e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516061, "uuid": "06b98e95-826b-4310-9a2f-48a7fb51a7a7", "value": "49152:rjZ9o3eGHKeVyCfdaKdym0a8jR65h6t0O12:fuKeMR65h6t0O12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516061, "uuid": "888ed5f7-b84a-43c0-b1d8-0faaed282b36", "value": 3330089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516061, "uuid": "e1bbe2b1-ef9c-4035-b7b5-05c1b35b9a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516061, "uuid": "2d269ceb-de75-4bde-af6d-9bf4221521e8", "value": "decryptor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635045e5-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752504415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504415, "uuid": "8318331b-3ec5-407f-9d2f-960d1e793eb0", "comment": "Malware payload (Gafgyt)", "value": "5f626a38ed1146b4eaa32fbcd6488afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504415, "uuid": "517cc1ed-e533-4576-acc5-c190a9cde522", "comment": "Malware payload (Gafgyt)", "value": "8657b9817f6837c7b959988ccc81417dba448785fbcb68764a3ec433375147b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504415, "uuid": "2f272138-251e-435d-8c14-fa5cd02d21fb", "comment": "Malware payload (Gafgyt)", "value": "fade78b6edcb396c5e6252c393694c1f0d1ad50b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504415, "uuid": "adcd70bf-312d-4aa2-8408-6a2647a77a08", "comment": "Malware payload (Gafgyt)", "value": "1972d05fed124b8d9b3c4e46799d8df2b6da2c28aaea16821512a49993e411f8041b264e40a76ff31ea55bbde4a6e65e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504415, "uuid": "e0e20241-caaa-48e4-bd61-f641f5a8d834", "value": "T1FDE30745FC518F12C6D656BBFB4E428D772A47A8D3EE72038D256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504415, "uuid": "24dc1cea-c358-4cd1-adc9-c06569a360f7", "value": "3072:WlW0LJTXvtlhWb9vAE0Q11Frf1RUwZXww7cZfhk1jRi5Ax:WlW0LJTXvtlhWbK0DFD1RUwhwwIlhkNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504415, "uuid": "02787463-7360-4e9e-a83a-cd55e92a32d7", "value": 146528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504415, "uuid": "57cea341-3e16-427e-9cf0-5dc12051c5aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504415, "uuid": "1605209a-945f-4e76-8c74-6e7a0f030f4d", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326bb124-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752515930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515930, "uuid": "f5e95975-17e2-4923-830a-48f2ad4d1e80", "comment": "Malware payload", "value": "8d8ac11652bf55ef58e4ae00cf1eacad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515930, "uuid": "e67e5388-e040-407e-9bc7-8416490969cf", "comment": "Malware payload", "value": "86cef520fe8ad3ee8bd70f4a1c10eacef989eec5f4389b847a5ed455db7e9c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515930, "uuid": "6532ada6-c931-45eb-86d6-a7adeb125d75", "comment": "Malware payload", "value": "126e5a6c83c4880590ef79d7a5e50325d0a96ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515930, "uuid": "85a50816-0e29-45a1-8f0b-dd76d3ebc4b0", "comment": "Malware payload", "value": "a4217e34650fe3d04fea40629c10eae03b5d8c3fe20e016134bc24105c56f77a8aea0cdacc4fa4fc2353b167b7a41f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515930, "uuid": "10979927-7024-48be-899f-ac623f5049ca", "value": "T1B5969E63E84BC581FA8F4A35CE92EAF009617C59FE65151F30987E07F6F338136216A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515930, "uuid": "830924a5-fa88-4a3e-ac40-89a6e7f0a088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515930, "uuid": "75cab610-5607-4f93-9fa1-c060dc48f85f", "value": "196608:PWDkIBRW6C+jZsJJpiIKJsLGgpESUCCEREOA6V:69E6TuJi9VM7UCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515930, "uuid": "36c586cd-43a6-4410-ab18-3ae0fa931676", "value": 9117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515930, "uuid": "345184f6-8a0d-424b-a131-83ca0a40e59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515930, "uuid": "7f4364cd-2c5b-4837-8407-56a7f667225d", "value": "Yimen Error 4 Classic (Sneak Peek).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f5582e-60ec-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752522751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522751, "uuid": "5bdcfa33-3c66-40c8-8c40-19c57556d3d4", "comment": "Malware payload (Mirai)", "value": "a3edf7bbba09176b214570081eac788e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522751, "uuid": "e51fa4a2-50ee-4dce-9041-99832e1a8934", "comment": "Malware payload (Mirai)", "value": "86d4b6d5621b8ba3b86787c150d4073394f587c52c03f3ef9b05c29e6b6fc388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522751, "uuid": "d89a2aca-ce63-40b1-886d-510ebe516a82", "comment": "Malware payload (Mirai)", "value": "bcbc7675d82bb97384e44317ce281c209e888958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522751, "uuid": "82b2387a-5446-4583-ad21-40d2f0000701", "comment": "Malware payload (Mirai)", "value": "36bc430ffff2321032a6cefa9c026da2395767d7040c0639ab392d51700f85eab57af879cf851703930ea241697da3d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522751, "uuid": "c3789523-99e8-45b8-bd69-ebb28dd2127d", "value": "T141E328D7F901DDBAF80AE73748174805B530BBE248525A333257397BED3A0990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522751, "uuid": "6082f313-ca3c-4a5c-bf71-af44bd9a5ba9", "value": "3072:2GEqz0dKij1jk/8a6Jg/HfFaamOVGjbibL5cuyzUXm:2G7GI/8a6SHEamKL1yzam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752522751, "uuid": "19ad75ef-5be4-43bd-95cd-65d3d39c53fe", "value": 153792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752522751, "uuid": "89a9ba23-c6f8-42ec-b9d8-61486d79f3fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522751, "uuid": "15b1148e-b1c5-4b96-8047-01221f3e85d6", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed03113-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485161, "uuid": "32d7e78c-4739-422c-867c-5a5de736e20e", "comment": "Malware payload (Mirai)", "value": "4e9d272b68c3fd6a28bd0b81505d3e3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485161, "uuid": "0cbf7707-e762-43b5-bf0a-5b04108d5c44", "comment": "Malware payload (Mirai)", "value": "873eaeb23e4f4fa766c2b7ecbd8c7b433a8487d6347401ea894e7e28a08700b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485161, "uuid": "53a3bea0-0ecd-40a8-955a-fb34686db296", "comment": "Malware payload (Mirai)", "value": "ac7fd64672fb1c081f9761e60a8d40f6add0f12f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485161, "uuid": "147d9dce-9a43-4160-931a-b234de38e97c", "comment": "Malware payload (Mirai)", "value": "843638423f6251fa8293a5175d8e31065c2b1d60edf8c29ec62a9847629b6c4d321e748b324a7c59f2205b0715bb034e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485161, "uuid": "728d8059-7703-486c-b5e6-05c2a6eacae8", "value": "T14BF33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485161, "uuid": "7b1dfab1-995c-410b-9133-c333a90264cb", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjtHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OtHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485161, "uuid": "e3d76987-4b9d-47a1-90a4-a700f1a7efbd", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485161, "uuid": "4ff9e68b-8330-4dc7-bdad-553ec6007414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485161, "uuid": "5f55741f-eec5-404b-88b5-54519572de2c", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2393a4-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492082, "uuid": "c623c1f9-7555-4285-81dd-b2ee91c33622", "comment": "Malware payload (Mirai)", "value": "03d5c4cb8eb65a27e89dde8cdef3230b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492082, "uuid": "b3edc4d9-d7b5-48a1-8e62-6dc3a7c6d4f2", "comment": "Malware payload (Mirai)", "value": "8743ee05aa26d3946bbcbf4c00fc19f1a39a051a5c69ae82ece778d1b3563731", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492082, "uuid": "d4a94fa9-ce83-46d8-942d-87797ef76818", "comment": "Malware payload (Mirai)", "value": "c9817f206c7bb6291dda353ae5446107d5638aa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492082, "uuid": "d66a0412-8080-4307-bbc9-11dbc147100c", "comment": "Malware payload (Mirai)", "value": "0d8ae12d2eb97345e8514875aa5f122552f6ff12c4ae8c6d2ff369296cbc770f4b7ef16be2610d9533face752dbf2a0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492082, "uuid": "a2471ec6-7acc-4fbe-a342-eb709868310e", "value": "T19A74A573D8158995F0245CB3126B3351AC468BBB48E722E3EE2B1962FF3145B51BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492082, "uuid": "fee6c63b-2318-4d40-b960-a855957622f1", "value": "3072:rlVip+MLdafWKvuAUJwj7Zy4xtKUf3DSMWzNq7mX/Itse84aKANb:JIdwv9Uey4OUfMzNMmX/Itse84aKANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492082, "uuid": "656aa91c-9b2b-4b70-b0e3-1b045e63918a", "value": 340540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492082, "uuid": "3825754f-3ed4-4420-9864-619fd0b884cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492082, "uuid": "f018661f-3f77-4c13-9753-c0f0655ace24", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7326f039-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517756, "uuid": "9f152332-3d3f-4e5c-9e49-14cbd6f94a15", "comment": "Malware payload", "value": "ab4331ab33611164e474577b2c92b455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517756, "uuid": "c4f8bc31-8131-4945-ba69-590b9f0ba2b1", "comment": "Malware payload", "value": "87f514310e2aef4b8deff74ed57d7be725ee9e07d6c02633ec2186532cabe39e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517756, "uuid": "2aa6f8d4-56ae-419d-9f0d-e6757c450a1b", "comment": "Malware payload", "value": "44d06ebb224e3a423dbfe259ad86446bcaeffbf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517756, "uuid": "5b08ff72-ff82-49b9-93fd-34f78a7dda51", "comment": "Malware payload", "value": "e42994bdd040392b7ac778c42d3d2b78f78548c246dc3e738faac342c3ea2d65fa8d58ca6ed2e5786495e5a37f84b0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517756, "uuid": "0a6cb680-84ae-4cee-bdc9-f948f57c2b4b", "value": "T1DAC45A12D66790F9D967D1399256B223FD313D688324EBDB876093312F21BE09E7EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517756, "uuid": "1cc055d1-52b6-4796-bb0c-19c68b1f1284", "value": "8f947aebfd03793aff0d53dee59b4808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517756, "uuid": "229114b9-f3cf-4361-9123-b373c86e99de", "value": "12288:l/DhgnvAWjfL2okpPJYAN0r9/baLKHYVjkKprQ:l/OvAWD25Lm9/mLKoHrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517756, "uuid": "083a466e-e5fc-4037-a737-7fa93b661784", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517756, "uuid": "289b2a19-5e42-43cb-90cd-5f53454da4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517756, "uuid": "0c6781ca-1a7d-44e4-85fd-1174870a3b6f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af15e32d-607c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1752474907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474907, "uuid": "0ab8ac58-1335-4b1c-b2c8-654d451c6926", "comment": "Malware payload (RedLineStealer)", "value": "7612fcdbc269a5c6f604407983f48b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474907, "uuid": "226ee332-ce6a-46a0-a555-69f75aa39e77", "comment": "Malware payload (RedLineStealer)", "value": "881666cfb7700551912b6f0b5ed601d61aa0c81576d53f69a43246b573832f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474907, "uuid": "99e167fc-6b88-498f-a755-0934d6666ade", "comment": "Malware payload (RedLineStealer)", "value": "c2c733863b1d63f1adda5d1d25b7d3ba3109f3b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474907, "uuid": "60add321-056d-4090-b355-1a0b5d8181b6", "comment": "Malware payload (RedLineStealer)", "value": "40ba55e3505ed90e03481005f3fa6b0457971f78f5c9cd1723517ffa008c28be8319bc89880205200423e3664db351e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474907, "uuid": "471db6f0-9b01-4191-b21d-919c49d8f7d2", "value": "T1E3F40144A56AED02D4A60FB52B32EEB003BA5D8DB820D2070FD6BDCBB57734129D174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474907, "uuid": "5f1e30d5-084e-4e8b-b89e-d2248b67f369", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474907, "uuid": "fa937744-5f0f-430e-adad-7f037c9e5ccf", "value": "12288:Rr1/3plPNMHAcndTGgx2Cmw4xFwZuKhjabvKLsWeZFYOkF4Z/Jvifse:1F5lPNMVndigx1mlEutWeZcFaxvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474907, "uuid": "6fd6fc59-6091-43b9-97d0-a68ecb935864", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474907, "uuid": "6e063a57-1460-4de0-bc11-1e0176c45c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474907, "uuid": "10658f01-8a7b-4fbd-8b71-62ea742cce83", "value": "396115720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ca4d69-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536709, "uuid": "a03a7198-a8c5-4b15-9692-f45848681784", "comment": "Malware payload (Mirai)", "value": "53d3cd492c10ab8bc0af46865668a241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536709, "uuid": "9a7df296-5114-4a72-b25c-662f24b77f98", "comment": "Malware payload (Mirai)", "value": "8827c7051e72d61ba4759eba3f33ed5e570b7bd775c5d3481e7d89303c91e505", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536709, "uuid": "fadf4ed4-405d-4cb1-a2ba-0da8acce780a", "comment": "Malware payload (Mirai)", "value": "3b33e7d60d873642eee5c227354643e55397c759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536709, "uuid": "7295a6c9-cede-409d-b3d2-ca0a9716eea3", "comment": "Malware payload (Mirai)", "value": "ae523060baaa09eeacac3fa371d127639859e67ccce3d91e844740b8ae9bbf389a62272abc0f1fe776d3976f1b9ea59a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536709, "uuid": "8c98ac92-1d86-4287-aa5e-307f149e769e", "value": "T11CA32B85B8819B25C6C156BBFE1F018D330357ACE2DE3312DD245B647B8B95B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536709, "uuid": "e4636c94-ec97-4362-9d2c-a1850237a265", "value": "3072:u7+rDnSy4/m0t+21MSYW2/1ghFafmNyIwdd5yOmpn/:6+HSyK1rhlUgTaS6d5WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536709, "uuid": "f63eb645-6829-423e-a4c4-dad7840a75f9", "value": 100256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536709, "uuid": "2c91bb9c-0835-49ef-9715-83b2f8aa8df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536709, "uuid": "7ae74246-bb65-40c3-bb13-739ed8039c68", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6606020f-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485093, "uuid": "54a99c75-4179-4d0b-9e05-8fb6af750b8f", "comment": "Malware payload (Mirai)", "value": "3b0aad0daec02eab7b6d21ea741cee68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485093, "uuid": "eab66fee-1004-499a-aae8-6f40db730530", "comment": "Malware payload (Mirai)", "value": "8858f47f96b1d42ab1eccdd52d5718afe8bce015814a5171b641db5fdf1b0bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485093, "uuid": "9fff7e8c-c2d1-46ac-ad83-654fb700a66f", "comment": "Malware payload (Mirai)", "value": "93d65578d8d5b401850fc14ad546d98aa8a97c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485093, "uuid": "39eb9bff-0d53-4ef8-88d1-169cc321326b", "comment": "Malware payload (Mirai)", "value": "55e44d406a3971bf8cfc9414f852e51a85913b9e505a38b7d4c2b67f9e3f37baab9485e907bdbdac467aa6c9a99f82a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485093, "uuid": "8c0236c4-4d73-489b-ad81-a680dbd5017d", "value": "T159B2F1A1A1863E72D770223A797CCA0017AB57FCF0EA72753524B7AC4BD2C47647814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485093, "uuid": "f82510c7-1282-46a9-9abb-44065eb556fb", "value": "384:MZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvda3hymdGUop5hKh:nX1De9kONQG5xD+jHMDzuQs3UozYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485093, "uuid": "9e3f9d45-cb6b-47c3-8387-da08bb28d5e8", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485093, "uuid": "5c262d4c-f51a-49f6-b38d-9016ad2799eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485093, "uuid": "9cb551c4-4141-4184-ac6b-b4ff514976c4", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87988bd1-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752477848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477848, "uuid": "9d4f20d2-db4e-441a-aca6-8314a47b37ee", "comment": "Malware payload", "value": "1ffe4572627daf0ff60638fcb126db2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477848, "uuid": "8c603246-f897-4f00-bbc4-afbecb0e629a", "comment": "Malware payload", "value": "88b46ab097635b26606512620d7e089678bce4f68ea6ba923ee37542187111dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477848, "uuid": "0ed7e624-8773-4e34-a146-2a4eb77bd88e", "comment": "Malware payload", "value": "64cbcfdc628fbe18239d9de87d9e24c83b1cc81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477848, "uuid": "76af6a72-2671-4eb5-80f1-4360ec1fae83", "comment": "Malware payload", "value": "15c8799f053f1299d65b8a34eb4f4ff637e81d10b92f9fd8935501ff4659eee781b2c8b2d734c303f4eb2faf49f0dee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477848, "uuid": "8367f1a1-4c1f-4cb4-838f-9058c0610d77", "value": "T10C864970D3415061D297C470CEDA4FF861E1B87B81365D0E1AC5F81A29FEE61AF9E3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477848, "uuid": "5fe134ca-c5b8-4fd0-918f-e6c606bee107", "value": "47652671a89f2f4611249fadf497121e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477848, "uuid": "528b01d5-bbb4-4ec7-9a41-a79b869f7b60", "value": "49152:RTM/B9JA1Na4MZO+AL56a0LoMzm8rh9Y4tV9BQFmRaSXEpNU9AM/8IPeYKw29YY2:YdKN8wrQPnIUY1Pswa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477848, "uuid": "c76245d7-f479-4d3b-9590-df6f5e5118e8", "value": 8150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477848, "uuid": "2daf195f-e704-406c-9235-05090deef0d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477848, "uuid": "82be5194-7d6a-442e-aeca-b4b56822cbc0", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb1894d-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503683, "uuid": "d54de806-6d40-4698-ad3a-1f7da0580bf4", "comment": "Malware payload (Gafgyt)", "value": "90d1c743e24341a13b10b7d2cc4b07b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503683, "uuid": "8bb349ed-a590-4761-bb35-9b4e43b88fcc", "comment": "Malware payload (Gafgyt)", "value": "88df454e09621d0316463e70a858f1ed8f97b2759622a33149de38c00736de79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503683, "uuid": "07deb471-b303-4c27-921e-d3704e99f8ac", "comment": "Malware payload (Gafgyt)", "value": "2069d9c932031b09f9b6e611496515498d700395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503683, "uuid": "301e1872-1e3f-45a7-a115-1fda0116096b", "comment": "Malware payload (Gafgyt)", "value": "ff022f76eddaa17bffe0b7900c3935fc68e7e2c6029dae36b4e40ccbf0de7f93708577e16cfb2cc669ef3a293d77a108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503683, "uuid": "d386c00a-59b0-4802-959a-3c7b44f1c4ec", "value": "T14DB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503683, "uuid": "26b9d374-72d8-4e16-b820-ce52e872e150", "value": "3072:b6an17WtsWhdgYJU0D6mbPbmTQOWsXAOn:Wan17WPJU0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503683, "uuid": "0063bc15-0aea-44b2-b7a7-491d8c7d6e38", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503683, "uuid": "29da5f0a-4f77-40b3-9e88-a521ba3e73ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503683, "uuid": "652cf59a-3295-4fbf-9487-2a26e46d288f", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adafc8ab-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503681, "uuid": "2efe6942-6848-48e7-bc9c-291e502af5ba", "comment": "Malware payload (Gafgyt)", "value": "174aca685f6032c10e5cb6e971f1d38f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503681, "uuid": "8074cd5e-cc0d-4980-862e-29fc7757d115", "comment": "Malware payload (Gafgyt)", "value": "88ed83b1013e062fd0bf6f0b8f148bf5578678ebfce01c2a8198adaca7e4573c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503681, "uuid": "ff600bab-b3af-4b6a-a821-d6aa26d28b8a", "comment": "Malware payload (Gafgyt)", "value": "adb77569fc5defc86d43fe9e5a14ee06e53d1fa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503681, "uuid": "326c6c00-cb72-42af-9922-3f0a6bb2f49e", "comment": "Malware payload (Gafgyt)", "value": "8a62eaa5c7e5db10f9c3487278438a7d9ab118b89e72430a84f38f8ea2e9c85370900405ffb23eeabf1a88ec2206aa48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503681, "uuid": "024b187b-580a-42ea-bf25-99db29c9945f", "value": "T174734A47AD629FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503681, "uuid": "d4687d4b-1dfb-4e73-a403-193779b502e8", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/C23yzTN7mj9VqYLe8f26e:v+eefvyoWWF/53Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503681, "uuid": "53c1ea63-a4ea-4dff-8eed-c7399182516b", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503681, "uuid": "e1af8119-471a-4995-9967-3ee51a560c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503681, "uuid": "aed197c2-291e-4bab-8184-84808c81c53f", "value": "s-h.4-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315cec79-6078-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752472978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472978, "uuid": "ffc551d7-87cb-4654-bdf1-3b8397d7620e", "comment": "Malware payload (Mirai)", "value": "7466b41102e04e2b5c70d146e8bdc0f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472978, "uuid": "748755d3-78cc-498f-a9d5-f0e864e6d64b", "comment": "Malware payload (Mirai)", "value": "8967c9e1f32bd587d861261e4cbdd278d98fae55162cc185c2c0f6cc5a6774b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472978, "uuid": "f33e4da5-fe57-4de6-80f7-35eff2b81133", "comment": "Malware payload (Mirai)", "value": "29d49d0519f06f7fe6fa78e3f0f204c6b26b0283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472978, "uuid": "5c6cf437-59b2-4d3c-a3ff-99fa533521c6", "comment": "Malware payload (Mirai)", "value": "9ee33ead15e2c477d98c9dbacbd26f18df559bb5ad777dcb8ff0df30f85dce44ed1076ad63d15ff18cfeec1060e7533e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472978, "uuid": "e122c0d6-b570-437d-9207-0dba0c55db91", "value": "T120E30A46F8819B11D5D111BAFE0E128E37231BB8E2DE72029D246F717B8A97B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472978, "uuid": "def8c17f-a217-4884-b34e-81fb9a324b4c", "value": "3072:08T6c64n/sBUJU/KOXPS4IB1rapCl3efQRN/aE:0bQqCDOXK4Inra4VdN/aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472978, "uuid": "2c7bb159-3a34-496a-8fdb-d0678fc7578f", "value": 146320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472978, "uuid": "bcf7b352-2c9d-4db5-bbcc-d1d093295e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472978, "uuid": "68ae12f5-5ee5-4ec7-b98d-6aa5b9755630", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ddf1da-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752493164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493164, "uuid": "8cc00864-7c2e-4239-a285-94cf7836fd72", "comment": "Malware payload (Mirai)", "value": "0074d6abc574ea6ba8db9f955b1e1419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493164, "uuid": "2e649459-ce1e-4932-8a06-a9283faab8db", "comment": "Malware payload (Mirai)", "value": "89ff66c2f059f8cc386aa4af70a2228e7af85fbc0c550157bc27c8d5762d0690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493164, "uuid": "c232a647-bc9d-4f58-8fc6-eca621c5a451", "comment": "Malware payload (Mirai)", "value": "4053645fa10121193812a4e35908d745e657b3ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493164, "uuid": "2792211d-7f48-45f2-95df-6945f5dcf94e", "comment": "Malware payload (Mirai)", "value": "6cdf9e36198133fe305c310629a7f86ea047695ac097155eda55b741a6a407ae870367c39a8f9070ba835d68ed073743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493164, "uuid": "af5bc5ce-5e49-4052-9421-d75af24cb917", "value": "T11193844D7E219F7DFBA8823447B78F21AA5823D637E1D6C5D1ACD6012E7024E241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493164, "uuid": "5b8edc27-e0f7-4e9e-adc0-79ff3de684e0", "value": "1536:lRXpeBDgwcvVopWOzZl8P6dTAaIhcnezTkcv80h/tT:NeBDcvdO1l8PMTvccUTvE0h/tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493164, "uuid": "da15e274-8f00-4401-991f-ecdf831ebec6", "value": 97384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493164, "uuid": "a346df81-9e21-457f-8859-32fc6ba2af10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493164, "uuid": "b5bd9f30-9cd0-4b3c-824e-acb207111a5a", "value": "top1miku.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2378d72b-6093-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752484552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484552, "uuid": "dc5b5868-1edf-4ecc-8086-f8445df2660b", "comment": "Malware payload", "value": "4817e64d124e8099cb1c726af0795bcb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484552, "uuid": "45a8dea1-d1a1-4342-8dcc-11c49daad40e", "comment": "Malware payload", "value": "8a4dd0cc6ef32c26a892592ab98addf9d60a0192d8ba89d3d52c396f4c50d098", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484552, "uuid": "08a19f7e-34fe-47b0-8d59-9e8c44fdf427", "comment": "Malware payload", "value": "1a548c5fc3b6e609667074f5821e84be5a4abe1a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484552, "uuid": "279949b0-a265-4f0c-8543-fc6d68363692", "comment": "Malware payload", "value": "02ad37186336ceb7174564722bf310e0ff8d0a4593ade17e6aaa1ad63ebe3ead716121b136851c40a219d78aad93ab67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484552, "uuid": "379031e6-75d7-473f-ae7d-c56a0d301529", "value": "T1E41833BFD2A0C710E15DBA31065B013DD275B9397D216CF0A892E8D9AED7EC70B3644A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484552, "uuid": "a128f9ea-b0a7-45a7-b27f-748f610c2f15", "value": "1572864:JTUUUAlpV3kCrUU25lsEE1A7LL4He/adPqdExLJBzzwi3ZCXYqJ04YT4o:JTUUfZLrU3YWd/aFAEJzB3ZCXYk04OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752484552, "uuid": "569ac670-9f29-41d0-8733-611280a6fbcc", "value": 92636223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752484552, "uuid": "dd1d2538-233b-4e6e-858d-6891d408bf8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484552, "uuid": "103c89b9-1de2-4d0a-93e9-25ccf87a7363", "value": "GMBH_2.2 (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bf3c6e-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492498, "uuid": "a0aa4fa1-02c1-4df3-adf0-46de3646aebc", "comment": "Malware payload (Mirai)", "value": "51b69ba4c49a2ee9c8c42bc4077faf83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492498, "uuid": "dbd8fc77-7648-4f12-b23a-b74f4d9070b3", "comment": "Malware payload (Mirai)", "value": "8ab5de147cccce1eccea9bd3503b08710b02605951c0c75554b53e492976038a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492498, "uuid": "21ba2ed6-be93-4fbc-ad86-a4916663b1a1", "comment": "Malware payload (Mirai)", "value": "ee3318e2e31984b1f5ebd972b202cb213b99eb0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492498, "uuid": "6db22cb9-9c5d-459f-add0-9ff3f915facf", "comment": "Malware payload (Mirai)", "value": "e38e8987be9f97f55e26237d3eead5f9a4c4bd7ca69e6a3c4f20de1ca1f911cb378378778a3dcef9f9b1a5fdd5e8871b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492498, "uuid": "0012114e-91c5-4880-8467-1f97cdd0d8c6", "value": "T1E5647233991584A1E0204CB3226777469C47D7BF88E726D3EE5A59B0FF3441B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492498, "uuid": "c08a2b00-c359-40c6-9c68-2d93b33ed40a", "value": "3072:Rbas6/LJOU+CF0l+hzUnR/WCxlKwjoSiJaNnHmXFvtMdxDaJaT:RbaS7CC4ahxQwjoNwBmXFvtMdxDaJaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492498, "uuid": "b3630260-8f4e-473c-985c-190b31541b5c", "value": 323819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492498, "uuid": "cb915c48-53a2-4f6e-8b1b-009f10e9b257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492498, "uuid": "2eabdf51-bd24-465e-a923-4500987123f4", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a3b8d9-60e7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1752520819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520819, "uuid": "b1418c76-e184-4336-a5f5-019eeff8aa7d", "comment": "Malware payload (CoinMiner)", "value": "97e1ed368f120531a91f8c98e29c80f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520819, "uuid": "9fa1a1f6-ed9a-42e6-8c4d-1f0148afc46d", "comment": "Malware payload (CoinMiner)", "value": "8c4923f5e0b73bcf0b540e3f033cb21dd5ef91570430fa3fa36206673fb95e0c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520819, "uuid": "81825cc4-77d0-4ba5-88f8-c3860db82ee3", "comment": "Malware payload (CoinMiner)", "value": "a3a4173d6492ce86c2afbce9c7d0b9dbd22e0a9e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752520819, "uuid": "67e542fd-340e-4ae8-9960-8d803e8739f3", "comment": "Malware payload (CoinMiner)", "value": "ecf1ed9e7ab0f639b0498b230e2453a21906773f95fcd8d7b15bfd0aa463f13c35fdb97d148a923526b4c8ac72a15375", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520819, "uuid": "c5f0ef2b-dfe1-4a70-ac22-8c2ef0d62b68", "value": "T1F6364BE6794AB6CFE48A17F89427CE42AD1F03F841100913ED59B5FEBE93D815289E34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520819, "uuid": "1d2f3c4e-6216-4d9d-b879-7efc97dcb6e7", "value": "f811af01ac6c2789aa091e7bc9b7b43a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520819, "uuid": "b025a1f9-4eae-42ed-806f-4fb8beb775d9", "value": "98304:TEj9kY+yjXkjaJLEEjvtRceofW8wSjAchA1xiKqrv8y:TEjRnjoegrv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752520819, "uuid": "ab2e2954-601d-4b0c-8977-c3d7207aa14f", "value": 5079656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752520819, "uuid": "3f3c65db-ec42-4a8b-8476-c6eef5342a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752520819, "uuid": "2bb559d5-d036-4ebb-acb5-c707fdbdad68", "value": "SecuriteInfo.com.Win32.MalwareX-gen.8034.17117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aec407b-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515998, "uuid": "23b244b4-fdd6-48d4-bb29-9d2fcb4fc98d", "comment": "Malware payload (Mirai)", "value": "36fb057f5bebfe93905d659ac64298d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515998, "uuid": "7419768a-c395-4061-840a-1e334d2e4ef8", "comment": "Malware payload (Mirai)", "value": "8c85e573042e68f3ab3388228d7e24b85ba605781fc5def7c296a99b2318ee8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515998, "uuid": "b4cb7a7f-8412-4c6f-84a7-fc54c6c7fa48", "comment": "Malware payload (Mirai)", "value": "d0aa942c9cf08f73f3aae88de1684e2aef65c7c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515998, "uuid": "1239a4f3-2bde-42d6-b0ec-e147d7de46d8", "comment": "Malware payload (Mirai)", "value": "8912b5a51b2bcc584418b2c76b1241284af03c7c81eba1425c89a635af36d9fc0f2ba16d0ae02c7e3edb5f4c48ede4c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515998, "uuid": "0dcb344e-332e-4ad9-8531-bdecc841f9b0", "value": "T12D03E11CA3181916D5E248392D3D8EC566015FC8E2E374251CB688BC7FCE952BBFD6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515998, "uuid": "15cb0b4b-fd23-4de8-880b-564825b9d79e", "value": "768:hzSK1dswYA8cwjv2sYveUm5fGYb4CHCWZxnyaz5qHfsHz9s3UozD:hvsg8cwb2sYvL7XCHbxyCY+AzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515998, "uuid": "6474b26d-1496-4b94-84b6-1d266950eae2", "value": 38572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515998, "uuid": "e5b5f801-7895-4ad8-b193-203ca219b0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515998, "uuid": "56bd4468-84a4-4eea-aa18-2830ff373dde", "value": "top1miku.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64109624-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752477788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477788, "uuid": "5b7118f8-67b7-4cd4-8ad3-5ef4341abfed", "comment": "Malware payload (NetSupport)", "value": "65c24a108b85a4627a10769bffcd76f7", "object_relation": "md5", "Tag": [ { "name": "185-163-45-41", "colour": "#0B6B55", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477788, "uuid": "56eb7fc8-b944-4e27-bea1-b0664c47f41e", "comment": "Malware payload (NetSupport)", "value": "8cc595fc35387bf28defa159f48d9de2951964f7de4331519050a59722fb8a42", "object_relation": "sha256", "Tag": [ { "name": "185-163-45-41", "colour": "#0B6B55", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477788, "uuid": "55022e6a-ebc2-40bf-bf90-a2dd9d424243", "comment": "Malware payload (NetSupport)", "value": "f20cb299066a17c4b579c29147cbc080326780a4", "object_relation": "sha1", "Tag": [ { "name": "185-163-45-41", "colour": "#0B6B55", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477788, "uuid": "637fce4c-ae56-48d1-b2a5-d4a07eacb73f", "comment": "Malware payload (NetSupport)", "value": "cc351c2dea4c3eaf6590c92e2f8467ff456ff21c0bc54b40aa591c12c16ca6d2c86be4e9ce1c102d2a21b119650790c4", "object_relation": "sha3-384", "Tag": [ { "name": "185-163-45-41", "colour": "#0B6B55", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477788, "uuid": "c06a4680-a092-4be0-a655-3355581d6d69", "value": "T101B633ED71545DB1DABADA262E7377D2C463C4225B0396B2A9047A4F40C93D0CB7A3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477788, "uuid": "47e7f041-7619-4233-a400-37c717df4640", "value": "196608:Ur6GPDBYxB3IYC2RY71g1gdHGHXOe9N/+hM24dPKnVTggfXbwWzk63Y:Ur6e6nBCwYFve9p+hMpdPKn/f0WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477788, "uuid": "e0452717-2542-4dc4-9b4a-41ddce634096", "value": 10477118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477788, "uuid": "4ae9ed12-d4c7-4086-bfee-4b76792cec58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477788, "uuid": "f2387c6f-ed11-49db-84c0-259b1860d235", "value": "8cc595fc35387bf28defa159f48d9de2951964f7de4331519050a59722fb8a42.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909ddb75-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517806, "uuid": "6cd50306-cd8d-41f8-9efe-92137e57a20b", "comment": "Malware payload", "value": "5371314c0ce1a7e11fc5399c3d933d71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517806, "uuid": "ebe7ca0f-ad02-4ad1-8472-5a58c5d4e70c", "comment": "Malware payload", "value": "8cfd8b03a51642e8618fe872bb36215ba619d87b4d15311c68ea71dd256b7983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517806, "uuid": "eaa3128a-fc91-48fa-8c9d-1f6e141abec8", "comment": "Malware payload", "value": "105036049f2e15a77857f92d961c2c569eaa7f84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517806, "uuid": "852329ca-cb18-4c63-bea4-08b05a027016", "comment": "Malware payload", "value": "e624a337a70026519d04716ed80dde0bc84b9ef4ce8d33d5d69532d7ed9bb03c9ee25b9b025dbb67cdb30e6ccd370948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517806, "uuid": "baf44152-9eee-4abd-a9ff-7d4a0e5f52b5", "value": "T11FC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517806, "uuid": "06fa2047-b8f4-45dd-97ee-ac6e0d84495e", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517806, "uuid": "227c71a8-1e33-4ef9-be99-313b6854e414", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517806, "uuid": "dda89bbe-b995-433d-a8d8-fbbd1bdad3a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517806, "uuid": "5e429376-6593-4cc7-9310-fa488c7aa476", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3467044e-60da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515074, "uuid": "5497b814-3331-4bf6-babb-32fcd45d316f", "comment": "Malware payload (Mirai)", "value": "f7dc2cf0fd30004bd7f25ca9744f7776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515074, "uuid": "65a6c819-bef9-4ab8-91ea-63e12e1a328c", "comment": "Malware payload (Mirai)", "value": "8e7472a26bc62069bbe68a906fa3652c4c90c614eaef286e5ef2c7bfbfedaaa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515074, "uuid": "1a122695-0866-4212-8835-edcbd7fcb322", "comment": "Malware payload (Mirai)", "value": "2de1c01757e6e9b2f70afe42e9afc33feadea2ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515074, "uuid": "42a5d33d-ed6b-4142-9dc8-0df550f4470a", "comment": "Malware payload (Mirai)", "value": "0507beaf6370febcead6079bed913a3ae9a3f952b54cb951961bc30c87ca43e47cb39c617a4f4b3ff0b7635dd845775c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515074, "uuid": "5e14c2cb-6014-4293-abe4-319370227098", "value": "T1AD73F8B5F8419E11C6C211F3B66EC6CA7E2603E7E3E932825B255B207E934970E77D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515074, "uuid": "5d00b203-8c8c-4024-80ad-109e0c3148c4", "value": "1536:m2oYFThv1Vq6eHoSf9ywHAAZP84ujiORC:pT5TeR3HDua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515074, "uuid": "2354bc71-e5f8-4848-bf22-b2c3c4112ca3", "value": 79544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515074, "uuid": "9832264f-3512-47fd-a632-298144ab7758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515074, "uuid": "9f1db0b3-94c4-4c0f-a024-f9ee2d568f12", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b75fcc6-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514227, "uuid": "94297bb6-1372-4591-8a84-b9a5f68cbadc", "comment": "Malware payload", "value": "4a350809c411be3c87a7ca8f90de14e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514227, "uuid": "e94bb1d6-a93e-45d1-afe1-6089e35bb6c1", "comment": "Malware payload", "value": "8f2ed50d77a7e54cb8882edefa6056b445119fdcb0656a02e5dd1e36b1160608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514227, "uuid": "b3ab2769-f819-4e29-8f3f-a131f9bb9234", "comment": "Malware payload", "value": "6d551cc1f8453cafe537d9b705ae91b64a6726a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514227, "uuid": "d2395c62-dc5e-4f32-909f-f60d4ae923ff", "comment": "Malware payload", "value": "1db3b02222da1d2a9b1f2a90e5cc764b361e7dbbbcddfc01dd503454769bfc6266a3b23ad8ec9bcf4b2ab5cc5d13c82b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514227, "uuid": "aa839334-d9a0-4f9a-9e86-08a385442186", "value": "T1FFA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514227, "uuid": "0cbe628d-5abf-4d23-916c-aa2c461eb3f0", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514227, "uuid": "bfd81c99-878b-46d0-a970-51baa221790e", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514227, "uuid": "a59dde3c-ab5c-49aa-a7b0-db2c61ce10c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514227, "uuid": "d9e34847-861b-45ce-b641-a5b63deb080a", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469ccc4e-6073-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1752470867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470867, "uuid": "e4c0a34c-529a-4098-93cc-f2a862c5f69d", "comment": "Malware payload (QuasarRAT)", "value": "16fbbb3402f4546c544d3eab8c030524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470867, "uuid": "ccbbfc29-2353-4aa7-a581-428697f34be0", "comment": "Malware payload (QuasarRAT)", "value": "9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470867, "uuid": "4ed0fbf9-5762-44da-92c9-0a12444e6d43", "comment": "Malware payload (QuasarRAT)", "value": "0b03c5b5a8991eeee426bbc85cd3d91b53f76ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752470867, "uuid": "02f65098-18bd-44e3-9849-7d58c5ccd64e", "comment": "Malware payload (QuasarRAT)", "value": "b570ea1cd3965bc0083fd1f32f025a80429dc6474f9b0f8dfae289411f42ad5401dc1cb1bb9f86b1c1d839e026bebabf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470867, "uuid": "4eb4dbf1-964f-4ba5-86af-84aad2a2dc2b", "value": "T159853312D15546BAEF73D9F6BAF2DDD3A7468A034731A101EC3E12D874531816BEE328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470867, "uuid": "63bd8a91-2495-4666-a1ce-755eb5a99f11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470867, "uuid": "f353aa82-5c09-4fc4-ab72-000c8eae15e9", "value": "49152:gWPYt89P76xlhM+n4UR3CF2Qgr3X4WTm7:DILLn483Cdgr3XRTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752470867, "uuid": "fe3f800d-4d11-4fad-adc6-6b18743dead5", "value": 1853440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752470867, "uuid": "3a8b3cc6-6c65-4c7e-ba9b-0fa9b4d88821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752470867, "uuid": "78a5a9f7-ef4c-4377-ae9c-51dbac8dc1e4", "value": "16fbbb3402f4546c544d3eab8c030524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc68042-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752496679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496679, "uuid": "5d9ee9c4-70b9-4bc2-9dbc-6c3da3146196", "comment": "Malware payload", "value": "916bf6edf24d9c904ac86564740fd095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496679, "uuid": "dceac261-3dd7-451a-87ae-c8d64c1f6ab6", "comment": "Malware payload", "value": "901f167f5832fa028fddce16ca07b484133620540d340605258bd75c1a78a6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496679, "uuid": "ecd1541d-f934-461d-9eb1-f0dad2da9f36", "comment": "Malware payload", "value": "51f412a9a35654abacf4283b4b555ab92c9a8969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496679, "uuid": "8994d69e-9b1c-46e6-b2ba-17b0afe1cbf8", "comment": "Malware payload", "value": "2c8863af58cf6b571ad4d22d42773d47db71f23a7211d88d9bb094bb8bfdadc644ef76df994f3149f202a36164ae6eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496679, "uuid": "03f2675c-f664-45d0-9436-96ce665ea44a", "value": "T1AFB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496679, "uuid": "9ec50c31-73c9-49e7-bdb3-2f03bddc5c23", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496679, "uuid": "de4d6cac-888b-46bc-abb4-1b6c79f31e88", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496679, "uuid": "65793d7c-bf81-4336-bb6e-3bf876da3796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496679, "uuid": "69bbe6a6-7732-4e0c-b89b-01bf11539aa2", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8585f24a-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479992, "uuid": "ec51df5e-541f-47a8-ab7a-eab0b6944815", "comment": "Malware payload (Mirai)", "value": "1a2574d875596fe9399a54bfd6775c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479992, "uuid": "c0bd4a6c-c74b-496b-b3ad-5cb072e6eb52", "comment": "Malware payload (Mirai)", "value": "90a19bc444173323f0ddefb8b2a521318168c27082f12c75e645e0dfbe4de37a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479992, "uuid": "53a6a0bb-93b8-4aeb-9809-aa5a294982bf", "comment": "Malware payload (Mirai)", "value": "43c2f1ff92ac6250988edeb6dfe25a8677844c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479992, "uuid": "f0fa7a09-e0eb-4f35-b0d7-6e87de79d375", "comment": "Malware payload (Mirai)", "value": "b47c567b782c19d548873500d6a6cf11c022ddb8f9cdc55a050440090e996450435f7473875c09d33a001d93e5b4b771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479992, "uuid": "a8846b4f-de05-4e96-b2c6-93096fda7639", "value": "T14D03E1923DEB2422E5306E30E772D8227DE52AA6511A313603F47209778AC1B967FD37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479992, "uuid": "1459abca-fd49-483e-bb10-ccbe2aac9f9d", "value": "768:4B/lEwbJsIQ7nb26sSIm03tGK/iC+b1TMVRax/tRMU4s3Uozr:6l5sIwna/Tm0gK/iCAd0RW/tHtzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479992, "uuid": "5a6e293c-21de-4533-b137-aae7c7390f6f", "value": 39576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479992, "uuid": "e805b24b-e5a9-419f-b6de-d4d2cf3b8727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479992, "uuid": "443fc5dc-196d-405d-a2b0-1f06a9caaffc", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190b6b8d-60c2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504720, "uuid": "9a93b9e3-70a2-4696-aeb9-64a9593683e2", "comment": "Malware payload (Mirai)", "value": "0da0ee545f4ddb18edbdcbc45c002a05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504720, "uuid": "f029900a-296e-4430-be99-c7ab07ebf615", "comment": "Malware payload (Mirai)", "value": "910b6d98d304869b2bf42f3f5f9e5bd2786f1a89bea6e88f362aec486ceda634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504720, "uuid": "8a443e37-bb4e-4a0b-b419-5a00b61b9ca0", "comment": "Malware payload (Mirai)", "value": "1edbb37ea2e408b5aaf97f80cac42a2d2841c022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504720, "uuid": "da118c4a-37f9-4da1-b587-a6aae695234f", "comment": "Malware payload (Mirai)", "value": "9e90d869da8a1c13d00708402832254488af8eeae07e715e5dea5ba040cbe835b93be05f48b887f71525b44eb617ea0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504720, "uuid": "d192da28-428f-427b-928a-a7f330745af9", "value": "T1C6730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504720, "uuid": "2bb8ad81-083d-4d9b-82fc-94b149b4d83c", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gpNU6P63z5yAMw1fxr/1eUc6I+i3JqwsjAr4:CskiIZJNlDWQNU6Ps4XwtJ/OJqwsjAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504720, "uuid": "ecabd6b1-ac38-4f5d-bc19-c102a12f862b", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504720, "uuid": "86ff56d9-78ba-4ef3-b945-2ddf2e7834da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504720, "uuid": "3d79ef1f-666d-444a-a550-ec02ca75c0c4", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b59f9ab-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481075, "uuid": "8d349d8e-6526-4211-a3b7-0b0f5b84b466", "comment": "Malware payload (Gafgyt)", "value": "109156944703b477985b141dc836c351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481075, "uuid": "a1cd682b-6ff2-4429-b9e0-5dea593e41bd", "comment": "Malware payload (Gafgyt)", "value": "914b3876bb14f853191e39cf5e605378a3397ccc92f4c474b0968eab2b8ac321", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481075, "uuid": "29d7ff50-cd8d-405f-8782-acdcb41beac2", "comment": "Malware payload (Gafgyt)", "value": "38b74d899afece7f25be1215acd3d8d76c5d2bb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481075, "uuid": "ad7d40f9-9adc-4ad1-b22f-89fe96e370af", "comment": "Malware payload (Gafgyt)", "value": "dee9b5ec8839fb35b364a0905cd4262930b395e9ee609f94b27361f052724595d7251ac8d32bd38712935021c09efa78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481075, "uuid": "a4b93401-2506-469a-82a6-5524ac6ccb68", "value": "T1AA836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481075, "uuid": "5f40dce6-d5d0-4428-8e5d-5d56476837a4", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XIuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XIuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481075, "uuid": "13e62bbe-c5d5-421d-bdac-c0c924432472", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481075, "uuid": "943e3fd3-63cb-46f3-a0af-5dbd10464343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481075, "uuid": "21dab90a-5d69-4015-b51a-5aebf0e3d647", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8bbe05-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503706, "uuid": "f843b38f-2e13-4689-bddf-6b5980b63847", "comment": "Malware payload (Gafgyt)", "value": "c830a94587fa473d6d13b83908f961a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503706, "uuid": "cd028d61-ba32-4a8c-8fe0-b323b499f493", "comment": "Malware payload (Gafgyt)", "value": "9169e5b59480e8036ffde9929fca93c6c650c832620b9c20f9bd6a02bb6959b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503706, "uuid": "c8cfbb56-2da6-416c-911d-6bd7f32d45df", "comment": "Malware payload (Gafgyt)", "value": "4a1d1f7fc9ab2eb539f4421efb38b9944f49b65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503706, "uuid": "793774f7-03a6-4d91-8b4a-6f14ca873327", "comment": "Malware payload (Gafgyt)", "value": "b620a3916a271c3c6e282fd89336ea1a9d2fd15f97b268d661488231fabcac4c63fcbd0039871581581af4aa88c77647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503706, "uuid": "275be2b0-002a-4314-9ad5-14ec43a41b0c", "value": "T10A042A57A6508B17C4D3173BB69F8240336387A9979B6306871EEFB43F8279B1E27901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503706, "uuid": "c1f3f662-2afc-4d39-ada7-aa324fb37ecc", "value": "3072:sfouG24UGy4aFQQaHVK1di+7BmmUUpf+wNq+AJM/9nIm/F5+BT9N:sggv74aFQQaHgvi+NUUpVNq+6M/9nIm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503706, "uuid": "0ee97c23-5468-46fb-b957-abb7526e3ead", "value": 179041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503706, "uuid": "853b9233-4029-4337-824e-28b353b720b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503706, "uuid": "d6fff876-75f1-45d2-9e53-dcd29cf7a1d2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9735893b-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536715, "uuid": "ed696f53-d6ad-456e-a305-65d375ecd3f4", "comment": "Malware payload (Mirai)", "value": "83a27d060432d25953331135748853ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536715, "uuid": "b35d7347-7d41-4ddf-843d-ffead4cc6ca9", "comment": "Malware payload (Mirai)", "value": "91adbd0c9b6d7c491d3ae3ab9c6f6fe3159cb2a4fba2b166d8bee4ad0d545326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536715, "uuid": "f4be714e-fb5d-4180-8f14-4e8394897216", "comment": "Malware payload (Mirai)", "value": "f2d497a5a21901b600d25c0164e776e15954c862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536715, "uuid": "51740b2d-7c3b-4ea9-bec3-9c5757b72a53", "comment": "Malware payload (Mirai)", "value": "ae2dd8218b8af75341d7b98ab6c5bead029db43338674556b3ee8c4640e8ce9da5716bb1b10647478a0f3a885e57b1ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536715, "uuid": "af91225f-2d2b-4015-8e8f-c2b71f6b1f70", "value": "T1CC834A03B18190FCC0D9D1784AAF623AE972F4392234B6AD37D4FF167A69E202F5E514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536715, "uuid": "8720acc8-61cd-4bda-b345-6f8c59874d72", "value": "1536:XUcUwE6VEQ9FAz9N2UOCJJcrAXekJ+1RiQkjhXzHAIPhs+2xEKL:kcy8EQ9AHdOCJ2UXeP1RiQklzHAIPh17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536715, "uuid": "80f31f03-3e37-4c4a-8f87-db901976805b", "value": 87936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536715, "uuid": "02cfe262-83e3-4d47-b43e-0b8adb6b49cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536715, "uuid": "6a1a424f-8af5-4140-a727-948e51e5c133", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012d8f0b-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516277, "uuid": "c6e211f9-6a48-49bd-b0a6-63cfaad8f396", "comment": "Malware payload", "value": "2cb5f4ad80707475bc8766b75096bdf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516277, "uuid": "403f64e6-c34e-42d5-bc5b-d98c3cc1af4f", "comment": "Malware payload", "value": "91ee0b27b9412f186a27cb2c92be99d64ba180f86f08fcee6c7b77a031ee7ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516277, "uuid": "118ba659-83c3-4e60-81f4-3bd6419aea83", "comment": "Malware payload", "value": "3b45b5c0f0bb20293d770ecfbadf8b7c97d728da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516277, "uuid": "2ea86e59-0a95-4a59-bf97-43c330acd994", "comment": "Malware payload", "value": "3e0983226fcf06b73bbf7c383077096e3ff7869b7b7ccfd3f45113a417befb7cbfa5e5af5304fd4d7ca0155273c381c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516277, "uuid": "72e4236f-9f22-43d9-a549-025b67156fb7", "value": "T100B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516277, "uuid": "78ad99ca-332f-427b-85b5-1d0f09946803", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516277, "uuid": "c3a3f75d-dc04-4b2b-8477-d5aa7e2bc64f", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516277, "uuid": "ccf6461b-f305-44d6-becb-f8ab9cdfb9cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516277, "uuid": "ec503e80-5cfd-49d0-a727-2a711c7570b8", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c4b857-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752482700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482700, "uuid": "29a0b5ed-3813-471b-a928-63dbd770ea92", "comment": "Malware payload (Mirai)", "value": "92933c02fad36de5a189d17e7b881b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482700, "uuid": "ea049b49-b34b-4bec-80f9-30a94b7e4d47", "comment": "Malware payload (Mirai)", "value": "91f7ad3c4b87381e6824feb638a598b1fdd321f97b67b694fa45aafc3e274555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482700, "uuid": "eaa3c2eb-5410-4c19-94be-f71d1b0b724b", "comment": "Malware payload (Mirai)", "value": "d500ae5ec70bac018ca908e94a0a85f102146576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482700, "uuid": "4d4a7f73-cce8-4977-8506-b8a085f91d0e", "comment": "Malware payload (Mirai)", "value": "0f245cf3611f7b6f60ac64e1776b27a2df090a803988d27b50de017524b1800f9af18af406c05bc802c6f62233163336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482700, "uuid": "71bf1619-2265-47ae-bf79-0af82c2c4f49", "value": "T18A632B95B8818B21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482700, "uuid": "5477faca-7f96-4d42-b3b2-79e926fc0290", "value": "1536:ZgnAkIP7B9stYVenVQmqctQrqOSQPMAiCu2aaHLLJa10/t:BP19st6en6mqczQu2aaHLL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482700, "uuid": "02b4e701-5368-4a2b-ac85-78ba07741f4a", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482700, "uuid": "626ac866-8c01-471d-9988-63bd24a3b7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482700, "uuid": "c6386e5d-9a74-4b57-b60a-aa89f0fb9a47", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f097ad-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513084, "uuid": "6f092b5c-77c5-461a-8120-58936407b455", "comment": "Malware payload (Mirai)", "value": "6b16860bc253cacd7a6d03e2d01e2878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513084, "uuid": "24a7f731-9d47-49d3-b22f-044cb8c8f7e8", "comment": "Malware payload (Mirai)", "value": "9223d71b14dac455ae253cc7678296c7927fee768fc4c00ea5999778d666e8d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513084, "uuid": "f2d652d0-3639-4f3b-a25c-41cb24860aa4", "comment": "Malware payload (Mirai)", "value": "ecbc5cb98b8dcd765c0751615665956559ebd823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513084, "uuid": "db3d1e26-c91a-4f1b-9024-6a254807a5f2", "comment": "Malware payload (Mirai)", "value": "7118eeec15cbd9d07de5a703b08c97c38cb7d3904acffcebc5127345d3861560e4dad3025fa3bc4c6f3fc1b7bf614c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513084, "uuid": "6dceb4df-e436-474c-832d-e67dff70e5ca", "value": "T16403E0BE6611583DD68C90BD13A20BE32ED40F42CC81E98F7ADB76A3DC4259634C6AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513084, "uuid": "8740afaa-d08b-435e-86c0-8b922ee3cb37", "value": "768:mV+incTQwqkJZNtmPV91Sr+SpVaEWvZhBpiEHJCch+UEhJgGlzDpbuR1JFf:m8itwqkJZNtcfY7VaXZvkEHCPzVJuXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513084, "uuid": "3622ddbf-0bd2-41e6-aee3-7353c6ce8182", "value": 41040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513084, "uuid": "849700d5-f9c4-4412-8e0d-d27d600b54af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513084, "uuid": "7d32cd75-85d8-41d2-ad0d-5e5172c7a14e", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97fd483-60b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752499487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499487, "uuid": "72cae975-ed41-46d3-bcd9-7d391b243009", "comment": "Malware payload (NetSupport)", "value": "21b91452640124ecba3b425f591c2bd6", "object_relation": "md5", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499487, "uuid": "13be8c07-e9a9-4c5c-af11-5b900daf932e", "comment": "Malware payload (NetSupport)", "value": "928b2d9c192e86a437b31725ee726dedc908e9cb30a48c1546973f201945f60d", "object_relation": "sha256", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499487, "uuid": "18cddcef-960a-4901-b199-2b3bcef8a967", "comment": "Malware payload (NetSupport)", "value": "50ede2b2ecadfcce33b2efcf44b7d9d77271a1af", "object_relation": "sha1", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499487, "uuid": "29e6092d-7be9-4a0f-ba3d-94f1ee172419", "comment": "Malware payload (NetSupport)", "value": "f3ff4932ea627b4f1a51c05b888df0e5c581f57c76eee6ad263b094c0c7a8748d12c269f300033c5bb6b759a76b74df8", "object_relation": "sha3-384", "Tag": [ { "name": "45-142-193-119", "colour": "#F41B1C", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499487, "uuid": "4817a9f8-d703-4f2d-beb1-80d202430282", "value": "T18EA5335B6530FBDAF42E51F521CC66204636BCE0A6D5F158C33893B92F70EE1AF24856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499487, "uuid": "81a23ed9-70da-4c16-9823-3262b6a3b364", "value": "49152:7pHNIsvPIWfhCA2caM5SAdjltCQC7V0OLjNLS2BssB+Y7dz3H:7oWPRqzM5S2UG+LSassnZ7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752499487, "uuid": "fdff1fcc-0ca0-4737-83a9-6594ba593ef0", "value": 2247323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752499487, "uuid": "42dd5db4-a5dd-467e-b5fc-67a3849b2a75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499487, "uuid": "57e15014-607c-4fd8-a993-1349e066cdb3", "value": "p1c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f705a98-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494853, "uuid": "2b378c7b-f837-4dde-a08c-0a4ee4a39c18", "comment": "Malware payload", "value": "d9282bcd50f84780a36cde8dbcbb70c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494853, "uuid": "135bc619-a005-48c6-bd14-ffbce74cc744", "comment": "Malware payload", "value": "92a20dfaeed96989eb70f8f40b16045189ec12461877ec5770d1a64c28176d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494853, "uuid": "1707b4a9-8f9c-4b78-9920-663464b6b5ea", "comment": "Malware payload", "value": "846502e0ed9c75dd7ddf5450399f7dd738fd4c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494853, "uuid": "33887b06-d2e1-4c1c-a120-185bc4b6b615", "comment": "Malware payload", "value": "ef80fd06dfbdb9ebda826b7d0277334612eefd26451fd2ba97348834a6702e309b4900a4f9c0bf2d8b0e477ea83fa821", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494853, "uuid": "f134ce0f-1762-4978-bd16-4880171481a7", "value": "T17AC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494853, "uuid": "6f6e1378-c1fb-478f-8a57-6fb6cac33bf8", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zg:W7v+mrY2xzf03yvZ/YIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494853, "uuid": "dadd2bde-739a-45f8-8f1c-20a8c712a1ab", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494853, "uuid": "13f07136-4d47-443e-8b74-2bef9945bda6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494853, "uuid": "36b0fae0-5782-4389-9c7b-56245fe8bced", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870dcefc-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478276, "uuid": "115923d2-d569-4844-8ecb-89304b35ec5b", "comment": "Malware payload (Mirai)", "value": "c342ee99f6312736d55393e78be2358b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478276, "uuid": "e4379aa6-5f4e-48b5-8551-63d067ab2de1", "comment": "Malware payload (Mirai)", "value": "934d5a4f9c6a4509bbf675f1cf9af09427d75cdb2e6b33b7b76e4a96c4f8eb67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478276, "uuid": "e47251a6-1896-4d7a-a8cd-febdaf4c2ff2", "comment": "Malware payload (Mirai)", "value": "11e1849efde5761523d3eed667a0207d0550b432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478276, "uuid": "d63a7542-50e7-4859-8131-424e55ab65aa", "comment": "Malware payload (Mirai)", "value": "2a363f0dc7b7af0235bcc19e5e78790df48e6abfae1ee995e28d212e5a3d7e152ec434c1c6d3aea670e8d9ffdd255c34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478276, "uuid": "00c70f35-fd9f-4957-9bdb-01fae8b0f652", "value": "T1F8D33C02771C0A47D1632EF43B3B17E093EFAA8121F8F644255FAA8A9171E375586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478276, "uuid": "bb9f6c73-3062-4b12-be0b-b4f12149ecf3", "value": "1536:Z2vOxTPY0xU3rWQgGX3cVqs4xriYxBdavvl8truInmqWkaNCpNjivAOnCj5ZGiAr:sOx0azEns4xrZxBSN80waWNPOAk76yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478276, "uuid": "339b52fd-6a2d-4ddf-8dac-fbf4d28fda05", "value": 141944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478276, "uuid": "c37e7a32-f1f6-47a5-b56b-a128d48da2c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478276, "uuid": "c7da3b83-e0f0-4a9b-a3b5-bfc128110ec4", "value": "bolubotnetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9618e130-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752515668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515668, "uuid": "62a26fc2-02a5-4aab-bf0c-59db32058da0", "comment": "Malware payload", "value": "c83ae0907f8a29acb1bce864e5cab303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515668, "uuid": "da8fe6c0-127b-4fea-b1ea-bd79619558ec", "comment": "Malware payload", "value": "936451c2794e0dd8e0575ca7d8b306702614786511627b8a9d36eaf8a6ef71f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515668, "uuid": "7255782b-2c93-4ae0-beaf-f296906f8cf7", "comment": "Malware payload", "value": "8feb9e07e206d07015ae561d0774c78461d1cdc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515668, "uuid": "78c2254f-ce27-4d83-90cc-5e7815319440", "comment": "Malware payload", "value": "ce0eb35ee21daa012eca387eca25421b1ffb7272465f8aa7b3ae26bee82fdd3bb7f1181d186f0343a7e718edcaf8ccf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515668, "uuid": "72ebf10d-d53a-4bb1-98dd-e67494255ce3", "value": "T1E3647D11B9C18032C67338304779E6B29DAE6C311D255A9F93A819796F74091FB3AB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515668, "uuid": "a5e7c19b-88ae-4141-9533-c2458f9205b6", "value": "7ca966277e27f41a2a0bd1230870de0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515668, "uuid": "b3aa03a1-6ca3-4116-9a96-67e7dface512", "value": "6144:Qn1b//GXc1f+2F+ZR5JWfJqoA08TMTSV9tDAa:yb/oc1f+M+bGhA9YUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515668, "uuid": "f6fefb56-0307-459b-a11f-b6920a0b333a", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515668, "uuid": "e2108d3b-3924-4687-9c11-7b1c26b7cc5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515668, "uuid": "bfc5da91-c344-4069-83ae-59b8b892e485", "value": "Haste.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0eeb3a-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752485101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "45cec72a-ebde-407b-9201-15a06a8d6ae8", "comment": "Malware payload (AgentTesla)", "value": "cca3b63b7101389add0672dd17daf9a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "f27ce282-8e9c-4ac7-a1e1-0cf61dd6f153", "comment": "Malware payload (AgentTesla)", "value": "939adafee7fd3b294a363969520389b8390412da3869677d34feeed44062abf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "0bb6aeba-e2b8-4dcc-851b-527591cf6869", "comment": "Malware payload (AgentTesla)", "value": "8dddcb3f2b7070d66b1eb5fb578a6bcdd99891f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485101, "uuid": "e5d663fb-ec3c-4235-aa1f-249d96a3d4e2", "comment": "Malware payload (AgentTesla)", "value": "afc776daedba5a2ed4564131c3867ffbb2298b3fdd802743f4be9f57f472f1ab60c596ab8aec98a70b63a55206fe74c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "c20b0016-e210-4cb5-8bbe-b2cf0e1132af", "value": "T1B3F4014061399F22C5BE07F21912D1B017FB4DEEB021E3574EDAACEB7964B841E42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "5a81222f-e690-4f3c-b2ac-7626506b9b14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "81147950-2995-484c-a38f-08ddd94a83b6", "value": "12288:5frsJd/3plPxXTwzOX15Cw/8vZrUwMIbfCni7vb0TTjt7tm7uJbPN/lBuVV:VrsJ95lPxXTwzOXOw+ZrdMjw0nZ7wmb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485101, "uuid": "88ec8928-8050-4a03-b058-9d946fbfffbb", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485101, "uuid": "a692be11-156f-4d9c-a61b-e36a8ec02c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485101, "uuid": "cf02c10f-da86-419d-b727-3ac1afa86a51", "value": "RFQ_071425.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaf1ba8-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504648, "uuid": "91cc69ab-9daf-4187-a296-b5ab469f0995", "comment": "Malware payload (Mirai)", "value": "0158a41e440ff5c44d4127790809e455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504648, "uuid": "5a11c548-5984-41d5-9df9-d60fce61f505", "comment": "Malware payload (Mirai)", "value": "93f8ddbd196dfd2d3d5da58596b154c64e4cc9bfc76cb0c99df2d460d293a21c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504648, "uuid": "690f3fe5-ac6f-45e4-9a82-222cad927124", "comment": "Malware payload (Mirai)", "value": "d11a79193655f3a901639fb4ffae3ee8514aac26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504648, "uuid": "9bea86db-e7cc-477c-ad1d-d466b92b4d85", "comment": "Malware payload (Mirai)", "value": "dbdb181b201bfc07b5aec1c2bdf76a39875c759bf8cdef83ac23b8a17d872382d797061b941dfe0807d445b7a03c28bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504648, "uuid": "08fd3a40-ee61-4712-9a1f-37a5777707aa", "value": "T19E533B99B4029E3DF88FEA7984160E05B92023D112931F276BAFFDE37D331659D06E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504648, "uuid": "5012ed1f-a021-42ba-8be2-05af7fedc648", "value": "768:2eY49YE204qEkRf/36fjdDe5QlF4vTgFHa1euk8B8vpG97ErlfXySJ1oXvK7P9:2Y7EkRfPAk6s8Fa1Xk8B2aErlfiSJTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504648, "uuid": "1735ed1f-f2c1-42a4-9f01-d64542462a97", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504648, "uuid": "300e4c47-5929-4027-96db-a2be6d650a98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504648, "uuid": "c6c9b6e6-b8ad-49d3-ac3f-3102bc7e1ef0", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8922b5b0-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478280, "uuid": "0bff457a-bb20-49cf-bbe5-16f8d7c5058b", "comment": "Malware payload (Mirai)", "value": "a4dae7c895538649ea78e3e20c9226d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478280, "uuid": "f959b173-1a35-4ee8-ad77-a9a39ea5c436", "comment": "Malware payload (Mirai)", "value": "93faf287520cc18f1ef8fce7403dd814e951764cf5fa69d36255b311426d02f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478280, "uuid": "af3bede4-f398-4505-b1f4-33929f9a14c5", "comment": "Malware payload (Mirai)", "value": "62e29afc07f182e6fa83fa81e03cf4a6c13b76ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478280, "uuid": "2bb5542c-63e9-4656-9ed1-154f5a8829a7", "comment": "Malware payload (Mirai)", "value": "a5561a80a49a3d31ef26b985d06b5b041977f6455e3438bd9f62df103ec5a8d409859abcaccea86cf255e3d2512362a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478280, "uuid": "f4d2fbad-beb5-4276-8f8a-950346653a2b", "value": "T199F329C7F800DDBAF80EE73B48630905B130B7A164925B372257797BED3A1D90967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478280, "uuid": "884bea27-d03c-48e8-ad6c-3d0d2f7a8727", "value": "3072:DLJUgjUNIghBKwo3iSrelg54TJhjGSzd0VljbiiLScD+yYTHVc:vRjUa5Ui4VhXzdYLS/yYzVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478280, "uuid": "42f46028-a4be-43cb-a329-5d904310d112", "value": 159552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478280, "uuid": "44b244ec-cee0-4587-ac6c-5fce926ed082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478280, "uuid": "bc3da309-bc06-4e41-ac03-c6ff09e74f34", "value": "bolubotnetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ecdd9b-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752477878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477878, "uuid": "4a2af815-6d9d-4acf-aec5-e746331a6696", "comment": "Malware payload (Formbook)", "value": "2f2b17d732fb8a37f04ae7b72fc91874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477878, "uuid": "306acf5f-f047-4cc6-bac9-34f3e4bb1771", "comment": "Malware payload (Formbook)", "value": "93fe733f28063459df03c7d1c73470f36c7ddc848405822059655993a089858d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477878, "uuid": "765eb32a-a386-44bb-b51e-b8b5c8cddaca", "comment": "Malware payload (Formbook)", "value": "7936f1d3ba16b990d0994514da70545440bbedcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477878, "uuid": "526f4739-e69c-41bc-ab1a-182263e2c271", "comment": "Malware payload (Formbook)", "value": "7bca31a950e9086aca7feb4354886e20d68353267afe0042896524fc79a98209307f95a5aaa5865018916858de9bb1cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477878, "uuid": "f783a417-3c52-45af-b6a8-7073301fae11", "value": "T12945C02373DD8361C3B25273BA26BB01BE7B782506A1F56B2FD4093DE920122565E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477878, "uuid": "7c37d8a0-5b8b-4583-892f-d88e06c55c88", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477878, "uuid": "cee8b32d-4273-46f3-9f29-bba777d4b57a", "value": "24576:Ctb20pkaCqT5TBWgNQ7aKd8L5XHlt5C0gc6A:PVg5tQ7aKWL3tM0p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477878, "uuid": "06522c90-a830-4c38-be70-cb0ad55f00b6", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477878, "uuid": "47c38cce-eea7-4ec7-adbe-8cff93625803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477878, "uuid": "11c5d47e-d1d7-4cb0-ba6b-ddba481d0859", "value": "Swift_Copy_MT103_747467JFJ_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b457b13-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478283, "uuid": "d313049c-546b-41d7-b7ed-beb13e616336", "comment": "Malware payload (Mirai)", "value": "c41c0c71ea338c12118d2d24a00d4f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478283, "uuid": "ef2b8ccb-368f-4811-95aa-b5b8c120ddd4", "comment": "Malware payload (Mirai)", "value": "94166b35d4fa064c689c8220453418f0747a9a2421828afc10b210c0f143cac0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478283, "uuid": "4fe56491-5b2a-45e2-907b-0ed29c72eac6", "comment": "Malware payload (Mirai)", "value": "9d5a52b27189d249d0d5596d48dbd20cb23ba931", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478283, "uuid": "ea0c841d-f17a-4022-b450-382f860931f5", "comment": "Malware payload (Mirai)", "value": "83b685b97cfe8e51d73ce2772b4dc601562a130cd1c0d13e63d9020e5f69fb588895ac464bbe9aeb86475056d04c2b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478283, "uuid": "05472347-d4bd-46bd-a147-476b0be64a0a", "value": "T12DC35B77C8296EA8C654D674F0708F781F93991181475FBE69A7C2B98043D8DF60A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478283, "uuid": "9d26cb69-7167-4b26-b99e-3f3da5a2ca13", "value": "1536:x7HaQwt2WOypOk576qz4UqQK0C3KA0SdXEePVDZV6rWHBfi9ghhoJ/1:1npKF5b8UpHAOePVf6rWhfiWoJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478283, "uuid": "52d5eebb-3949-44bf-87e1-0a1a5eb7c2e2", "value": 125284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478283, "uuid": "199ad084-0ecb-4c44-ba12-29587232ab2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478283, "uuid": "4c47b570-7722-4040-89a1-c25c1e787491", "value": "bolubotnetsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c046a2d-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481076, "uuid": "f1fdc9ca-8d58-4b32-8951-59a8b25fcdaf", "comment": "Malware payload (Gafgyt)", "value": "cbba57b27708fb57a437bc5772d1cf12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481076, "uuid": "df737316-9af9-412c-b2e5-94ac634f3059", "comment": "Malware payload (Gafgyt)", "value": "9483015901aa045adaf9587cb700571a063c8a4fcb37372a83765f955f06339d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481076, "uuid": "62a83a54-5c39-4ab6-8a3d-2b94904f0e52", "comment": "Malware payload (Gafgyt)", "value": "bf20e90ea8c67c33d2b09de56c75e9389938d74a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481076, "uuid": "809632ae-6906-47bd-8c78-adf13436059a", "comment": "Malware payload (Gafgyt)", "value": "2f0d51eb8a1f0199c4b53d902bd97321ab99f6881aa33b017abe1e3213c94643910d732f7037269db80ad31aacaa0790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481076, "uuid": "0b19d530-fa24-4dd9-9bf4-43cbe9501255", "value": "T10B930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481076, "uuid": "e6d40faa-1257-40f1-8e17-108d16fe713d", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxqePczYrmREqQ4b/X7XSee:OQ2HYBv1WT/ePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481076, "uuid": "6e75708e-421d-4bc8-8899-44de4d9db108", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481076, "uuid": "3d7d7db1-c294-42b7-93bb-dab1d8e38aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481076, "uuid": "7026e12b-c8f4-4878-95a2-960726f86da9", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b970d1c3-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503701, "uuid": "c6372dde-cea8-4c2c-8f1a-8e71e428a6df", "comment": "Malware payload (Gafgyt)", "value": "002c1ef005a0b00c2e8db2d94efaf570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503701, "uuid": "c682fd29-4546-4568-a94e-8fcf2c4d5ec1", "comment": "Malware payload (Gafgyt)", "value": "9483690833cdf3f3b51883a0694c4b12cd3704323d390be072fb6d4a3e8c2e22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503701, "uuid": "e0811372-6d8a-4d01-9176-02119400e799", "comment": "Malware payload (Gafgyt)", "value": "0019cf62cd82a0ccda40b269aa1bbf402803f9c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503701, "uuid": "bc9f788c-a8ce-4a56-a60e-f8db078390a2", "comment": "Malware payload (Gafgyt)", "value": "3842bfdf1d79ff8d8e75644693642c3befbb2de128203fc7561b948fcf9e2deff5310574aa6c0b09aab66177ddba9460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503701, "uuid": "e17b7607-5b8a-4c7e-9a72-1d898056e4fb", "value": "T1D0731AE78785DCB5D5820774A3D3A31239F1952913DBF5C2CB7C9D208C61403AAEEAE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503701, "uuid": "8d5a7658-f7be-4941-a174-829cbdd87d27", "value": "1536:STozsvEQGcibERJkmMV1eR1y/IPGAL4VpcywOqdL4PCC2CGCCCCCCCCCCCCCpsC1:SkzsMQaQRJk/1Q1+IR2qdL4PCC2CGCCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503701, "uuid": "c5fd7541-3bbd-4dd1-9da4-fee9798913bf", "value": 79212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503701, "uuid": "8aa71646-2d53-4cd1-bd99-ec8c47a79d53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503701, "uuid": "17eedc37-a026-4b5e-bf45-4d55cbc35bbe", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a70d24-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752477814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477814, "uuid": "b10a80ac-7a6c-4faf-82b3-c1215e54168e", "comment": "Malware payload", "value": "8a5b70c15ded10292fbfaf42836a96b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477814, "uuid": "7dcf2d81-bca6-4a47-ab77-5ca0d696ba73", "comment": "Malware payload", "value": "949349b317bd5003724e5ba5a156fdecc6cf5327581683a1b987abd7692c2515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477814, "uuid": "72bf1cb5-4b23-411b-82a4-6f3189ab11dc", "comment": "Malware payload", "value": "442ccb2d493bfa560767fc957ab116716c53425a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477814, "uuid": "6d1e4cce-9edb-4469-b32b-463b38b46a41", "comment": "Malware payload", "value": "d8c7de25e32a66f5260a62e88bff1f98277311a2683bdaa938440306eb15993c4979138edc39707cf21179ac40e27e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477814, "uuid": "04f016c4-62fc-46dd-989b-93633ed02208", "value": "T139C4222175F0C477D8F20E705FB902658BB8AAA955D51A8313C4AAFD3EBA343493E347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477814, "uuid": "07fcebf1-9e75-44f2-8cd2-3a2ff7219bd5", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477814, "uuid": "4f0f9acc-2b47-4f71-985d-8892ac783e38", "value": "12288:OYOkU6mk1j8I8A3H4gQykAAS9M8RyBpYV/88NrpcZ1To9zKE:PO1gl8A34Mk8ooTwZ189z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477814, "uuid": "cc328808-2a87-4346-ba16-97fb682a6548", "value": 580400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477814, "uuid": "ac8009e3-b4f9-49bc-a535-0befb17c6adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477814, "uuid": "675a4baa-7025-4af6-8b10-c82cb4f81bc2", "value": "206436908754-852357875324570-876567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2dd344-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485074, "uuid": "31e79560-6158-49db-a363-5d00855548ef", "comment": "Malware payload (Mirai)", "value": "afb721954d54bed9b399b4c723af5eb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485074, "uuid": "574b3885-1a65-4c84-ab81-df997818ff37", "comment": "Malware payload (Mirai)", "value": "94b20f4b2e4a96aa4c1374d24b9d9943b9a92c1b10486cd41fcef5b09a50a2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485074, "uuid": "15d02e1c-a5cf-4ace-b050-8410169e6b29", "comment": "Malware payload (Mirai)", "value": "50096206ac3e24d838443d478aef0febb5056103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485074, "uuid": "56b3a886-58b9-464d-9661-6055655f52c3", "comment": "Malware payload (Mirai)", "value": "6aca63a9d07073552c8d7e7cf9289d20d8730d490e6b4be999485e82154ef1d6ce5e3b9b57464c9420b553dc2f65ca1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485074, "uuid": "ff5103b6-1d61-49f4-9dfa-b11cd7dbc349", "value": "T151D2E07C7B0249D7CAAAA1B84DE50B262D608FB2F1436C076558D9D7BB0A86C2CB5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485074, "uuid": "96f55fdd-32cf-470b-ba93-d38809d3a78d", "value": "768:94ylAtv6pqLJM0RXaxGyUbXtheU/S792JgGlzDpbuR1J9:GMBqTRXa+Zhr/fVJuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485074, "uuid": "5e3cab50-7660-42a5-beeb-ed9851116911", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485074, "uuid": "6263acde-fc8a-4c0f-921c-df8aeced7a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485074, "uuid": "5238dc67-361e-474c-bd7c-1ed9de3e5e76", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb78b614-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503704, "uuid": "89701dea-5212-4285-89b5-0f589b0b880b", "comment": "Malware payload (Gafgyt)", "value": "723cee7a41cbb26f7d4aa2a93881a095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503704, "uuid": "ba03ca5e-d50c-4c19-b560-f47224ee8243", "comment": "Malware payload (Gafgyt)", "value": "94bf5753b49b2284dc9f2addfc1625db82a3dcb6a12f20e857d86a7c6cc308a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503704, "uuid": "59b70f9f-aaeb-4610-b7dd-0aced53d4bff", "comment": "Malware payload (Gafgyt)", "value": "70facc22f36a1fa95755ac171e2f929fb0bae972", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503704, "uuid": "47fce0c0-756f-4413-89aa-62d6ed6c03b8", "comment": "Malware payload (Gafgyt)", "value": "6cd555f42f04deea0b8677b9456eea99c626d576f89573be7f47ff59f2eda1f719759b8cc1c4e182c99284ece8b1f6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503704, "uuid": "78b2ac84-95b5-4abd-a80f-06462794cd9b", "value": "T16AA3C583A400DD7DFC6F87F6E552400532B0E3EE5BF30D65A72A7612F86B06D9A62E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503704, "uuid": "aab881f8-04e0-4404-bd28-ab2298a54b6e", "value": "3072:qHx7Tf31P48PvZn0id1dk0BsOvuyysNBh6t:6DnLk0BsEysx6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503704, "uuid": "6dd0fd62-e5d3-4ca8-839c-72e9494754cd", "value": 100084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503704, "uuid": "3c379b60-2e8b-439f-a9dc-5a8f7e5800da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503704, "uuid": "64f345c9-91d8-404b-a284-cf4f0679648e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c4f7cd-6093-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752484881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484881, "uuid": "8d71c81a-898f-4a0d-b2ce-93e5201dc79e", "comment": "Malware payload", "value": "39403d72896adc530045469a306037d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484881, "uuid": "3fa7dbf5-d8a6-4fdd-a324-b29f19b67644", "comment": "Malware payload", "value": "94db8c0f213b4375cc8c86c1980845c77e5510595b152fad7bf04f3a58dd5ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484881, "uuid": "57595e9a-5669-4406-aabf-f8bb259670d9", "comment": "Malware payload", "value": "9cd2841c05ecc07319548d20950181784e18e881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752484881, "uuid": "4d16daa6-ce9a-417b-8caa-38c6ba26f98d", "comment": "Malware payload", "value": "e6d1f6557128e427e12ff966f23fff2e701b8545640b7298fa9dddaddc90f30b042ccf923fb85426f71492119da610ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484881, "uuid": "6d56c695-591b-4f35-8ce8-df784bdaa275", "value": "T12EE401037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484881, "uuid": "6ecca95c-b9c8-4de2-91e5-22c9315da09f", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752484881, "uuid": "92bd9429-0fa9-48d8-b82f-d3735e5f99dc", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752484881, "uuid": "fbf5e19b-cd2b-48c0-a2a6-6641a15b2fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752484881, "uuid": "118b23b2-fa30-4b75-9633-6af138910008", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929cd3a0-60d5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513085, "uuid": "2fc6c7e1-cc1c-45b5-b0a1-4814a0e6e6aa", "comment": "Malware payload (Mirai)", "value": "d921a52f001f4efc7f6565d74b537b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513085, "uuid": "c022816e-ad40-4495-8fb6-9bd161ae43ca", "comment": "Malware payload (Mirai)", "value": "94fcb7a0db25f4e91eeeb6b85f4912a4621547b33929a3d404abbbb64a3581e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513085, "uuid": "362dad1d-952a-4db3-a863-4f2f7e9c92d6", "comment": "Malware payload (Mirai)", "value": "383dd304eafa2117e49e0dd9faf7825570ad5d7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513085, "uuid": "3bf28ae8-7432-42dd-9e01-5db77be0c8a5", "comment": "Malware payload (Mirai)", "value": "c4c5714eed9e4f900e8fcafb2584e38fcd1d7831cff9aabf78191d16301f15648e5a3dc568406aeb367b40e3c4f49899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513085, "uuid": "d9189324-e265-45b5-a0e8-557d5c3ae367", "value": "T1BD03F175840549B5ABC07234D0F78283BB822B7841FE34EE664D505BB24B0AB87F679B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513085, "uuid": "cb717030-0e11-4e1e-8221-3a13fda26d38", "value": "768:3qidlGiQKVa4N+krEAj/YbBqjwNw5PDbaHaikQ4s+Vrc1G0UTvJFaZldUYKWs3U2:3qUlbV7+kr7slYm07b5rs+cGddF8nUYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513085, "uuid": "3d680105-14a7-4f1c-a8bd-909d1477d3e0", "value": 38852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513085, "uuid": "49b8af6c-1419-45c2-a1e6-14595b0b018b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513085, "uuid": "8a64b326-73e5-4ef0-9cd4-295ad067801e", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc5f65a-60b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501158, "uuid": "f6c2ec44-2756-4510-81d4-d52c21871b78", "comment": "Malware payload", "value": "7f06b73f5c0655e26f5d1e2aed6a479f", "object_relation": "md5", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501158, "uuid": "82860d2c-39f4-4cdc-811e-af3524258bfb", "comment": "Malware payload", "value": "9556fb4270f7e669aeca2b23734c009f55535494abe5297d8111a839cc3720a9", "object_relation": "sha256", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501158, "uuid": "6cd1db41-a1d1-46c8-9404-23fee2c3ceac", "comment": "Malware payload", "value": "64ad1a29ed6c2ccec6d3328d02db4c693a9a2743", "object_relation": "sha1", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501158, "uuid": "1b35fe0d-7875-4eb0-a645-e5b2f39b7e5c", "comment": "Malware payload", "value": "5a553dd1dbb0d80f3ef26cf29e65c2ccadfdb779305a7440d55f52a7361ed9a1f8e99baf3fc699b8bc7c830f8c8cfff6", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501158, "uuid": "f6445885-5634-4f0c-bb76-8728f06b0aa9", "value": "T1A40533D464BA68375A46F3715F2A84C478B8B7FD940F69AFB494A80A5CC3B0A034FD53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501158, "uuid": "890dccd3-f8f3-44f0-85fc-b15511213a73", "value": "24576:G6OGrUot7RegJBwVFrjEvFhI+0zQ8pqWB0:RH1RVJBwjAF++P8/B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501158, "uuid": "48484ea2-8289-47a3-938c-a4dbe521e565", "value": 873973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501158, "uuid": "277819ff-2275-4a36-ad52-8f949eadca1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501158, "uuid": "41dd826c-c748-4944-a50a-a10afc8c8a8c", "value": "rdp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37c0702-6074-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752471532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471532, "uuid": "c85b9788-0c85-4e8d-8be9-fcb02a7c0cb3", "comment": "Malware payload", "value": "a0e8b1f486bd1109c3aa4b0abb830875", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471532, "uuid": "5fa685f4-1dbb-4c58-a746-380207f30eaa", "comment": "Malware payload", "value": "955d47fc8d4d49ef4c95ea94cb945e8d60584c3cdcb96bd3f940eb636dd8abe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471532, "uuid": "c48e97f7-3593-44bf-b730-a25d05e383fd", "comment": "Malware payload", "value": "223a5a0f40ea53c29631d56c8491f8fefa748be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471532, "uuid": "c786abde-0778-4e70-9f4b-c306bbbae327", "comment": "Malware payload", "value": "eda0bc52b16c63882ce9eecf7dd08fa873ef77e40e5a1220e6ab6675a60e2e97d92e1228ff78effe8441d87813f67f53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471532, "uuid": "7dab0a0a-6750-4f28-a182-4e72c676a2af", "value": "T12BE401037308A756DF4BA83A82CBFD31B7C2799153D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471532, "uuid": "7ee2898c-3b9d-410c-8f89-b77a6f66e2e0", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471532, "uuid": "f6273cc8-6442-4aca-a290-0e8ebc69df4a", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471532, "uuid": "0147625d-a410-4409-8024-3d06bbc7c29f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471532, "uuid": "2d3a35c4-9fb2-4ff0-ac79-c4ba5738f770", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c9101d-604b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ConnectWise)", "timestamp": 1752453841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453841, "uuid": "a745d3a1-b711-4e49-b96d-5653869f9e36", "comment": "Malware payload (ConnectWise)", "value": "dbe6c8ef2a3b93c58bf4e5aa9d91dad2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "davidlowa-com", "colour": "#10AE56", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453841, "uuid": "cae4b227-ee0c-42d8-ab04-6a74d538e5f6", "comment": "Malware payload (ConnectWise)", "value": "9595038f9e790da7228972188d71e2c0b2346b0acf5eb1f5d654f7904da2a91f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "davidlowa-com", "colour": "#10AE56", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453841, "uuid": "40ddeaee-3f26-4fab-978b-3505e5c39dac", "comment": "Malware payload (ConnectWise)", "value": "75550286fdbc95ba5d5b9ee975d8d4d125fd786e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "davidlowa-com", "colour": "#10AE56", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752453841, "uuid": "bae158d1-12b4-4567-aab0-0a7760918b9a", "comment": "Malware payload (ConnectWise)", "value": "cd3076b437e4689b5e180db480aaca2a9c568b4a263f6d093a48665417b67d41c02a2b9bf41f76f6a85b3227e59d6fdf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "davidlowa-com", "colour": "#10AE56", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453841, "uuid": "2c511e79-8d39-42d6-b04d-49aee08f66e7", "value": "T1D5063372A8556F46C0B874B8247CB1E7C0EF00A557636DC3AE4B6E726CCFE4492E616C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453841, "uuid": "8d882b13-fc7c-488c-8d61-33aa595c868a", "value": "98304:fWEW/OFRTloM/DgBwkLGN3PsaPwek+my3UZh:fWEkQgC0GdPsu5mSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752453841, "uuid": "88230b37-2f97-4e01-933a-c700a8dad5c1", "value": 3994788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752453841, "uuid": "a82c9266-8e9a-46a3-a37a-ad93134c5ad2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752453841, "uuid": "c7fbbc86-f37f-4d1a-a45b-65f4b8d10963", "value": "Connect.ClientSetup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fb1bea-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485176, "uuid": "0ce64960-1f9a-4c12-8c27-8754e9802832", "comment": "Malware payload (Mirai)", "value": "6b71427ac9c44fb474917fe29315b1f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485176, "uuid": "dbf44728-8b19-4640-afc9-a906d9fc1f48", "comment": "Malware payload (Mirai)", "value": "95de61a6e2c17ef47871d6a7fd0cc62d92d6860f89478ef3c5fc4bc12e086b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485176, "uuid": "b3b2b5a0-8f5b-4d46-b3d3-37eafd12b0db", "comment": "Malware payload (Mirai)", "value": "921adb3616cb8f7e93df6230322c450f1640a2e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485176, "uuid": "c9f406b4-0dd6-452e-89ae-b4219114e058", "comment": "Malware payload (Mirai)", "value": "07ce2b6806b24b0ad13f131b5140071008199a1cbed95e8abab07c7889fc174d7f46eb7d2f61b10a6be498655d9c2c96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485176, "uuid": "aaa47ca3-7fee-47ab-a3f6-18706a5a3d12", "value": "T1CDE32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485176, "uuid": "584e68d0-988c-47bc-9bf4-a7ac677a2253", "value": "3072:FYvMxqixyDJAmUzdBJXu9WRtotmLFQTihvJX0clM/9h4b/kP:yvMxqixyDJAmUzUSotmLFui3X0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485176, "uuid": "97cbe540-a894-4028-b58c-7a6f25bc0b62", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485176, "uuid": "4c147d7a-1cc8-4d6a-97d1-6d224eb57627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485176, "uuid": "4aaa40f1-75b0-45c1-b9c4-ee5a7d84c020", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ced8c6-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485072, "uuid": "b8b7b94d-6544-4062-87db-c29020fc37b8", "comment": "Malware payload (Mirai)", "value": "544a0dea0710ff9389c8dcc772dc3242", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485072, "uuid": "35667958-90a7-49f3-a0da-7a16ad598468", "comment": "Malware payload (Mirai)", "value": "95e906e8b38087d9c06ac0a988920b47770ff172bbb00eec7955c214e3fe9d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485072, "uuid": "64f92ecb-2af6-4307-8bba-747a2b1f94c4", "comment": "Malware payload (Mirai)", "value": "e528013b4952adcf65be74bf3efebe12bbf840b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485072, "uuid": "d7549ad1-7c15-4993-9a4d-63149f598218", "comment": "Malware payload (Mirai)", "value": "4a799ebcf0b264e1cc816f1611b26154b5b710c27bfcc0099b43702ff9f17ab882248b193f56e55583cffca4b2c706b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485072, "uuid": "867614e1-1002-440c-9da8-c356d2f6c443", "value": "T1CCB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485072, "uuid": "e2849d20-1d31-4c56-8af8-0110f59f1191", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1p/LWy:c9sSyzz36YaWWgg1pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485072, "uuid": "9575e6d8-2b98-4551-8136-2d81d869f779", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485072, "uuid": "fd4d1127-ed96-4260-a373-b6afc075b33b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485072, "uuid": "ddbf30fe-d13e-480c-89fa-7989a6ec5832", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e96850-6046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752451835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451835, "uuid": "f7697d9b-7039-4053-a914-c152b267b8ba", "comment": "Malware payload (Mirai)", "value": "8f5dcbc47bbc4d7422d93b952226c724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451835, "uuid": "d7897e25-6409-4c05-980b-0a0d37398344", "comment": "Malware payload (Mirai)", "value": "9625630eec4290b35d9aac090d76d7aecd27bc1424de7bcc215f8630e151c8cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451835, "uuid": "622e3cbd-7838-49cd-9e55-5df1613c02a3", "comment": "Malware payload (Mirai)", "value": "a0555eabeb8223f5639dd11ddff72712dd9012ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451835, "uuid": "e04a0a38-64cf-4bc7-8f25-eb4d7d8d3f4e", "comment": "Malware payload (Mirai)", "value": "be652f5a66bdc9c2800bd6845761d4c457ae0e475e2ec1697e79b293b8e5ae01976db39101ab2002c02ee3c0acf03d64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451835, "uuid": "1ad5d4de-f197-408e-9faa-af3268897c1e", "value": "T101C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451835, "uuid": "5c153eba-865b-49ac-81cd-e4129fe01223", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoSrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuISrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451835, "uuid": "1b323d08-f0c0-467a-8307-d30b303bb0f2", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451835, "uuid": "207178f0-0c53-47f9-8145-c46d583df8c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451835, "uuid": "fd08779d-79c8-4ee5-b294-420173051052", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded18a38-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496892, "uuid": "fb5edd5c-ad85-4512-bb0a-fb55b9c8620e", "comment": "Malware payload (Mirai)", "value": "b4774dc8533e3b7dfa3e7615a67b2b83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496892, "uuid": "4cf1f0d7-2a00-48ba-a8ce-77856e9827ca", "comment": "Malware payload (Mirai)", "value": "9630f49ef79df8e85a158ba6b1dde21e7dc06373476e830f30bd35458323e250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496892, "uuid": "99970776-ee28-49fe-9e9b-9a839dc1b1c5", "comment": "Malware payload (Mirai)", "value": "02db144027d688169de2461a4c22a7e4c7de6318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496892, "uuid": "558c594a-45d1-4dfe-937b-be16c381214f", "comment": "Malware payload (Mirai)", "value": "86a7cd6fbf9b4f915472c0d6cee36f3bbd5183e64ed4fd72513e9e3f817964a43cea60ac1753ee10cc3870408e41954c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496892, "uuid": "b25a84d2-0e43-4fd6-b0b6-1bba96864f61", "value": "T131638D76D419AC94C4844338D4F28B792BA3B80883771DB6AED585BA4047EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496892, "uuid": "272864d4-6ea4-439a-ac7c-9cc1d5e5f4a6", "value": "1536:2a53jIp+aFCZZl7wtkjeYUVawK/NMPZIGZ/j72CLK:2gUcaEZZl7EgeI8/j72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496892, "uuid": "900e6cfd-d750-480a-8b46-de60d8c37108", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496892, "uuid": "3f59483e-6bec-456b-a159-e6dff51a2b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496892, "uuid": "a87d6f83-c39e-4856-8065-2ed910f74248", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ab710c-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517177, "uuid": "1f6d881c-c561-47ab-8ee2-ebd6c43150ec", "comment": "Malware payload", "value": "318fb1155f83517468a462b3715f2fbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517177, "uuid": "c4b4f754-4520-4e7b-9311-12f92545b9ff", "comment": "Malware payload", "value": "964ccf6b4101340d23a31796bb3cfd168c35398c3ca60a43a253c6354da07892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517177, "uuid": "7f4e9167-03ba-4da5-b8d1-d0a07257c01a", "comment": "Malware payload", "value": "84c51376b5361751aa826d73b9000246f6c35ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517177, "uuid": "b23aa6cd-9ea5-4059-9d5f-23da70469fed", "comment": "Malware payload", "value": "5467893dde28d11a81860667362c5be4dc432f1f547b78c298b56ede380cd048f850998e278efbcc5871aa526adaf32d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517177, "uuid": "03202b04-5fcb-4939-9b10-4ca4442de18e", "value": "T15BA40294E9819B62C2C801BBFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517177, "uuid": "4d6a9e33-74d8-46fb-8a44-44c563fe3743", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517177, "uuid": "754ece3f-2d26-4a9a-abcc-42d027e054f4", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517177, "uuid": "50f3f50f-f1e3-4137-8e36-17a8ae4a4c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517177, "uuid": "90470974-da03-45b3-b10d-6cceae1fd19c", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e00aa4-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752492283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492283, "uuid": "c0b1951b-65cb-40de-a570-ae8b213d6233", "comment": "Malware payload", "value": "6b5cb7299c1d21c9ac75675269d22073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492283, "uuid": "7d605141-8046-4984-9afa-c81bb15c5dfe", "comment": "Malware payload", "value": "9662eba55681124d75883a5d368cefa32f6c2b381e6a091d7b792880f5176b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492283, "uuid": "136da4cd-c487-4e4f-b90d-b6e051284b6c", "comment": "Malware payload", "value": "64b7259c98bad68011e3c80821b4b9a14124f5e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492283, "uuid": "e1473c60-5e8d-44c4-8496-6382c854dd86", "comment": "Malware payload", "value": "3a6078f4ffb483d3a1f4393a1c26f7cf09021f21c548113fde7ae2a027c473b46701e92947ee7a89d3f1cfff7fea6392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492283, "uuid": "855e5a38-6f96-4950-9dbe-a43c444a9679", "value": "T187C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492283, "uuid": "be67c100-a524-4093-849a-2969a2a22899", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zY:W7v+mrY2xzf03yvZ/YI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492283, "uuid": "236bb15c-1142-4de9-8add-20c93cefd58d", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492283, "uuid": "0ae96306-aca8-414f-b447-e3f75f31a7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492283, "uuid": "7f6685f3-0a2f-4ae4-941b-2ac7c2c54901", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c89ad4f-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513934, "uuid": "6c817087-14d0-48a5-90e7-33e5a0e8d40c", "comment": "Malware payload (Mirai)", "value": "b47f9874aecbbac175a3e4de5ab7d263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513934, "uuid": "79d52b64-f207-43b5-bab4-0d614f86ba2a", "comment": "Malware payload (Mirai)", "value": "966ff0899613a6779ce33736e1d5924e0ee095772722485c15737c06bd40840f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513934, "uuid": "1c69eb5b-9a37-4601-9925-9fafd898c746", "comment": "Malware payload (Mirai)", "value": "c5255ec42f652e0a44e962854f9321dc273b9d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513934, "uuid": "1a850716-a0ff-419d-8855-59918ef47fcf", "comment": "Malware payload (Mirai)", "value": "0958158a316da80ddbb6c2d980bc90c18970ad4b263e9d96e9621113b4a2660f530288eb30793788bfabb88832bc2a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513934, "uuid": "321d5632-bf7f-40a7-bee8-aedb280479d3", "value": "T1F5F2F16193CD6310E61CB075A0EE3F1D6037E16A4259686AFBC85877FA74FF8B818742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513934, "uuid": "bfc347cc-a163-46cc-9e0d-668016867325", "value": "768:QA3hfqgRpq/QsSr6L/sYKXNJDgPeUeVU1aL5nbcuyD7UHQRjF:RRfa/em/Ydxg7MQ05nouy8Hy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513934, "uuid": "474c6766-1552-4cfe-8359-8a5439a21046", "value": 36908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513934, "uuid": "0dafa283-9c05-4802-b68a-d605b8410f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513934, "uuid": "e66610d2-88de-4d5a-8b0a-293dee898091", "value": "top1miku.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863e385f-6108-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752534968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534968, "uuid": "b2692522-9ba5-4f1c-8b56-ab58c0fcfe27", "comment": "Malware payload", "value": "ae699097f7d953345cb9d72902f2720c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534968, "uuid": "8ca1d0eb-1c3b-4d75-a939-5d6d0a261068", "comment": "Malware payload", "value": "9741aa792ee7d39770169e257d35bf820f798294d439aa2ec2b4c038a60ba1a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534968, "uuid": "12ac61bd-cbee-4ba7-9f73-7af22a66f8fb", "comment": "Malware payload", "value": "4a6cd646a973315be0192b194ff639ad5a8e69b6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752534968, "uuid": "4e1b51c7-07b6-4725-9c99-06bafce32ee0", "comment": "Malware payload", "value": "bffb6a18ac57c54725c8638bc6f2426d302ff70c87e140c8e5e4be2dd66607e609420e84361dcd0ec8a2a01ee817661c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534968, "uuid": "658f8c6a-b201-4322-9a07-2497cc2093fb", "value": "T1F7F0DA9E41102C53643A6D4BB7018F1CD283C2F7CFAEC65BF66E4C284B9E70CB225989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534968, "uuid": "20b3514e-5f2c-46f1-9543-4278a7c22653", "value": "12:wwQfNQzkXwsQFwQk1NQk5HXw9aqkyFwQ6NI5NQ6uGXwhUKJFwQH2NQ4KupXwU6zM:CNPw1GNhwNkNI5NDwhnUNNKEw/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752534968, "uuid": "dfccd0a8-2ec4-4b12-ac99-71ec1c343362", "value": 536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752534968, "uuid": "053cbb03-39c0-4120-b594-372930e41f6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752534968, "uuid": "85e84168-3d71-45e3-837a-54142ff77847", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cbe9b6-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485069, "uuid": "67b3cbe3-0f89-4b5d-80b4-b55f40d39e33", "comment": "Malware payload (Mirai)", "value": "90c305bdb91cf28587a2d859f6de5c29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485069, "uuid": "afc8fd49-0aca-407a-8aaf-3f759f961b73", "comment": "Malware payload (Mirai)", "value": "97560c6aa64d47d1dc9ce0b1f0d7acc9f864507e4c8238249caa544c70f3f2df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485069, "uuid": "a80d8659-0e5b-4586-9fc9-91af26b1f407", "comment": "Malware payload (Mirai)", "value": "8155efbab7cf09a3794c4c6e3c0e9ea7dc931ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485069, "uuid": "1824be49-1a9e-41f9-ab74-405666e55aca", "comment": "Malware payload (Mirai)", "value": "1aaf3f32af108ec0cae8b7d540748f931c5b7e07054a0a3dedc1594add875b8f6943af839b2988ae5001681882951c2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485069, "uuid": "c6f0170f-50b6-499b-87c6-a7c879f3ff2c", "value": "T135734B21F9391927C0D5A17A21F74B23B5F643CE20A8861F3E710F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485069, "uuid": "2e594195-198e-45cb-b652-dd3cdc39f34c", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTWfT:7PQbrL7SYOBR2WfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485069, "uuid": "8bf57cc6-0f65-44d6-b915-d8ecb7612905", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485069, "uuid": "f5850e99-71e5-4584-9424-9e713c6947ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485069, "uuid": "0c3b4977-8db4-4dbc-be2e-868407d12aa4", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989f1de3-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494626, "uuid": "f6ad92a0-a1a6-43c1-a749-d21c346080d0", "comment": "Malware payload (Mirai)", "value": "b69b399f20e8e88fe18b6def806f34d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494626, "uuid": "1a12d11d-d43e-40ad-b7a0-9c19d021ed34", "comment": "Malware payload (Mirai)", "value": "97d798b98ecf3e74e511c6f46872f116ff67380df9be5c4cd16dee9ffb88a8c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494626, "uuid": "e0f6ff25-b495-4ff2-a603-ec98352a6b08", "comment": "Malware payload (Mirai)", "value": "b3c87b6c45556fea21284fe2fb9aabec1aa03602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494626, "uuid": "cb652d08-8ca6-44ad-b1a9-309d33c75dc1", "comment": "Malware payload (Mirai)", "value": "403d4c786c00117ee2756a4d726fe8aff5defa4f6afdac0d4770f1894110a3a8835d4e977b3c0465c0354c9008494ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494626, "uuid": "5a0ed4fb-4b30-40aa-bcf5-a73457044417", "value": "T1E8E2F1116917857EEB308471E0F6858777691FBCB9FEB0B25462024DDCC298253E2ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494626, "uuid": "123b0d54-f24c-463c-b82c-e7a06c364877", "value": "768:rEKkUgXAnURCr6HmDFStmYtu1x69q3UELdi:nkEn7uHEem91xvL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494626, "uuid": "dd07ae3b-2643-4866-baff-3a38726f379a", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494626, "uuid": "7c94df63-eb59-419b-be10-9e8fbd198bb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494626, "uuid": "255840c8-4d88-46ea-98d6-2d1997c147bf", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a39ca8-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485179, "uuid": "33059be7-9c7e-4786-82ca-9e34e4608f89", "comment": "Malware payload (Mirai)", "value": "33345fd4c4dfbb2df6cf142af770c316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485179, "uuid": "496a0b0c-2e59-4ae1-b4d9-7532721d13d6", "comment": "Malware payload (Mirai)", "value": "97e4566594199c5339d56a8d84a9315c2043f2118113212862593cd90af20021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485179, "uuid": "0da4e234-5098-4149-9487-0263e17a8055", "comment": "Malware payload (Mirai)", "value": "75cd981dd8be1ccc8f85b3997f93d280bc92ab50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485179, "uuid": "014ae966-cb67-43a0-83fd-a61a1dd9e408", "comment": "Malware payload (Mirai)", "value": "fa7547a53e949514f73a1f55f72a685997186492faf5530eb13507fceae712c96b96b0afea108ba55f70de637bdbdddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485179, "uuid": "874be240-5f33-4cbf-9461-b592ddd7f5eb", "value": "T19C93D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485179, "uuid": "24f79e9b-715e-474c-ae6f-e6b6199ea3aa", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqfhK:NFjXYyCEx0KhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485179, "uuid": "4c21e9ac-07b9-42fb-8a61-003257d69a63", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485179, "uuid": "5da96a75-e14c-4a80-9faf-ca1cb1831289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485179, "uuid": "dcdcb96d-9bd5-415d-9921-7682a5d0bc8d", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8acfe2-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485080, "uuid": "a402b54f-c4fc-4920-90d9-c7f2e6d7ba29", "comment": "Malware payload (Mirai)", "value": "a62a284bab9f14db5b570865e39748f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485080, "uuid": "1d25ac49-df88-4c5a-9eb7-8d236b8d0ab8", "comment": "Malware payload (Mirai)", "value": "983f98878a7fc34936b2fc95401ae17ffd1b51487679aff2b6e9f4749d7ef5b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485080, "uuid": "c6515492-68ba-479e-8e5f-2cda7ed2c372", "comment": "Malware payload (Mirai)", "value": "5b24e49c129afd37765a2fc7ca7b82c197c0e557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485080, "uuid": "96ed07f4-fe66-4944-a696-042f46a585c1", "comment": "Malware payload (Mirai)", "value": "d7281061e9e4440ee5218c291fbcf87552268e71494949f99810b309e80943e0272aa9c8df1e6cd5d14fed7891c0971d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485080, "uuid": "469812c9-636b-431a-9cfe-9ac293a3b4d3", "value": "T14AF2F1B181348B18E37C43FE45AE7D0D2C49E868AD04E0F5DF847D628615F54BEB1BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485080, "uuid": "e76b4c3a-5748-4361-8280-e3dd02f699bd", "value": "768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfLwjJnbcuyD7UHQRj+/:E4B1E+TcAYC9owui1Jnouy8Hy6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485080, "uuid": "77486f9d-00bd-4280-b7aa-ce8f8cbbd7e8", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485080, "uuid": "50cceb49-2e2f-4bee-8251-c266f0583be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485080, "uuid": "b285526f-906b-4010-9223-310d552179c2", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83294d6a-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752477840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477840, "uuid": "30386dd2-55fb-4fa7-9abc-5bf67f1b13e7", "comment": "Malware payload (Formbook)", "value": "d387e34833a6c3b7dbe061b88a76fdd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477840, "uuid": "fc4afa4e-699d-4f5e-ab2d-beb06be8668f", "comment": "Malware payload (Formbook)", "value": "987b501b64945e01776085a5fbe2fc05559750956e37cd12121d752e6b6d33df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477840, "uuid": "8aa77e25-6964-4a09-9268-380f39ed2eb9", "comment": "Malware payload (Formbook)", "value": "d826becb0d41a5523cb3fc0134fb9d2daf30533d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477840, "uuid": "c710c519-ce23-4588-82ca-5a7718c72648", "comment": "Malware payload (Formbook)", "value": "ff01d32b9cad7941bfb3aee8bc148160f43c2553a0baf8c111045a2564d360feabbc8968f4f878f40e91654cac75706c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477840, "uuid": "08d972d5-41a5-4f52-be3b-c31970126bb4", "value": "T14F45D02273DD8360C3725273BA257701BEBB782506F5F96B2FD8093DE920162525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477840, "uuid": "b4f9482c-dda2-4444-8d9b-89ed06b5414f", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477840, "uuid": "c189bd4a-b555-4214-9a0b-8bdaed2203a8", "value": "24576:ftb20pkaCqT5TBWgNQ7al/RwxeeaUVrYbeA76A:cVg5tQ7alSn1rqey5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477840, "uuid": "292471e8-f61e-45c8-be99-d7153ab9e14a", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477840, "uuid": "9621afc8-32bf-4ec0-ad4e-e66272a940df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477840, "uuid": "925422d4-3884-484b-b4ee-90206d8f9abc", "value": "img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493ed86a-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752518116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518116, "uuid": "b524ac19-20c8-4664-8051-64cf3b20c8c6", "comment": "Malware payload", "value": "712bc9a3c607b8b2d77a615bae2d3f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518116, "uuid": "b9c04eb3-e1ba-424e-a15a-95efeddf1f4f", "comment": "Malware payload", "value": "98d6190ce8aad222f2cd47567311c02a5d6f2adde0da145372851b03de441ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518116, "uuid": "e0c57539-6f3b-4427-a367-ef05f139045c", "comment": "Malware payload", "value": "31b8c82aa774d8f6614dd5a33bcdff9d2a36f56b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518116, "uuid": "e5f80ab8-16ef-40a9-a4fe-d8e91d7f6773", "comment": "Malware payload", "value": "ce50ae51d93c979749cec71ff80e8de81349a5e8d43b9cac0ed86c88c6a6c8cb30b5958c2f6697e33bf799a7a740ee9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518116, "uuid": "91f10ab8-a955-44f4-9ad6-b771a6eb4416", "value": "T18C159D4662F451E8C877E03891AAB21BFAB0347417144AC723F455587FF63E4BBBA362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518116, "uuid": "6f772634-e43d-4d65-ae5b-c377fb4d72c8", "value": "9a3c3f11aff0b97435f0372e2ac2ed88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518116, "uuid": "6e1729df-0909-4966-8370-3739523d8a5e", "value": "24576:wbWeUBlipNL7vRznMyW+nVq3R72tM6MLiFs7opt3eh39c3CnUL:lfBcdelkuR7n39c3Cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518116, "uuid": "ce401ff7-fa37-4f20-81f6-8ba63b0137d6", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518116, "uuid": "e95132a4-31c7-48e0-b421-0eecca1739bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518116, "uuid": "e506544f-add5-4bd2-94fb-23c28257dbbd", "value": "d.ggOlympustoRecoilMacro (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338c37fe-6078-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752472982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472982, "uuid": "77f7166c-604c-4fa6-937c-1e2b10f44f84", "comment": "Malware payload", "value": "9aa993e5642bcb20f962fabadbbbc771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472982, "uuid": "6115d43c-8bd6-4a55-9a62-9d633be49d4d", "comment": "Malware payload", "value": "98fad136d0c54ebc0fa3080784eaaf56707261709076c3cc23be223b36775636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472982, "uuid": "1434fbd6-e59e-4a56-9d6c-8a9457bdf231", "comment": "Malware payload", "value": "b2da7979eb4c67a693bf20ac0697df46e4d39aa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472982, "uuid": "abed49cb-ed40-4859-aae3-970ad9a662e2", "comment": "Malware payload", "value": "6706931fecc0961f9c04544069a78e4f82f8b467e72d1a9ffdd4e5c7a17e1534a50bc8416881a3a3923d30cb3c1fe791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472982, "uuid": "6ad152a2-de99-4c81-8202-0ecdb2121ae5", "value": "T1E2E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472982, "uuid": "427cb7f1-0692-446c-8e60-cc394c0d6e45", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472982, "uuid": "e479b1c0-a69c-40f4-b2ee-90038ed43f3e", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472982, "uuid": "cfa1e06b-41c3-4a4f-bb0d-4ecbf6429388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472982, "uuid": "5bc44f24-7049-44bc-959a-71de38fba584", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1621a5dc-6109-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752535210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535210, "uuid": "e6493e07-d227-4cdc-a294-4bf36c97414e", "comment": "Malware payload", "value": "f5cba15a697198f6bd7071742e898103", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535210, "uuid": "b682074b-4741-4d80-b882-08424ddad800", "comment": "Malware payload", "value": "9935f0b2d2eb492252ef523222201b2cb3ad5dd7a73c34d1d952909f7da66d46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535210, "uuid": "94cb61cb-86d0-433c-ab24-29cb9c3a00f9", "comment": "Malware payload", "value": "185d32cef77324ccdf4d41e765ef0d159b8f7e9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535210, "uuid": "4a04d0bb-c9c5-41e9-90b9-de9c7d37b17d", "comment": "Malware payload", "value": "ff8c9ddf2dea40e93d14144729e943a0bd15b37d72d177c010e3cee77da8712f7555676db98cdf88413ae193163ecc01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535210, "uuid": "1f2d30b9-acdf-4fa7-9f51-c3a2fd20ad73", "value": "T1774146BAB4628E3033ACC5F875856548A34786AF492B5EB4F083B83C37BC35470B47A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535210, "uuid": "97e9497f-6486-4f03-ac01-f56d73b9dda0", "value": "48:vkwvpihneZZn1oBlyeLnltonmzEvJGU6ljiPq2MTCki:vkwYheZZK6eD2mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535210, "uuid": "afe13aef-0578-4087-864c-b0af5b058e84", "value": 2279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535210, "uuid": "c68ed415-172a-4ad6-9389-cb297fb585ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535210, "uuid": "e0a41f2e-8581-4569-a57c-83b2b0fcba8a", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfddb34-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480002, "uuid": "bf6ca652-f0dc-43fa-bedb-a135959f7c82", "comment": "Malware payload (Mirai)", "value": "4a9fcd1f92f0b27b0d18b274dc209a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480002, "uuid": "6cde7560-9e07-40d4-8ebc-70531f619e63", "comment": "Malware payload (Mirai)", "value": "999e268bd1d7691875aaead94114dcec9d9fff165d63b28de4b094639383435b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480002, "uuid": "8c8579cd-a282-4a15-86b8-d32cc0d5589c", "comment": "Malware payload (Mirai)", "value": "626985ce82d51da7a4fcf5184615331f8c97bbfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480002, "uuid": "ac9cde62-242d-4ecf-b68c-496ace411107", "comment": "Malware payload (Mirai)", "value": "62900b1bb106d49494dcfdf411c4abe11e6d69bfe1abc947054e48d9f3fc962dc7b424baeb55360410e52c5a7820282f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480002, "uuid": "37721889-11ff-4800-b6f8-5b7b575d8220", "value": "T1D813F1D5EE6E2CD6DE3CAE7402A551EE47A971C4231F67C9231318A0B81096FDC98A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480002, "uuid": "58518be3-2595-4b5d-8490-73954f63ad10", "value": "768:f3yMykhUEc3tMhaKvqpF2hD277T2RD5lYKWzVUSmEXkWRs52dYYFips4gkW2:Py/kqwBvqQD3qKaTmE0We4YYFippp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480002, "uuid": "3cff8f1f-53a5-4aba-81fc-e5124493baf8", "value": 42672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480002, "uuid": "718d4cb8-c437-454d-ab98-4deccc627b87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480002, "uuid": "26981628-2802-4db3-8f7f-5f77a5ba6eea", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5057919-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503667, "uuid": "380cd13d-4bc9-4bc2-a507-55251c37e573", "comment": "Malware payload (Gafgyt)", "value": "b29368d83c5a52c2c73cd16f23398487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503667, "uuid": "6b665a09-396a-4250-9b91-6af3792078b5", "comment": "Malware payload (Gafgyt)", "value": "99e9faa2e373b5a13dccdb9eb9fae896a2b4716e8333edac99e179f12b14e44c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503667, "uuid": "e6aa6107-9d93-4ec2-9c54-3d0eb1e7f30e", "comment": "Malware payload (Gafgyt)", "value": "d187871d53c994295f144637e0a443de6dda8877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503667, "uuid": "7a74af97-caf3-4b35-b794-b4d4ad0d7a88", "comment": "Malware payload (Gafgyt)", "value": "4049c3e7a8f9da8801a3ac2eb32b0bbfb1ea43381e4838bb4ca9233a66501bb3a988b8714889643f0169ac3b51d9bad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503667, "uuid": "d7933f72-e38c-4a2f-9a2d-4151d28fe253", "value": "T111930892B901DFB6F40ED77A04D34724B670FBA24E531A72731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503667, "uuid": "cf64ea37-37d3-43ef-a885-c890b7a12da2", "value": "1536:4wZVhxpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gid2f7vTmQ9VqXjewf2Le:R3p09W6KTG/IB6Yy367YfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503667, "uuid": "78c40857-7c82-4c6a-8b15-8fb35461564b", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503667, "uuid": "bc22ea55-e120-455d-b3a3-a1d503baa32c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503667, "uuid": "e8e5209f-17e9-4a06-b82e-61816dbd11a0", "value": "i-5.8-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d408611d-60b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501169, "uuid": "7f6a70b9-03e2-4340-81ac-0c18f5ccc851", "comment": "Malware payload", "value": "f3a737d19f44d06718fa94e0b2bf270a", "object_relation": "md5", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501169, "uuid": "50c81ded-7a01-4695-b0ae-eb895dec5b6b", "comment": "Malware payload", "value": "99ff3751c276a5ded906089a3f89fcab5372a728602d2ce636fa78e0f95062ba", "object_relation": "sha256", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501169, "uuid": "2503a171-15b2-44b9-b4f6-6fae8dcaadb0", "comment": "Malware payload", "value": "861a2620039ef0170c6af53d247ceb5ef4794d55", "object_relation": "sha1", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501169, "uuid": "cc0cc313-ba29-4037-b0c9-2f447f5376e4", "comment": "Malware payload", "value": "4fe0aa7ffad33a7a9c8a1761590121f64c1beb1639958db585087dd773949aa91a9eb16fbed9ae329b1d550f9c591fec", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--laurenxss", "colour": "#4E4DDA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501169, "uuid": "ebb16d4d-a6bd-4ad5-b4c4-8fa602c53790", "value": "T1B4A4234940FECB8AFE02240E411473CD6A5B95B7919AF0DF62D21DF12BBC2E65C617B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501169, "uuid": "fba8bc33-34a2-4ea3-b6bf-07a63fba8a9f", "value": "12288:qkdjNkUo82YR4idxHpbhZV3X0LBj7HxWfLQsY:qaeB8dawHplZTjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501169, "uuid": "e19f52e1-f63a-4616-b0f0-59291c15f1fa", "value": 481227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501169, "uuid": "a70393d7-facd-43a9-8632-7c6f9cf84e59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501169, "uuid": "0505d140-f600-42f4-91a7-df3a01346254", "value": "dfn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6380b26-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516580, "uuid": "2f9f247e-19dd-40c2-9244-96b69cf423e5", "comment": "Malware payload (Mirai)", "value": "69965a37592c156eaa799278828fd246", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516580, "uuid": "f42c77d3-a454-425e-983d-5f1ee3e6b7e9", "comment": "Malware payload (Mirai)", "value": "9a4747fb4ca166cf3ba048b21b377a4a0748d0b0d388a3f183f9b9d14a69c00a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516580, "uuid": "58eb16bf-36e4-4a0e-8571-a904740e8d33", "comment": "Malware payload (Mirai)", "value": "cc9d499978e6c4c4b2db02dadaada2b3fdb0a2c9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516580, "uuid": "68d17eef-d276-4318-93f7-e336eec2fbd7", "comment": "Malware payload (Mirai)", "value": "d8acbb880d7f6407cc23d590e4d3e2743081f666c715757f53068c3339aea775d9f1086b671038c1c9c97df82c35489e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516580, "uuid": "af2a0c7a-4de8-4acd-9dd8-3a1338af178f", "value": "T14671B5CB11E71CB3BDE29A2BB67A684870E26A9F50C99F149CCCBCE6105DD09F091753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516580, "uuid": "ecf9709f-b79f-46d4-b8cb-e79cb64879a0", "value": "24:DXbjsMXbY0Xblx2c4+XbRo9YXb4txsLXbZ0XGXb0hhMXbqqEGXbQr9hUDXb79xX4:HDjL42i9A3LkhU3Q3UHZV+kTzzjybCoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516580, "uuid": "64b5cc6d-5ad5-478b-b735-ddf05e30870a", "value": 3621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516580, "uuid": "e35b4932-6846-45a8-bccf-d23bc1eae2b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516580, "uuid": "7b5d9fa8-376e-428f-818f-a97ce2c8b623", "value": "painbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d5c4e4-607c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752474967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474967, "uuid": "cfc31b50-6f5c-41c7-b3ea-2fa0061db20a", "comment": "Malware payload (NetSupport)", "value": "d56857c54584aa6759163c5aae538ffb", "object_relation": "md5", "Tag": [ { "name": "5-181-159-202", "colour": "#C98393", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474967, "uuid": "30c61f8e-3b4a-47f0-85c0-df413629bdf8", "comment": "Malware payload (NetSupport)", "value": "9a94656a73ac9fb73026c9cfcf48228b011fc2ba93c29cb2ba9000f7b65f5dc8", "object_relation": "sha256", "Tag": [ { "name": "5-181-159-202", "colour": "#C98393", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474967, "uuid": "00d9bede-d2a4-4734-976a-1271f198d2bf", "comment": "Malware payload (NetSupport)", "value": "51ce3fa202740c5154fb16257e1ff0df8a05dc45", "object_relation": "sha1", "Tag": [ { "name": "5-181-159-202", "colour": "#C98393", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474967, "uuid": "1a60d884-5b5f-4ad7-ae95-9a68ac207240", "comment": "Malware payload (NetSupport)", "value": "d3dad993f9cc32e9a7825f046c1dd83f17537ac9422050c08124a2ae4d21542b015f9f0efdb18db10d793736f81239d2", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-159-202", "colour": "#C98393", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474967, "uuid": "f2dec9ae-336a-45c3-92d9-da9b993340c5", "value": "T1256633DDF90D4FF7C799B52EF6857627942B100C035D901FEAA2149CD284CA88BB3A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474967, "uuid": "df5d4056-71e3-4a1a-a7fa-bdbf08bb2f2b", "value": "196608:Ur6GPDBYCVsp3wDJ7BGDJ7EDDJ7luDJ72s:Ur6e6CVspwOWOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474967, "uuid": "28b152f1-e214-46a9-bcc0-9ce17424622c", "value": 7098586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474967, "uuid": "8dabfc4f-e4a5-4250-a016-db913bd3613b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474967, "uuid": "96c49242-3652-49ea-a6dd-d5c6bee2fcf9", "value": "9a94656a73ac9fb73026c9cfcf48228b011fc2ba93c29cb2ba9000f7b65f5dc8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e352064-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528486, "uuid": "8e617a8a-2b05-48d1-8e8f-ec0e763034d1", "comment": "Malware payload (Mirai)", "value": "a15fe5c597b23d6ba014937b44923f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528486, "uuid": "d280a6e3-c0a5-428f-8f34-2501faa4ed2a", "comment": "Malware payload (Mirai)", "value": "9a99bb58923bf250ed66ea0e852008f6004bcfb183f67e70fe9b299e4ec4ed1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528486, "uuid": "7a017d23-7f9c-4d21-85a2-fd523112f7b7", "comment": "Malware payload (Mirai)", "value": "25dd1b7d752a1f27973ebee6130b4fc3acec5b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528486, "uuid": "66505a50-42a4-4edf-959f-764eac5309c3", "comment": "Malware payload (Mirai)", "value": "d868a8fd44eb6ddbab14da3289d78602b6b8018262110959fd601964c009221f096657533430b1e8583e837097900622", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528486, "uuid": "2290b36d-482f-41a9-8931-ac0c5b1f5a07", "value": "T1BFF2E174C1994FD2EDED9EF426E193D5FAEC0E4F1722CCD370428F519B02419858AAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528486, "uuid": "fc3793d6-7794-450b-8990-c8855df05dab", "value": "768:seDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2BZfIN4uVcqgw09x:sCRocD0Lu/PWUWr/iu8g4u+qgw09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528486, "uuid": "d149d661-acaf-466e-9ac6-ab97aa0f8a36", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528486, "uuid": "fb4b99db-fc0d-49a4-ae4c-3db89e49f969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528486, "uuid": "d003c1c2-45ef-4162-8235-5ac9e4c90121", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bfa8ab-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505136, "uuid": "f7712f5e-2797-4ed8-8edb-1db23fc781bc", "comment": "Malware payload", "value": "71283f8b4812b3ddbc8adce8a9552b10", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505136, "uuid": "e3f3f16a-d7f6-4201-90af-11f5dd93e6c9", "comment": "Malware payload", "value": "9ad769b44e5eb8e813cfaf1b8962d195b5e6c2140234178a30a360a859776ec1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505136, "uuid": "d8cc3879-ced9-4943-9212-5d0da4225b66", "comment": "Malware payload", "value": "2c2f73b63b4bff854b2f10269ec64ff87f50b30b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505136, "uuid": "43442d64-cb22-4652-b19d-ffcc7b0c87c1", "comment": "Malware payload", "value": "af12accab9c847ca47b114a06efc39ab074f08aadeb253fc07b3fe8d2d7e8c8f40ec5ea55e1e25238413e4ad178a73e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505136, "uuid": "71012abf-51a5-4bc8-bd86-2b779a4132ba", "value": "T156F028CBA865E8610C528ED2F47A5D04A882D7C50568CF1DB8E2B87F586CA10B2B6F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505136, "uuid": "80d2357e-2656-4110-b25f-2def466a16c5", "value": "12:QvJXOpue8f+AiJKgCWKDbnPZzJ+jsbcddLhFP0LK2a:QvZi4wDIbZ4sbcddhIK2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505136, "uuid": "95541aa0-7ce4-4148-864a-9c49e3c63a26", "value": 618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505136, "uuid": "cb4785bb-1b22-4a4e-9a0a-eb331fffdbad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505136, "uuid": "1a49387c-7c83-474a-9114-53feff9e0ea3", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fb45ee-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481073, "uuid": "ec15d7bd-ece6-476a-8832-89724fd95452", "comment": "Malware payload (Gafgyt)", "value": "979fbdecd1a9736382e408ca5bf891b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481073, "uuid": "11c98388-a3e1-4e56-ada9-31ae002ff5e4", "comment": "Malware payload (Gafgyt)", "value": "9b111ccd2e7391bdcd29f765b00c9c3ede7c6cbc2a6c2c0859292adc9493c0cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481073, "uuid": "4c1275ac-653f-48e6-b515-e84e2bf5c3e4", "comment": "Malware payload (Gafgyt)", "value": "279f008cf1332a867d1c4c94efdf842055cf39c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481073, "uuid": "d06dc77d-a31f-4845-ac58-33673b6fddd6", "comment": "Malware payload (Gafgyt)", "value": "8f01ba1cb7404c3a759a9e16f45229ff531a79e05c79e508914346c333e2376931f4aeb7daca95e3d3718c992b3da960", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481073, "uuid": "0e2dced9-be85-496a-9d92-e4811ca0a689", "value": "T1EEB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481073, "uuid": "a8a2bf67-e401-4e89-8431-10f9d2a5028f", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OVN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreUNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481073, "uuid": "17aeaa14-1d6c-4071-baba-9e1bd5d1064f", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481073, "uuid": "dbb43f43-3987-4da0-9ba6-8c3082ee4a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481073, "uuid": "9eebf389-bba5-4041-b016-74d0c7a998c9", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e95f0df-604c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CobaltStrike)", "timestamp": 1752454210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454210, "uuid": "f3a39a36-e283-45ae-98e1-bf317c9e8750", "comment": "Malware payload (CobaltStrike)", "value": "6cf6b48059d5c559f5f8a657baa3614b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454210, "uuid": "899f9f60-1db7-4a3b-a805-67e0f27979bc", "comment": "Malware payload (CobaltStrike)", "value": "9bdaee1bf391330969550d0d2621fb3e2892d30ab944a59ff26b428be46a8f3b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454210, "uuid": "a6784d72-aff3-400d-a3d5-000cf28cf669", "comment": "Malware payload (CobaltStrike)", "value": "844c282d8b723c901857f40158c20fe3dd03b726", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752454210, "uuid": "ed14ae21-1f23-4b83-b4d4-1f143cf30052", "comment": "Malware payload (CobaltStrike)", "value": "c25ff587e9e0cb9d4d6b6efdba084b4e0ab4a68114c847177096d1689c620253bfd551fd91e762e85681252b5c005477", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454210, "uuid": "6d19c2c8-ba9b-4dfc-a7bc-3327ae3c21f3", "value": "T11D854A0BBCA519F9D0AA9732893661567A71BC050F3263CB3E90B37C2F72BD09A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454210, "uuid": "8a2885dd-e130-47bb-85c6-879df285580c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454210, "uuid": "0e39ca3d-c6b7-4512-a52e-311fa6cf2657", "value": "24576:d/FXC9++OyV+hTZ330Z/jsxOQrTiC8lj07MM28gYqEE:ds9++dVe933+jlj0q8gYqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752454210, "uuid": "67351ee7-48f4-4353-87ff-3b0730de46c9", "value": 1858048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752454210, "uuid": "e220fbee-061b-4e6f-b130-52865d803e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752454210, "uuid": "ca79c639-8ade-47e3-b736-ca7e71947354", "value": "6cf6b48059d5c559f5f8a657baa3614b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa84dad-60fd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1752530260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752530260, "uuid": "576adb79-b43c-4ebd-a25f-ddb8b8fb22c7", "comment": "Malware payload (GuLoader)", "value": "a63045ca63c6c702f8fdaf8a1f46cb03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752530260, "uuid": "92ac1f40-c144-457f-8e8d-3d2179242ee4", "comment": "Malware payload (GuLoader)", "value": "9bfa0a2702511b88a7eedce012aba76ea43e686cd81dc6bd09fb76bb9d7fd6aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752530260, "uuid": "e57d3afc-e4cb-4ccd-8764-57e900a4bc94", "comment": "Malware payload (GuLoader)", "value": "b7fbd10eb8e17df9a6c7ad53942398ef2f56db9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752530260, "uuid": "1eab84d4-4399-4d2c-9dc3-2384a142be18", "comment": "Malware payload (GuLoader)", "value": "764dd0cb99b4da8ce0a9792dafc6646d5b3c5a76e4b4fe5ea5051018b13701906cc37532e24985b1d1a25a4d33f77eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752530260, "uuid": "d95b2a01-3d30-4bf7-b4f4-a7290d2caf40", "value": "T179552332B3354146C47EADBDBC82A2F92E7D9EB48954709B2398F50E1EF3284847974D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752530260, "uuid": "8050799c-e860-4b74-a4c9-1c75087807d8", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752530260, "uuid": "497a93e8-1c47-42c5-982c-06ae3a1516cf", "value": "24576:0G67M0Aoh9mmLjjZjvPZSJvbGGVsD4mfh8dznvVI794vH63uTJeN/guP:PrpoimXNDkFsD4mfqafulC/XP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752530260, "uuid": "1fe38359-e8b5-483a-b61c-0ec84e6116e4", "value": 1376460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752530260, "uuid": "cae1a342-e3f4-4cef-89cb-dd1099499fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752530260, "uuid": "ec25b239-c1be-4e4f-baf2-ea3b3aab7777", "value": "Arrival--Notice.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2e9bde-60e9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ConnectWise)", "timestamp": 1752521666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521666, "uuid": "2491b88e-caef-4010-b282-1dccc37b7948", "comment": "Malware payload (ConnectWise)", "value": "c47140190b5e1e15655eb2716104e460", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-nnnnnalm22", "colour": "#8ADB19", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521666, "uuid": "3e2b687a-1f9e-47d0-9dce-5e9fe114c422", "comment": "Malware payload (ConnectWise)", "value": "9c2cf2747e9ed2309d00d44c7c080e48c13c710c22aed9c68814392fa06861d2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-nnnnnalm22", "colour": "#8ADB19", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521666, "uuid": "4808a413-a591-46f4-86da-f9fa2e8fe33a", "comment": "Malware payload (ConnectWise)", "value": "acc889372f8b886a95ded00c049c497b6042e21c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-nnnnnalm22", "colour": "#8ADB19", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521666, "uuid": "3f332c5a-117b-48e9-b94f-1cce472e549d", "comment": "Malware payload (ConnectWise)", "value": "1815900455b7478f86181a7a754a092c91a2088b5f12c0b98672ba36f99459b30b961d367bded154940d12b7eb2ec9f7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-nnnnnalm22", "colour": "#8ADB19", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521666, "uuid": "174dfda9-cfc3-4c43-a508-ed9fc66419a6", "value": "T1A546E001B3D695B9C1BB0638D87992699774BC009316C7BF53D4BEB96D32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521666, "uuid": "3e5e1326-834e-47c9-be9e-bdd4a39b02c0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521666, "uuid": "429e5bf1-9621-47a9-bc35-66e5915bfb9d", "value": "98304:TGs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+l:SfefPMjb2w6L4Rr0AP0yANlDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752521666, "uuid": "d8be3f6b-aa11-47d0-973d-7bacabfbfb4a", "value": 5883136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752521666, "uuid": "63c808a3-c7fb-44cf-96d2-9ddc57e0dd5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521666, "uuid": "11026824-3683-4b6b-a2fc-116335e05ce9", "value": "Voicemessage589324.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e9bace-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528519, "uuid": "e07ea345-1021-4660-8f61-e3c13ecbfe4d", "comment": "Malware payload (Mirai)", "value": "f2f2a0eb4f4261a539aaf90417c1dd6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528519, "uuid": "71157447-a0c1-45b6-844a-bda08d5e7754", "comment": "Malware payload (Mirai)", "value": "9d4e72345e3324b6793081c69c3df6242b3d139c38c6cca4cd2b557a151b4094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528519, "uuid": "aee792e9-a144-4b10-a649-ad6118c2c0f3", "comment": "Malware payload (Mirai)", "value": "487d71fbadb7fab38c70a33108a85733355c06a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528519, "uuid": "9f6b0439-4afc-43cc-9dd1-653d434889eb", "comment": "Malware payload (Mirai)", "value": "b5321ac72f09f12d810aecad37d22cb73844db5f89a13f3982125ecce684bcbd456ee4f16c1bae0667c39f4b9c9203e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528519, "uuid": "265a725d-5e32-4721-8586-e539e52706b4", "value": "T18E733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528519, "uuid": "ae7a85ef-eebb-476a-9421-88ff3a413724", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNx:OZWLnJpcO72RDRZNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528519, "uuid": "adef2061-425b-4226-8e55-7b925fbffac8", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528519, "uuid": "7b751d8e-1a0a-4f4a-af3b-96acfc8a862e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528519, "uuid": "e60b049c-c463-45ae-8c96-f9ba71aad207", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5e2de0-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504404, "uuid": "5ead857b-fb3f-40ee-bf78-6cd0c7617f8e", "comment": "Malware payload (Mirai)", "value": "e7ea291520f809d351590d444e5a4cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504404, "uuid": "82081b6d-1cb9-4ae3-8663-b8c43a73bb66", "comment": "Malware payload (Mirai)", "value": "9d5863348f4b5d2f877151d365bc192a1ff4df74c330b5c7afea2034ce6eb053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504404, "uuid": "b1d05975-c8c5-4631-a032-faa618d7fbfe", "comment": "Malware payload (Mirai)", "value": "f1f8003ebe8e80df57cd6c273a59d34da072e735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504404, "uuid": "e146647a-a5ac-4ab0-8f54-e93bd3862833", "comment": "Malware payload (Mirai)", "value": "611767110fa36cdf10c76f4646158ba264518a1496d355fb19ae365caea284fe32073bd476185e5ab7f9afb7e5623370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504404, "uuid": "27e11a55-5d56-4193-b8b9-4d1d84c56cda", "value": "T13AE34C01B70D0A03E2636EF03B3B27E1D3DFAA9125F8E644251FBA8991B5D321586DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504404, "uuid": "675fc957-5670-4ee1-973d-824732c29299", "value": "1536:O2PCynFIobH+kxExeSHV0Pceis5FV2nKlktaozMpgvAgYiR9adkPKhdqS6NiYMah:OkIx3xjcssEnKytaRlg/iYrmjTgggh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504404, "uuid": "0a434abc-dcab-4238-852e-0ebb496cc02f", "value": 147604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504404, "uuid": "06047560-93e6-4145-a51f-241f574d6a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504404, "uuid": "fdc17041-6c45-4d52-b66a-1cd47599a7f8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d0eb29-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752491857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491857, "uuid": "31b98d01-b962-43b3-97c6-b24e962387de", "comment": "Malware payload (Mirai)", "value": "fad22d46919c5ecb266c09d707a2cba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491857, "uuid": "43335643-8d8f-46ae-ba0b-f40297bf3939", "comment": "Malware payload (Mirai)", "value": "9de87e56a2d7c6b0004c5f954363483e04b21147978e7373854526d8e39fc1ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491857, "uuid": "0a3cffa2-5af0-41e6-b3a0-c357962fd5bd", "comment": "Malware payload (Mirai)", "value": "4a0afea4e13f052b3ba6e2a76faa0e05cce3f008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491857, "uuid": "29cc609f-6132-4984-9ca1-84d19ccc0368", "comment": "Malware payload (Mirai)", "value": "3bc9fa0137ccfcdaa124bef85c76bdac98f5e6daf49e26f967fa7c7639498a1f680d7ec8fc32ce929bc6725b51dd9a6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491857, "uuid": "2758fa4c-2c6c-4a76-a803-1ba8ffac5e7b", "value": "T17904A91D6E238F6EF768873447B79E21A75923D623E1D684E1ACC1101F6029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491857, "uuid": "0ed26332-2588-4e67-8da4-dc042c39bf74", "value": "3072:FI9pSQoBorYkj3FyGezCb5hQzZ4GZKF1fwzQ:FsSrmr1j3izyGZzKrfMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491857, "uuid": "111e169c-af7e-4cbb-a4a0-96fd5e18405b", "value": 178948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491857, "uuid": "acadb12d-67d0-46a9-9c5c-0daef5701c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491857, "uuid": "eb7a09b8-cad6-4a17-be41-d2e7fe6d3826", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0421246-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518369, "uuid": "1c45f5e0-919c-44c7-93dd-92cff668801a", "comment": "Malware payload (Mirai)", "value": "d962cfaf2203d0e538f7b667a9039fc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518369, "uuid": "9ab99753-fe75-476a-8354-741058b40b39", "comment": "Malware payload (Mirai)", "value": "9e09ee05c2d2b1bd77f79b72fa0dc7f2943a26890d4f9a2c900896248afdd4bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518369, "uuid": "e85e19ac-3791-40de-be62-0091b1af13ee", "comment": "Malware payload (Mirai)", "value": "d7974269d0aec71418168aaa26b9adaa85b0e2d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518369, "uuid": "7de8d4b6-ba81-45c1-b1b0-2462350b012d", "comment": "Malware payload (Mirai)", "value": "2ddc81741fab767638457af758757557f4cf2fc7248d74cad849cad511cff42e4fe94b6cd576b85615d8d5bd1ad295c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518369, "uuid": "aaf04142-011d-4928-b878-9ad1f1752ff7", "value": "T1FA032B25B7791A17C0E0527F20EF4F16A8A91FC46590D66F7DB20E2A9EB23011D16FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518369, "uuid": "268e897f-f886-44a4-a1bf-17ba868c497b", "value": "768:5u1knMkUsCUcSMGVzM8L+ru414EuBvExJ8Sr2tCWX0:5u1kMTlSXzM8L+6u4xJgJtatCWX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518369, "uuid": "30f2dffa-bac4-4500-abaf-cea3d1ebc536", "value": 37792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518369, "uuid": "4817319b-0629-493b-b8b8-cd335030e4e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518369, "uuid": "427334eb-25ce-4fff-a364-8ed37a0f3b53", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ba4a5d-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517202, "uuid": "4104e7bc-7f9f-474b-bb1a-a23b3c4a4f9c", "comment": "Malware payload", "value": "375c9028206b2132f79e90ca86f60d17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517202, "uuid": "1c28bf2b-1ba3-4315-8096-e018a6aad2aa", "comment": "Malware payload", "value": "9e364d15fe2c15c612b84f91414a3b0a7939acd69980bb27cdd5f1adffe23936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517202, "uuid": "9fdafc1a-7b4f-4918-b4c5-72ab273e539b", "comment": "Malware payload", "value": "08c6f5178938fb6bc5abad368affa9c180f226a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517202, "uuid": "55b10a2e-ccf6-4c18-b3b1-2961ae9ddd21", "comment": "Malware payload", "value": "855136c3904bd9f8c213d9c919d9e3fae6251c397f36940125e354744c4a47f2897e5787c0c04316f3ebfcbf2ee724e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517202, "uuid": "ad4d915b-4f3a-446f-bbe4-9352610c52b2", "value": "T1F375BE7590D6A0DFFE7995B285A22291F0327523C63C0FFB12E8E3726B17AD11E59318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517202, "uuid": "317c50b3-aab6-4526-814e-46790edf0e1a", "value": "dadf1ffb48205f6697443fb8a59edc6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517202, "uuid": "154311c3-9aaf-4fab-94bf-96c49c8fd280", "value": "49152:aeuJZ9G01OJrFk2eQgA1+Ip+8KA1+Ip+8A:BuPzgrvIoHKoHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517202, "uuid": "7b5e2bc1-c25f-4cd7-adef-8e3eddd181b6", "value": 1575936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517202, "uuid": "f5eaeb7c-d948-45df-bc21-eb1e336ced62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517202, "uuid": "9f37d90a-6b1b-4ceb-9e11-2f991922ff66", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101093ec-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505135, "uuid": "8cbae98d-2851-4466-b713-c06bbdbdb704", "comment": "Malware payload (Mirai)", "value": "4bc1ca5bfa53b71a81529e3717de67fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505135, "uuid": "6c323ed6-2a5a-4a6e-b905-3229c62bae71", "comment": "Malware payload (Mirai)", "value": "9ea29aacd6d5b38501f3ee2c8cfa5e3514a267de6194d5899d4f177f6769458a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505135, "uuid": "701fba9d-c843-460a-af53-b42ff384b279", "comment": "Malware payload (Mirai)", "value": "bec9235e2a7fbf3c5c484a670389a91c5207c779", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505135, "uuid": "a5f0006f-ac2c-4614-890b-98780ce3c26d", "comment": "Malware payload (Mirai)", "value": "35f81f799e8e8e3b2679e267cbb9d6e4e5c32d5a71a0652711792c2f0ad089b694913a4b2e915c0d9449385ce40fac68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505135, "uuid": "cc44ee9c-e432-47a5-a812-f75dcfc0ca49", "value": "T1703108947C51FF725A03DF85F9328E05A843DAC20455CA1565FA607FC8BCE48B836B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505135, "uuid": "a70920d4-7816-41d4-8310-bd83d669726d", "value": "24:QvZi4wDIbZ4s9A0jKXFW7PoKX2g7xiV+aTQKXImHgxhKXw:QvZi4w8aS/jrro2sckgxhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505135, "uuid": "0dee5164-06e6-4c66-8dee-92130bc5b5b3", "value": 1648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505135, "uuid": "043ac428-4a0a-4aaa-afea-9db402019bc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505135, "uuid": "5d590425-2a32-4b24-8104-3e8f746cf2c6", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837c0bc0-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528521, "uuid": "74f18814-8736-4993-acf1-9b144524823e", "comment": "Malware payload (Mirai)", "value": "4812e568a4ffe5b04555a54fb00c6e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528521, "uuid": "08cddba2-3b51-4dec-8f52-fbe3e87968b3", "comment": "Malware payload (Mirai)", "value": "9eb587e93e0831d24f45967cb6c7f3ffd0e34faf639fa3930a0edb1fc2dc0761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528521, "uuid": "5959c9d0-e0ec-4c93-b195-b11f694c14c6", "comment": "Malware payload (Mirai)", "value": "5fcc84c9d78c69d191ddaeba5add06d5ecd938f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528521, "uuid": "60bd56d0-7383-42b5-80b0-5ff5773b7600", "comment": "Malware payload (Mirai)", "value": "72fae4467293ccc59e34e0774a6a3ae3d0b662c2d498ffc94a57964379170628b80f7c69cc2bd03e71318d68a2febb84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528521, "uuid": "1cf1b629-c4e5-425b-b2c3-e1b925aa6e38", "value": "T10A13199AFCC24A3FC1C01379A6AE5A4D3721E3E4D2CB7607CE545B3536C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528521, "uuid": "78a7badd-7f2f-4011-afbc-c752d2125ff5", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwloOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528521, "uuid": "04ac5224-e543-41de-8b2b-24fb9bce87cb", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528521, "uuid": "c81501e5-6bdc-4199-8e49-4dda92bb282d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528521, "uuid": "d043db99-27f5-41f9-93d8-0041df8f64f4", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5ec32c-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752537257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537257, "uuid": "8644f74e-497f-47cb-987a-ef6d94c9026f", "comment": "Malware payload (Mirai)", "value": "bd4571c34961bb516a99455a800b34d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537257, "uuid": "7a4e139f-00be-40be-9be4-258b08c5b84f", "comment": "Malware payload (Mirai)", "value": "9ebcc7596374cacce2c862d2e2c4c6bb76de4ae9379ffabba63660a99e4917ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537257, "uuid": "d1b898c5-522e-42d1-ae9b-25eb4eb1301f", "comment": "Malware payload (Mirai)", "value": "c1b9eea989ccd89487a0db738e5e45f3d642ee91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537257, "uuid": "6dcb4c16-2c6a-4b47-8807-1e230adf42d2", "comment": "Malware payload (Mirai)", "value": "551a1d3dd790cd070f5f852271ccd33c1983962e0c4328f201dcf345613eb39a45acb0ee1ce71f477fcf4b59eb4d7a0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537257, "uuid": "3ae07bc1-766e-478b-95ae-8e5e1bfb282e", "value": "T1B2043A46E7408B13C0D71B77FADB524533239BA5D3A733065928ABF43F47A9A0E22E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537257, "uuid": "1821aa64-6c87-43d5-a218-40b078ce3001", "value": "3072:Rx4NAePW5Oa4dfa6X/KEUC5rz3O29QxapU+WoX+brLzM/9ujxm6uwjgEFmcl:RxcAxKdfa6X/KEUGrzedxQU+T+br3M/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537257, "uuid": "39090e84-5eba-4cb0-ac49-0c1cef60d228", "value": 178020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537257, "uuid": "17bc40eb-d2ac-45f8-8382-215f7df761f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537257, "uuid": "081a7043-7a03-43bf-9439-77011a5d5eb1", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0828b3a2-60b4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752498679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498679, "uuid": "f9ffbf93-ec65-4ec7-a9c2-56fc672cfce7", "comment": "Malware payload (Formbook)", "value": "dc8cbe1cc643cd647b0cd4c982932efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498679, "uuid": "450707eb-76ac-44ac-b977-25326ed398af", "comment": "Malware payload (Formbook)", "value": "9ecaf7df193568c73d0069fcff681ce44e8ce79f17f402df0155e611047035ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498679, "uuid": "acfb0487-364c-4054-b14e-4a4d2bdfca16", "comment": "Malware payload (Formbook)", "value": "db146f02540399436661488831d5ef0a97a0cae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752498679, "uuid": "c0088282-9aae-4e5e-93ac-4a2661599f23", "comment": "Malware payload (Formbook)", "value": "f7d10fe6b2e075deb74860d46fe18fda0ef8b99ad078299aebc44f013cb5b20e8fa0d9d51a32df1051276723c8bc95f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498679, "uuid": "b16de5ba-f8ea-49be-99b3-ba2ebf85fa74", "value": "T1E345D01373DEC364C3B25273BA257701BEBB782506A5F46B2FD8093DE920162525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498679, "uuid": "7b109032-b611-4396-a916-d3889838e7b4", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498679, "uuid": "774a60be-28ec-49e5-95a0-a170ed66e7c7", "value": "24576:Wtb20pkaCqT5TBWgNQ7alrrGBe97pIcMMYDaNKi6A:DVg5tQ7alrCDHMY+Nd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752498679, "uuid": "f8700834-96d9-47f7-94d7-740073bc6ac6", "value": 1219072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752498679, "uuid": "c09e7e13-3134-4d46-a01e-2d603eb98226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752498679, "uuid": "83eefd0b-8a7c-4298-a2bf-73af564773a9", "value": "PROFORMA INVOICE FOR JUNE 235-00987372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f80f6-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485206, "uuid": "63e3a05f-182f-49b1-a4a1-7c4d1da2905e", "comment": "Malware payload (Mirai)", "value": "baef6bde39a41eacf510d3736c9427b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485206, "uuid": "955ab8b4-5b06-422e-a6c1-3f670bdf1a28", "comment": "Malware payload (Mirai)", "value": "9f15f5bc4b6cdf366cc4035635f5b5d63bab12e1112b30d50a9fed73b1d37d5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485206, "uuid": "b663e929-f104-4271-b956-179c4608917f", "comment": "Malware payload (Mirai)", "value": "e959bbf8b5d51568002400e28eb386e811ed521e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485206, "uuid": "35b18ef3-fae8-4951-aa9c-f2fbdf722f71", "comment": "Malware payload (Mirai)", "value": "92df22549193e4302acee3b2a203e3e83db07896dc2b39aa1882773c87938b330d34b4ec379cf362ffce55ed23de1c41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485206, "uuid": "836535dd-e094-4964-a402-4d9606a165d0", "value": "T1B853F891B8426A39C2D1577BEDAF548E3314A7D8D1DA3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485206, "uuid": "d2ccacff-9f77-4c39-964c-f648bc098630", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485206, "uuid": "2a54bdd1-5da0-4050-beaa-87c6848dd042", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485206, "uuid": "c4cc015b-0bbf-4f7e-8b25-e0f4ba6002ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485206, "uuid": "9abc1e47-5f40-4520-acaa-1a53480b0b3d", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ecf245-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513391, "uuid": "1d8cbfee-ee63-4c3c-8c41-869b51163a9e", "comment": "Malware payload (Mirai)", "value": "fc882397c2795ececf1588ff54bc3b3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513391, "uuid": "e54827b3-8977-4e26-8882-00ce75cdba41", "comment": "Malware payload (Mirai)", "value": "9f241256e9cf36966f0383605a16d5e7c6cf7f5f24a8d1c840b8e07445096627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513391, "uuid": "d9abdd3a-efc6-4b02-915e-17e41c4a6fd7", "comment": "Malware payload (Mirai)", "value": "e2582ac9f44320fb10d6c7f1eb59aa0b15df9140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513391, "uuid": "8d03f806-517b-47a1-92fa-36c7d24c7727", "comment": "Malware payload (Mirai)", "value": "4a9440b1ab1621c5fad4feb472f3ce849e30d066f4d1f4cca0e426a0cdf435e5159b99a80d78bacadc4fbf1e96d30c8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513391, "uuid": "8dfea6de-12f7-4f1a-9024-91815c4df4ab", "value": "T1D4F34B46FA408B13C4D61775B6DF420A33239BA493DB33065A28AFF43F8679E0E67915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513391, "uuid": "9baaccd5-9726-4a75-8300-58093b7a98c5", "value": "3072:oTEhq3seeLRTSahzS54jn4jJcRKisLLBgDCiHUM/9OeiGVmA30oj:oTEhq3ApSahzS54j4jJ4uiDCi0M/9jmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513391, "uuid": "e7326ee7-de14-4da2-bd6e-1fc281b0913e", "value": 165592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513391, "uuid": "626c6279-ebec-4e12-b166-54e93b652da2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513391, "uuid": "5bfc099b-6e78-4b21-ad2a-cc4673fe4f04", "value": "top1miku.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a849946-60ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1752523809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752523809, "uuid": "a4be8868-682a-424e-8a52-0ff161435c18", "comment": "Malware payload (RedLineStealer)", "value": "24b91da35c667b2ed1e2a82f5b75e23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752523809, "uuid": "3de1e91f-d97a-4f54-ac06-fb93718e8694", "comment": "Malware payload (RedLineStealer)", "value": "9f4fd964d9e20442c62eadcd25ac89121f2d93d8e7910830b81b9133e0ec38b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752523809, "uuid": "1f7e815b-20ff-4f75-bf74-b55047c8c7bf", "comment": "Malware payload (RedLineStealer)", "value": "c853b894463285ffbc5f2ba8332eaf221e1c98fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752523809, "uuid": "d9a1aae4-165d-4e22-9c1f-bc333ce4fac0", "comment": "Malware payload (RedLineStealer)", "value": "9cfe90b90777bee05ab5fd66186b4e5e8d8c0688501ccef1d1ad2e2a62c5a1efb5f695f65c2a9a59bebc7bb78845704e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752523809, "uuid": "89d8cddf-53ec-4c9d-a11a-aeb9cb4d4ac9", "value": "T18304D698324B697EC96F883DAC700CE0677CAC561246AB079D8FF0E43D3A7919B151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752523809, "uuid": "e4da1e0b-6e0b-46bf-9a2d-89520a4f75d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752523809, "uuid": "202da5de-6566-4194-b709-7f038b88452e", "value": "3072:9VJoSXK0IIw1bGSzmxN6KN42wVjw46j8e8h/:fVOYEzawVjw46j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752523809, "uuid": "05d84a6c-21b4-435d-aaba-c199a3249cd7", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752523809, "uuid": "84445f74-1cf8-4d04-9220-7faf52be7904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752523809, "uuid": "07ce2955-f70d-48d4-8217-a1b1c164c775", "value": "24b91da35c667b2ed1e2a82f5b75e23a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e7068a-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494454, "uuid": "09e24b2d-22f6-40cd-a241-f8d98d4f5f22", "comment": "Malware payload (Mirai)", "value": "220d4cd678365f49c815107198460c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494454, "uuid": "40b7feef-addd-47a5-b5c6-5063ac97921f", "comment": "Malware payload (Mirai)", "value": "9fde8157adab5a0b7b592bb9d56b35cff479e1c0835da4b16c348986bc4dd222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494454, "uuid": "97a3d3ed-f3a7-4ace-803f-a0f04a42a3c2", "comment": "Malware payload (Mirai)", "value": "cd4ce684b48199af91c9b10974b763b3be1ccbf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494454, "uuid": "74c9da66-e27a-470e-9170-ddcb16feb2d2", "comment": "Malware payload (Mirai)", "value": "533a129b59e1658a69bfd838bd31a1b66e9844f61f8d0b38e834a6e124cfed46c46bbbc8ac7288ba8e10f4f15dfbd19a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494454, "uuid": "4086b033-8f99-4105-816a-02ae9403a0f4", "value": "T1A4231C46FCC2892BC6C0133AF66F6A4E3721A3D5E2CF7617DE244761368611F8E66E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494454, "uuid": "823a2a76-970d-4724-8ea7-d23772fc3a67", "value": "768:0PAaxO8hPsq8//7b9nu4dZQ0rzY4BDvESNbOCfoMFMPgf1BNuw08Kmzln:Bpnq8Lb9u4bNYgoavlogf10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494454, "uuid": "cb7b4db7-9c3d-4d3e-8f4c-ac437bb40931", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494454, "uuid": "68c28423-b9b9-4fee-95cf-58ac932b84f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494454, "uuid": "978e34fc-a504-4381-9cde-8cb25f82c99d", "value": "top1miku.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aee372-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494856, "uuid": "7fa96a51-122f-4b3e-b43d-4fd67d109785", "comment": "Malware payload", "value": "32acdaf14d3e278f45cde56167299e39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494856, "uuid": "f5c3a6c8-79af-4d3e-b5a0-7d42891cadf6", "comment": "Malware payload", "value": "9fecef087898aa39bf7e4e9d03733a9d0daf126b9f6610ed6e78691a1b8f2b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494856, "uuid": "1700f606-039b-4b0b-abdb-0a51480c28ec", "comment": "Malware payload", "value": "5af15e7266e954694b5eb07de9752b3182faaed0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494856, "uuid": "2a8f8a72-9dce-4b79-b34c-5ba469107539", "comment": "Malware payload", "value": "380822012933733676a230830f566ba34c4807b2c524fba77de162b72a82f07cf1cfb89cba0034ebd55c0100f2eb04aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494856, "uuid": "5a5b4fb8-6105-4fca-82af-bb6e21a6d029", "value": "T1C1C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494856, "uuid": "fe0cff79-62d3-4c84-9936-9a98b8cd94ee", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494856, "uuid": "40b0d647-8a11-4304-aafd-bf9284326395", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494856, "uuid": "743ba788-4ff5-4134-b214-3391521fa726", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494856, "uuid": "639eb277-d78a-473c-8adb-e17062c76cda", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e73f06e-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504407, "uuid": "f2c69926-9310-4c4c-beba-da33e01a60f1", "comment": "Malware payload (Mirai)", "value": "088db4c3f3feb6a07e8aa6bd44358ae8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504407, "uuid": "fa502002-8c2c-46b6-ac52-02fe28c8c343", "comment": "Malware payload (Mirai)", "value": "a0a73ee1bcdd616747ff61c349588e22aa8077272538f53e2c67ec6a2f59559f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504407, "uuid": "991b33df-40cb-4739-9ffb-25305dab4dc7", "comment": "Malware payload (Mirai)", "value": "daec9fa1103f03ce527e4de15a3490d15405be24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504407, "uuid": "5e98cea2-c10c-46b7-8e34-ce6baada076e", "comment": "Malware payload (Mirai)", "value": "f9a69d405a47adaab19b88c05d7e171c317728dabd5e715e85219e71564c5ef70a970a87a37432afeee0c7ec09e62264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504407, "uuid": "a99873cf-5cca-4785-abf7-920be290d9d2", "value": "T13814961E6E228F7EF67CC73057B74A34975D23DA26E1D684E2ACC1141E2025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504407, "uuid": "8e097f73-6ced-45fe-b9a8-ead1df9721d1", "value": "3072:T056TOP8E6UiDVQr/bCSFFgIEHw6bMcsgm7vniI8p33A:T0YjtyxFg9HzMUm7/ijO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504407, "uuid": "2e1176b0-e450-40ca-adea-e275adf9eaec", "value": 194736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504407, "uuid": "0101629a-957a-42f0-b268-685dde50a68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504407, "uuid": "01b38058-9efb-42fe-a68f-7472c2e01d84", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80222b31-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752477835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477835, "uuid": "2ed351ae-9afb-4dbf-9615-234c62cfcbfe", "comment": "Malware payload (AgentTesla)", "value": "35a40df61d3867c1c180f261bc1f34eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477835, "uuid": "5d7c61e3-4dd7-4984-892b-e4eef5b3a7fd", "comment": "Malware payload (AgentTesla)", "value": "a0dbab52b11faa8a506303a66c984966164d928537aef52f8049eb4fe1e85f5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477835, "uuid": "99c3e5c0-7773-456c-a677-9b2646405e57", "comment": "Malware payload (AgentTesla)", "value": "9ebba7e6ee95826dac50b099888fc9c365bc6b30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477835, "uuid": "f387cb36-7756-41a8-b166-6a8f87cf89e4", "comment": "Malware payload (AgentTesla)", "value": "3865691d8df377a2e9f1b38394dc0e60c5ca0367781106ff5abe58301aecec9c7d524380666be88942e2af7ef71087f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477835, "uuid": "ceafc593-58d6-4c35-a287-6e0a9048b2bf", "value": "T17235BF1273DDC361C3B25273BA267701AEBF782506B5F96B2FD4093DE920162521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477835, "uuid": "2bb54328-03d5-43f5-bdb6-22b259b14785", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477835, "uuid": "f7c1937c-faae-4b96-b25d-65f8a43abdf3", "value": "24576:ptb20pkaCqT5TBWgNQ7aFylkPzHQ5zFJr6A:6Vg5tQ7aFXbHKj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477835, "uuid": "d00001a7-62b9-4219-86c5-a494700f8747", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477835, "uuid": "17ac0d50-cc05-4268-8a69-e1e0ea306299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477835, "uuid": "dcb27985-b3d9-4b63-89bf-aa214c721932", "value": "Facturas_AC0978_AC987578 AC987767757_AC97875675_AC986575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11815e50-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505137, "uuid": "12c29796-ae8b-4d65-adc9-8f0e365fe6e4", "comment": "Malware payload", "value": "2f413cd553a25417d7855f28e0c9f989", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505137, "uuid": "4b0e83c0-2b97-4470-bf2a-781da1e19c38", "comment": "Malware payload", "value": "a125be2c2775c18591b39a9c724de7a35f4a6d50ae70035631fdefa688266da3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505137, "uuid": "10dae6ac-1bbb-4e20-a013-00d45f8968dc", "comment": "Malware payload", "value": "8e83985716ab3da7196156caa633a57c2306ac3a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505137, "uuid": "89873056-5713-4a9d-b2d8-e09626606fe3", "comment": "Malware payload", "value": "d4fa35915e09e97136c50897083a4e8f887aadbf09788d0769883c1ab60fc08039236d0fa29c88fdff79d59a235fe6a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505137, "uuid": "fa3c112b-b57a-4714-91af-743905ac2840", "value": "T160B09277C0E1039CD608FF186AAB62202000F742041841AA7BF0322AC881C3264D1E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505137, "uuid": "93382600-df80-4bbb-8b20-ca90ad19081b", "value": "3:LxAjrId4aKBFSEpUH/94dcVMVHE:LMId47UadcVUHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505137, "uuid": "cf62b14a-386e-470a-b7af-4dc00411e60e", "value": 118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505137, "uuid": "c8dd433b-ae5e-4793-9d3f-bf6851f10980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505137, "uuid": "bee66e00-8b75-4421-aa1f-66624e030647", "value": "shell", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dcd3b4-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752473551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473551, "uuid": "9cfc2946-a6ef-466b-94cf-5a1e6daa711f", "comment": "Malware payload (Formbook)", "value": "8a04cba6c21c1bad05c2bcd229a68786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473551, "uuid": "f50942e0-2451-43c4-940a-d642498ffece", "comment": "Malware payload (Formbook)", "value": "a214920669c94931076ee81332dcfc34519033264ab4a95b94f2ee9299b9c210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473551, "uuid": "c79ab9e4-6386-4b9e-ad19-3ef552740414", "comment": "Malware payload (Formbook)", "value": "527bc2c21ae57d01a23bfd375a79ee753cec33ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473551, "uuid": "71b40217-036f-42c9-8570-c0f42f9b0947", "comment": "Malware payload (Formbook)", "value": "c182e0c2c32a98e4c78f6eced93d21cd834a4af64bfcf4b6ab2319af6f5cb2d00022d9751a35ff0764de16e5f9d0fffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473551, "uuid": "53ba79d5-8fb4-4e83-900f-ebb2e2ad113d", "value": "T1FB45AD1373DD836CC3B25173BA356721AE7B7E2706A0B45B3FD48D3DA920161521A6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473551, "uuid": "c6085c37-dd83-4025-b6c1-5b4033e5d033", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473551, "uuid": "a4becbd5-a1f5-440f-85c5-588ff64083d4", "value": "24576:ytb20pkaCqT5TBWgNQ7aUzZ2xDmO7WBsMI96A:/Vg5tQ7aUzZ2DmegsME5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473551, "uuid": "206c1520-915d-4f59-a96d-7edc22b2ae48", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473551, "uuid": "44c7b1f5-4e9b-4e1a-aff6-0e02fa16ba17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473551, "uuid": "c6886ad3-f175-4674-9d52-667437399ab8", "value": "PO acknowledgement.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e8414b-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514372, "uuid": "b3aa67dc-e9ed-465e-a4c9-ac93fd233fd0", "comment": "Malware payload", "value": "d3c639ff8b55fd286c13390cf820d8ea", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514372, "uuid": "3b24ffdd-2233-434d-85b5-125b59417a1a", "comment": "Malware payload", "value": "a2d1f717b39428fd47b3e2b9c01577e1b0528bbedccbf3749edd3ded4341760d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514372, "uuid": "c4210edb-9ff4-45d6-a10f-9447251a62f8", "comment": "Malware payload", "value": "4f7831ed42d90c79d26a78bd96c10fd9424de7d9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514372, "uuid": "9f89bad9-9697-41c7-a3e9-a85c2b97a9db", "comment": "Malware payload", "value": "a14d92fb7bc1e90021f7ed4d1c2fef1d8bf271b2b04d445eaa7bcefc2d8983beb531aaeb37b5467839508c7bdfef29fa", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514372, "uuid": "d367163b-640c-42a5-96f4-05580462b388", "value": "T1CFC080575250E29C4D478EC7D0D75760C506220517615181F171CB147D00516D289545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514372, "uuid": "096ebe4d-cee5-4e14-8e32-fb5d1047bf9a", "value": "3:VSJJFIf9oM3KbQqPJH0cVEReMzqrF13IetmAcLhzAK5DtRGaVLjNH:s81R3KbQO0c5I48zD5pRGe/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514372, "uuid": "2bace687-cd1f-4a15-a408-72558e8fd486", "value": 157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514372, "uuid": "c54d0aeb-04ed-4801-9ddd-b5e956fe251d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514372, "uuid": "c51a5c3b-19e0-4e14-a986-76b34b63cf6d", "value": "bknpnt-com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6c5018-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485105, "uuid": "90fb5fcc-ea01-42d6-b80d-c2223eb04f53", "comment": "Malware payload (Mirai)", "value": "ba744b77904ff87a5ad542e0b91b599b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485105, "uuid": "fa0c3fdd-6edf-4481-add9-5b5f3c63450d", "comment": "Malware payload (Mirai)", "value": "a2dae896bd264b1c3f66f1bc0d9fe66d79665c5c763124a7790a2019a7606127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485105, "uuid": "207f1c2a-b974-48a6-a2c1-433b6688c2f4", "comment": "Malware payload (Mirai)", "value": "78ca0bc479e4c8b78659ce4c9e6ebe35805928ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485105, "uuid": "90d8209a-2094-48be-ba71-e8cb972a0811", "comment": "Malware payload (Mirai)", "value": "2d1f505808f44161cc25f2a81d1cd8046f39fa362fac1fa3a78ef72b36025d081684bb0359a803d78f0f3167fcb5254d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485105, "uuid": "d67c1dbe-33da-4569-bdb7-80ed034f26c2", "value": "T166538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485105, "uuid": "09b27938-4dbd-43a4-a8bb-331dfe193a9e", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485105, "uuid": "52829639-8389-4de0-9c3e-20bccd49c33d", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485105, "uuid": "93346cda-fda8-4833-8eb9-90fd1df38dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485105, "uuid": "edad7beb-4598-4df0-aac0-71189d0fea19", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b74bec4-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485155, "uuid": "1dd7d228-6c23-438a-aca8-983b163957d8", "comment": "Malware payload (Mirai)", "value": "58432f4404835f6386083bc5aad11261", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485155, "uuid": "1d1959ff-1050-44a4-820f-67e06f833ba0", "comment": "Malware payload (Mirai)", "value": "a2e4aea0f60bc2f12d4170a69350577b97dd22eacaf81720ebad668f1468720e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485155, "uuid": "1530fbf8-02eb-4b25-ade3-c1837b298cf0", "comment": "Malware payload (Mirai)", "value": "820ef37ec3948df2df7493baa23f879a7e6e4a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485155, "uuid": "bb8da7d5-8ea5-4fee-833a-5031c49792e1", "comment": "Malware payload (Mirai)", "value": "5a569f9cb450860fe878ced00ebf900164976064ea7e05b8405d7e24ce4e62bd0f91179b5666509719a660f5d6d9c7f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485155, "uuid": "2d90be5c-8866-45cd-9a06-cea1f5ff0a5f", "value": "T1B5C20A9BE5D5C82FD0C0033AB65A5A2D3312E3D8E1CF2747DA5C5B61325B728EE9DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485155, "uuid": "69049e9a-5ed5-4e28-8e0f-5aaa320c89b9", "value": "384:oatjHrIQJnjh9MCFqAoX6RfAcXiedw50G6V6E0F24haDAaSTU/izgSBxx+3wGoOP:NxUYnjTMCHGWSeC50GM/QU/tSn5GoOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485155, "uuid": "c1d585bd-0575-4aaa-9b62-bb8bab40604e", "value": 25852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485155, "uuid": "96c5ce2a-a7a3-4a49-9b80-2d2c5ad003dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485155, "uuid": "6aacb655-ba48-4cfb-a8c3-e421488bfa1f", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f717f3-60c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752506190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506190, "uuid": "90195984-2bfc-444d-a0d3-0190c88c3a4f", "comment": "Malware payload (Mirai)", "value": "9631ccd4f9dcef28064f3d370fa6d090", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506190, "uuid": "66004b88-bfa5-42ca-9747-47facbfd3ddf", "comment": "Malware payload (Mirai)", "value": "a30504ced0412b0a9ba5c30436b17e289ed80d43040d1fc12db2cf6209bca415", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506190, "uuid": "1e39f6c8-d61c-4070-88be-1585501302f9", "comment": "Malware payload (Mirai)", "value": "4ac906210c2167515fefb3e02e7462c6a76b4d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506190, "uuid": "a7f0846b-039b-4b39-b6d7-9740aad6c103", "comment": "Malware payload (Mirai)", "value": "221947673da529e26454f4e6520c6894aba79ddeb2b949b6156d376633c1346650a4a2266f5f1cb6d86dc2da8ff2178d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506190, "uuid": "16c8488f-07a6-4e8f-83f7-ecfe9925ced7", "value": "T17613F14CE94C3899D87C2D7D50091BBC1B7690D233DF1B1E33268D40B562A5A3AEF435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506190, "uuid": "b541f5ed-78a0-441b-8413-0aecf41ed19a", "value": "768:xOoBksLykSbuIhr+PwnM+VSozYP5uAAMrpH/LjrDnWqlpWLI:xOwktzuOCPwfWPczMrpHfHWq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752506190, "uuid": "37e10b9d-d2e4-4e0b-8e26-8be69df48081", "value": 41780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752506190, "uuid": "7992b447-ae48-4962-9ce0-a226520a37b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506190, "uuid": "81ac12f5-4ad2-4b0b-9e1e-243f0380b50f", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66bdd46-60b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752497656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497656, "uuid": "a8268e20-e1b7-45b2-bd99-139a82d1c6a1", "comment": "Malware payload (Formbook)", "value": "8b1559c9e441e9a6944074cbc450f3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497656, "uuid": "8b52936b-8881-4477-8d5a-c402df361e05", "comment": "Malware payload (Formbook)", "value": "a3721fdc1d4f9179cec068cac23a723fdf2bba91ab354811266d90defbcffc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497656, "uuid": "4d2bed0f-2563-43c5-a3a3-472c9061a7e3", "comment": "Malware payload (Formbook)", "value": "d6dffa591345e3e1fb4806a676f07a31721942d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497656, "uuid": "f3aa1b87-16e4-413a-9289-7ddd3519b639", "comment": "Malware payload (Formbook)", "value": "8b9f490284670f11780fefd6c12bcad3303bd17e0011cde3821df6595043224358fb5950493a207c9943eef1830f7060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497656, "uuid": "d7cce694-0675-49c4-8340-7f81f000dcb2", "value": "T1870501637506F922CCA063B95668E3B9123D5E88E423C38745F9BE7B3D427932DD49C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497656, "uuid": "f6f09d2c-a9bd-4dd6-a030-165c74140152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497656, "uuid": "4d9986ba-34ea-4e5f-add9-d7ae85723127", "value": "12288:l6FAkO9AFtK1fR0OWgzUpIJURj7oYbCr9Qv4QsHmZrCbEixnewakD5Uj3:7kQCtKPhEpIWRj0vrbQa170wamuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752497656, "uuid": "bb469db3-f39a-44fd-9d82-481d9663b82d", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752497656, "uuid": "37c8a32b-d836-47ce-ae1c-fe167d93a46f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497656, "uuid": "7eba20cf-ae03-4e20-bff8-4fdb4f79d3d8", "value": "Elite Shipment pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97ae845-6076-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752472428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472428, "uuid": "5491f308-9f14-4826-b63b-62a8b30cf9a7", "comment": "Malware payload (Mirai)", "value": "274a1a803ac1f7bb45e34d26cb12a1ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472428, "uuid": "508cd8b3-345e-4698-8fed-8c22f6dd16cf", "comment": "Malware payload (Mirai)", "value": "a37a0d384a24979361212a724295339f0a58dd8090e52ba472f3343f29fae144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472428, "uuid": "70c0ba8c-97c2-4513-9156-32c488c70292", "comment": "Malware payload (Mirai)", "value": "90f79381ea08a55cb966334d621fee38ad32a41e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472428, "uuid": "412bed87-1bd4-4f89-94ab-3da04300529b", "comment": "Malware payload (Mirai)", "value": "3d5dead8e39721cfa0b87ffdf4417a2ab1b0847b85c22728dab46006e23189b50b2cf602e001557374cfb26fdd999ea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472428, "uuid": "ad5ec307-f09d-4e6f-8b19-ce85e969f0a6", "value": "T146D34B05B30C0947D2A32EB43A3F67E193EF9AC121E4F640655EEB8991B2D331589DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472428, "uuid": "cea588e6-38a8-4546-9b78-fa034c24d6e0", "value": "1536:3/3R206RprJUOdEsmMFf6Fz+e5XNRxiAqTFuJRFZVjZOS8sVLnvAeOYqB5u2eLqA:kTplTdLuCe9NRxmFyhZOgVcDAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472428, "uuid": "f576abb9-29ed-4f20-ab47-71d5424f9cdb", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472428, "uuid": "4ea804c6-99ea-49fb-81e4-4172de0e7ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472428, "uuid": "8d877995-3359-442a-a10e-a2fb72807bb4", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec79e098-60c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505934, "uuid": "302b0420-2a95-43c2-8377-f385ffd72e1a", "comment": "Malware payload (Mirai)", "value": "09b89a8602549df41bdcfc494bc3da69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505934, "uuid": "7c6a47ab-7e83-4eb8-932f-4447d3e8847e", "comment": "Malware payload (Mirai)", "value": "a5535ff2f24140e4037a963d1c64e39421415d5ed1270afeb133610b85d405eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505934, "uuid": "cdd98c23-8de2-4f37-9d64-2a09788955d2", "comment": "Malware payload (Mirai)", "value": "2df198e49d7a838acb75b31a5c0158dfa4f4608a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505934, "uuid": "a9be337a-b789-4173-be02-2a3ef9915e0d", "comment": "Malware payload (Mirai)", "value": "6782c229f6469db8eecf0c8534ba0f0f7ddbff451d8633cf7af00ef88581c7fd0acd71f38f5a82d573ddee68dbe51b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505934, "uuid": "5f00b18f-d9aa-41fa-b469-7e132eece5a4", "value": "T106A3F846A9819F02D4D631FAFB9F414933136FB8E3EA7102D920AF5427C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505934, "uuid": "763c4997-d583-42cd-b579-198b02d1efa2", "value": "3072:ljTnRPD2sP1n0aTMiK1CNTjjuO3GPSfRBFcG:NTRP3P90aYiK1CNTjKOESfRrcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505934, "uuid": "df98e017-f28b-41ae-881e-a5e1dbd30223", "value": 100740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505934, "uuid": "9e551aa0-43f3-4ba9-aa22-18909bcd6a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505934, "uuid": "005d3fb7-d81c-47a4-b9d3-d2dd5b850618", "value": "larm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a606413-60b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752499783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499783, "uuid": "43df9c70-d140-4982-a4d0-1ecbb841ebbc", "comment": "Malware payload", "value": "2e8a35bd1ce068369605d8f3b34ca73a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499783, "uuid": "6aa326f8-fb91-47ae-b2dc-197bc2f7de6f", "comment": "Malware payload", "value": "a67e43235528b910f09f47a4ded1664f45612d67d2c07503f47b3370d6222471", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499783, "uuid": "d5475201-b511-4963-b4a7-781144d25d65", "comment": "Malware payload", "value": "c15f4c99bcf4b4a81bd61f6fcc95238b2462be81", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752499783, "uuid": "2ce543c9-b700-4410-8287-948c7ce24666", "comment": "Malware payload", "value": "aed16a2229da49f1e7ff39e0a0e4a172284ccf174ea8e0afaafb928810548f377ecc0eb85bfc94498259723a6a65287c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499783, "uuid": "4e987222-7495-45cb-be38-fa68ff309618", "value": "T126B30170D02834ECDD14BA7AB954D3A117BEB543535B856E88CD820B4CFBA4DFB18E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499783, "uuid": "8f86bf69-0216-4e3e-a62b-2866752eb3e7", "value": "3072:7ypzZP9VmUjQ26qplFW/mPr9SrdwYwEWZ2gdupfl:7y79IUjfpPW/madwYwrmfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752499783, "uuid": "8c275081-2d5c-43e7-9692-947a52227a15", "value": 113156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752499783, "uuid": "b10176c2-881d-4930-a9f6-fa8fceeeeaa7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752499783, "uuid": "8a46b148-f09b-4ef3-9216-c9da4869aee5", "value": "aaaaaaa.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fcfa5b-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752537255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537255, "uuid": "749c4e1f-ad78-4e30-ba52-230f6dc2aee6", "comment": "Malware payload (Mirai)", "value": "fe50e8b6fa10c3be5c696250e34dcd28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537255, "uuid": "918305ec-0568-46f1-a4b1-8b12f4a36dde", "comment": "Malware payload (Mirai)", "value": "a699c766879653efe2f16d754201b7e97d6d221aa69863a140f656e8c405c9aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537255, "uuid": "5791bd09-ef54-4fed-8e79-089210853770", "comment": "Malware payload (Mirai)", "value": "3ae24ceac5e99654075d1bc46b4c14c85618d0f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537255, "uuid": "7df69f56-64e9-4709-9ee2-de27de53435c", "comment": "Malware payload (Mirai)", "value": "199ce1b572b72850c52a46d7b8c6a0e586e84bd42089ba2ad3c5ecdc0b570b0503a0f2e3fb4b0ab7a506c17b15977e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537255, "uuid": "e9d4dd92-004e-41d1-b898-f76b11a50dfe", "value": "T1A1B30806EF544EFBD86FDD3306A90B0534CC459716A93B767A74C828FA4A50F0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537255, "uuid": "782a9f4f-a95d-41d1-919d-2630302ac916", "value": "1536:kms8cNzBKVo5m7f29OcejFXXpVNO0w9hDna+2JZQ+apb6/hsMp0WTlm:u994o5m7f2UBjjanB2JSbchbT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537255, "uuid": "5be6804e-8b04-4f3a-8ed7-5d2b1645e832", "value": 113972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537255, "uuid": "c86b3ebf-ff6c-4389-a377-8781b6ecf34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537255, "uuid": "a9ea3e03-066e-412e-aa63-5bd3497e800d", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915dd499-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752517807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517807, "uuid": "af64d5df-eba0-4f57-a8fe-deda67ef40e3", "comment": "Malware payload (Mirai)", "value": "1fbdc411f7538192f755ead41234112a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517807, "uuid": "9eba4162-3336-41a8-873e-bdb1fdee434b", "comment": "Malware payload (Mirai)", "value": "a7596c4df2934f187825cdf85534f626bf94a663273d5217e386f87da245088b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517807, "uuid": "e1cf726a-8bc1-4c95-a675-8fe8d44ec083", "comment": "Malware payload (Mirai)", "value": "62962a426378b13cf3645c10b18215073dbaf189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517807, "uuid": "176fcc2d-13ad-4897-93fd-cc0f0fe384fd", "comment": "Malware payload (Mirai)", "value": "cfcb45a12ff3099501ab68b45a16fcb352d7626d61612d9f46f1d70dcc0891493f5128ceddc605585d88364b2eecde8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517807, "uuid": "f1d71a73-4249-4294-a1f6-34a289d69bdd", "value": "T1AFF2E18329B84109C17F217A08A6FD8D88B095A9D2BC85F34B94B423D917FDC759869F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517807, "uuid": "b9cab308-fa66-4ed3-a557-866b92a61d4d", "value": "768:vCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIpFsht20snbcuyD7UHQRjs:vBGbyqhXrTBrQX4oEwU0snouy8HyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517807, "uuid": "08961000-ca2d-48af-8d43-09cce92abaee", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517807, "uuid": "e5d122ab-9023-48ec-b1ef-869435a75fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517807, "uuid": "166b8e94-e227-4dcd-8094-333427be08e8", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607c2cfe-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496680, "uuid": "4433f3b8-e537-459d-ba73-04bbc62812c1", "comment": "Malware payload (Mirai)", "value": "1071658c25fbd2ba33c0ef47456471ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496680, "uuid": "99e18f3c-21b7-4bae-8d59-bf08a08e8f7b", "comment": "Malware payload (Mirai)", "value": "a7aa20853fccac2e1846ae00b74feb5b44dbf1a92db081b39541d2218ba9c8d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496680, "uuid": "ba4e8054-587a-4411-871e-8fb695fff9f7", "comment": "Malware payload (Mirai)", "value": "0c18f7a06322e8c4c679aaae54be20049647a407", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496680, "uuid": "d50cab85-26f0-48c0-8221-9587e00809a5", "comment": "Malware payload (Mirai)", "value": "7d508719cf285cdb2ad08eb3f4222c09202bd729a696f3add8204411eb0d98ccfc42765ef36ce17398cf22efa7a454c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496680, "uuid": "afffbe3f-cb25-4e38-83f2-2dd3c09508ff", "value": "T1ECC2E0A95228D472A1B44436FEAF01035B36CEF8D6EF312A22144734A097D26E6B5F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496680, "uuid": "ebcdf69c-fb68-484a-a2cc-7b371eea4fee", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plN1ORMrhym+:byNUQUfhQllxlaH0MFjlOnGsnHs3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496680, "uuid": "2315f0a4-651e-4e09-bdd1-c278802786eb", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496680, "uuid": "7351ce2f-fb25-4ed9-b142-009f18386047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496680, "uuid": "b5490d88-253c-4c95-8660-94cff4ee302c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8450fc-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528481, "uuid": "58bb5773-fed0-4403-ad21-fce038ea89d8", "comment": "Malware payload (Mirai)", "value": "050d6c597f722107fef4800530944117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528481, "uuid": "72a8e045-30cd-4d9e-b91f-96cc29429255", "comment": "Malware payload (Mirai)", "value": "a7c83e696af649934bce2e1333687c0b29fbd8f22aedc75c1ca942bdf6098244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528481, "uuid": "257edb13-405b-4739-9a9d-295df47c032f", "comment": "Malware payload (Mirai)", "value": "ffd25316bf55a7c2da517298be675f33eb8a0dd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528481, "uuid": "36e631fc-ba37-4250-821b-b8c905aeb64f", "comment": "Malware payload (Mirai)", "value": "9fe2805c4f71f7557d77e9df414a3c3d2ce80773d68206676b42167aa7c68cb0093f24a58f9839e2f8434dd2d81600dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528481, "uuid": "3287472c-4688-4f5c-a905-3a10f69dc2ed", "value": "T12BF2D0D5D7E88944D76ED17C841FBA0F0594C49C8C04529DCEA97C5A2813F24FABAAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528481, "uuid": "03592a64-2c84-48d2-8177-e609f873a7e7", "value": "768:4W/zEpEYEgHE+Tc6ryeinkUNnERhn+f4o6iu6j/ACGEqijYlonbcuyD7UHQRj0:J4B1E+Tca7UAhqR6yx6onouy8HyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528481, "uuid": "22b8c6af-9172-4a2c-99df-0061c2fa1e9b", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528481, "uuid": "ccc429f5-23d5-4b97-9a8d-f44c8243277c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528481, "uuid": "337c7484-2a5f-4993-a2fd-9c3fc9b75fd4", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d97f87-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479987, "uuid": "2bd03d21-5032-4dce-a712-533f9dfcbf0d", "comment": "Malware payload (Mirai)", "value": "ede4c652c398c187d3402a8445501d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479987, "uuid": "279b0552-8b0f-479c-9723-5f9e8526809f", "comment": "Malware payload (Mirai)", "value": "a851a356311c345001caf70c79a51980d634dc59624d208ac5d2d00b38dcd1f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479987, "uuid": "ac671cd6-d30e-44ae-8460-35270e76ba4d", "comment": "Malware payload (Mirai)", "value": "bc83bcd73ac3bf05cb16bfb714be50780baac5b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479987, "uuid": "daec43de-95e7-4e3a-afb8-58cbd3e3fa1c", "comment": "Malware payload (Mirai)", "value": "d1458338588d231f4650cfbd9596bbbc37ced8607b33e11ba3095bb6557ebcbad0d18668daa8c27c7dc67cc69c8606ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479987, "uuid": "fba4760f-9883-4f55-a775-dcb3cf10b963", "value": "T1ACB3BE97F70714A0C86647F007C75B9E6E233212CE5BE9E7AC1E2A3A59390DF19163C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479987, "uuid": "481c8e17-44db-4934-ae8d-406647368efd", "value": "1536:EaTf9tB/TZLeS/LaaWOzgDQ9VzUlZFdBlCfx8F0FgLDy//LWe:EG9P/Tv/9dskrzUJdBlCxgSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479987, "uuid": "904a5348-da3b-46ab-8a02-e5078536a36c", "value": 116492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479987, "uuid": "5909cbc4-d444-43ff-bd0c-eb723cfe7a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479987, "uuid": "398e874a-f052-41c4-8af2-dc338071ff0f", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9015cc7a-60a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494183, "uuid": "e0b28458-d1d5-4ad8-b174-a6f23ed71bed", "comment": "Malware payload", "value": "9eff3644bb7d4aad65389919fb32872a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494183, "uuid": "d4300e5d-1f7d-4756-97c2-318c98922ca6", "comment": "Malware payload", "value": "a856d5238414e06777c7660b1a39213fa8fa90fabbdc3eaaeb67fe25a0590120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494183, "uuid": "d768390e-2c66-41e4-9dfd-f3db748a143e", "comment": "Malware payload", "value": "e7e08e769679c5d3b8bc1e7405ab019c22c8beca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494183, "uuid": "1dd9db48-437a-47cf-b8a7-3098b37a2f1c", "comment": "Malware payload", "value": "2121ae6df526d772eecf8a39879bc5d388109551f6ef14749e05b5af8294a70e251d4a120af5de7208fdc9815d9ac1a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494183, "uuid": "9b80d114-9875-4bc0-8aa3-0eaf7a1d5106", "value": "T1CBB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CB67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494183, "uuid": "083d895e-63d6-4dfb-8817-a8a8b8978e4f", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494183, "uuid": "242df9e4-c10c-4e2f-9fbd-cf32247a1661", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494183, "uuid": "e15285cf-6c55-4872-92eb-a9b749606442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494183, "uuid": "9c751a73-d6a4-41ea-9b1f-b1be424bacc0", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d42558-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485060, "uuid": "07e18dcd-3056-4d37-9c93-c7f0e8934267", "comment": "Malware payload (Mirai)", "value": "04c9fd20f1ae3bc9dae6235e70289ae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485060, "uuid": "5a10b855-e869-487f-bf4d-e22ed43e867d", "comment": "Malware payload (Mirai)", "value": "a85ffc8aa999ff14d83b460344e22c3a74550fa0742f76c91e0cc9fdb685489e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485060, "uuid": "bef015c0-ccfd-4b8c-8edd-47b797d27444", "comment": "Malware payload (Mirai)", "value": "22761c02ac0fcd3a421328d4d026fcd0a3040e9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485060, "uuid": "cc4a8891-c5bd-4d50-9699-f3d7c5cc9545", "comment": "Malware payload (Mirai)", "value": "0c12bab1eb15d512865f74824a6464b754ed4256b89da3e367c2a922ceaf4d87341400f67ab43bf936b0417a97d46098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485060, "uuid": "f2012926-a53c-49de-92d4-575456478908", "value": "T1C7533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485060, "uuid": "759b84e0-eb2c-4c13-99f9-2707cdc15430", "value": "768:Ge4gpsM204GEkRbjveXHVnQiiQthUv3gFHu1eu48B8vB6J7EzNfXuuJpozNq7P0:Go3EkRbDoSiPMIFu1X48B2SEzNfeuJNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485060, "uuid": "6109bd1c-d609-4a8e-8293-e72b6ba3bd13", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485060, "uuid": "5b16479d-5ea4-4e81-a097-b4e6cb5aa5a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485060, "uuid": "0b79b055-793a-4802-83cf-5adbcf79e2e3", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724707e4-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501864, "uuid": "cb87d05f-8370-4710-bcdf-75d0ef0374d6", "comment": "Malware payload", "value": "ade81b01cc089b2852c73a8467a0ffbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501864, "uuid": "481f2bd3-fed3-4234-84fe-4e4ae4e04180", "comment": "Malware payload", "value": "a8f2fa4828384b043eae6a93742638185641d2e8a3463594d10dc232cc5db9b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501864, "uuid": "b654cb99-9677-46d2-83d9-1111f3d39ea4", "comment": "Malware payload", "value": "2fad4939d6a56aaebd43d7b34c5591f5a95e0544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501864, "uuid": "bb975174-f5b4-4e3b-b67d-916a1b54e057", "comment": "Malware payload", "value": "635eb8092a66f3d8fa04c8de35ef2c68ae50fb26aa12668bee28fff0cdffc2f1e197f537d69b3c447b76e447623e9511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "winipsecNjRat", "colour": "#8C9143", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501864, "uuid": "fa37d0d3-55be-4e0c-ae9a-59d4cd06229c", "value": "T125E4E8437A818B45F3A42A3543EF691853DA95B24BB3A70B2F24337B98011E7FC997C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501864, "uuid": "1a945d16-5e5b-40a9-8f63-b9d6099f4fc7", "value": "6144:BVXyw3csE27mTMBjHGXKOaTf+blehvcgW5ARypk37cKErQG3QPpxU+tjg7KNCyKi:BVXyp27DBjHGc7c1AYzI/5NCjCoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501864, "uuid": "8eeb138e-6958-42d2-9a85-417f5269a879", "value": 678402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501864, "uuid": "fbcbf807-bd75-41e9-a62d-9ca13c41bc1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501864, "uuid": "305b413c-5df7-4c21-9af5-740a0bd27748", "value": "a8f2fa4828384b043eae6a93742638185641d2e8a3463594d10dc232cc5db9b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ab22be-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752485126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485126, "uuid": "34c83717-7e11-4de8-903e-e7c970e96ea0", "comment": "Malware payload (Gafgyt)", "value": "a3e364c258765fc6b3c2e52a479b30da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485126, "uuid": "1a6b36c6-af8a-4fea-81e3-3fa4a43d8fd9", "comment": "Malware payload (Gafgyt)", "value": "aab7c1434440ef68e53cc6da5908ec64f9e55a0b219f8baa6aa5b504151438da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485126, "uuid": "3d473fb7-9203-4c42-ad01-74d8eb3c7bb6", "comment": "Malware payload (Gafgyt)", "value": "db5a26622c03f5d7374978438fe66395e8c846c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485126, "uuid": "9287ca5b-c562-4654-aba9-9205023023c8", "comment": "Malware payload (Gafgyt)", "value": "ed4aa4161c944fb21580a2a23f3636fa70333b81bc9b4729e81a0e0d700f5d423895c09aa2d75a16358e04471f8a93e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485126, "uuid": "c6f012b0-0a4d-4124-8989-11c59d9969c0", "value": "T10973C3197F314EF7D8AFCC3751B84702309C9A4622997BB9ACB4D518FB5A48F06E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485126, "uuid": "829826b2-74b1-4c22-9d46-9aad88f7f864", "value": "1536:tU+xPhZIWiJV7/lbpmFY1uu6LqlMIZAppVF1q0:tzEnFbpme13MI0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485126, "uuid": "e60d49fe-d48f-486d-a3c7-33fdf7cd6cdd", "value": 80204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485126, "uuid": "6bb2db1b-9e25-4649-ace5-7bdfbb20e802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485126, "uuid": "fc5c7659-a759-41a3-9d6b-d9ac689fbc56", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7527052-6045-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752451406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451406, "uuid": "ea50b55a-3240-4908-bbbf-866d3873ccf8", "comment": "Malware payload", "value": "c4f9b8b05b4424758d7e289c76976ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451406, "uuid": "24168c0c-691f-4982-a84d-b0948394a5c3", "comment": "Malware payload", "value": "aac929535af2f4547744ca21cbdf57a7cd350ac76e6fb8a954cad30686525e6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451406, "uuid": "8f575f86-cd3b-434e-80f6-8917ead69951", "comment": "Malware payload", "value": "930ae710413e6e56a325f4664218692d724897a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451406, "uuid": "6dce39db-17f2-45db-b3f3-b60217caea7e", "comment": "Malware payload", "value": "72ef10ea19f61e0f0f0f914e0dc04ad92286f0bd17f82e9119443622f5d5f889cfc7c55f6e020b0c830914b4203a18b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451406, "uuid": "55ecf2ff-76ab-42d1-b9cf-f1571fab2142", "value": "T134C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451406, "uuid": "5602c349-8c0e-49f7-a01e-838eb34ba054", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zn:W7v+mrY2xzf03yvZ/YIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451406, "uuid": "54c44b39-26c4-4aec-8c9d-6564da4a7b95", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451406, "uuid": "6ade525a-a9e7-4b25-a770-f81ad425f5fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451406, "uuid": "4bb3d58e-13dc-40ba-bc36-7ea2db944652", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32b999a-60c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1752506724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506724, "uuid": "84f3bd2b-c0a8-4774-b212-6aec071a6350", "comment": "Malware payload (AurotunStealer)", "value": "1a2acef4058282242f918731ebb2ae6a", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506724, "uuid": "e5084cf6-d70b-4656-b3eb-49fbc3122ce4", "comment": "Malware payload (AurotunStealer)", "value": "ab725f5ab19eec691b66c37c715abd0e9ab44556708094a911b84987d700aa62", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506724, "uuid": "a81758f4-8b79-4a6c-acd7-8f32cbc02f5f", "comment": "Malware payload (AurotunStealer)", "value": "339f49f46f5c35730f89e9d0e193fe351a8b3487", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506724, "uuid": "d826590c-80fb-4017-9bfb-fe54ad0a71fb", "comment": "Malware payload (AurotunStealer)", "value": "7bee2a65ee0d89c3868279998ff28899ff01fcf9a340d943f7ac0890af1456f25c02c8fa693c78824c64d9b068be3ba8", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506724, "uuid": "98c8ff70-362c-4e30-8b54-90463cb5f25a", "value": "T15186E109799755ECE16BD0798396BA1FFA72340907149ADB07E0827C1F77BE05FBA202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506724, "uuid": "d8113a8a-d3da-4bee-85bb-813bfb890b6a", "value": "a26df310ba35bcde22c7ce7f4ab53f44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506724, "uuid": "f0ce9aad-0527-40f2-bf29-8ca3ae5ee3e0", "value": "196608:6uIpA/ZFqKNo7+a6XUxsOT1oCQi0Fv2V:6Ferq+o7V6Xnu1Aiyv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752506724, "uuid": "fa1339df-1135-4719-ac7b-f67da9b8ab74", "value": 8549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752506724, "uuid": "9f0700e2-3461-4e57-a20d-f51ed145648d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506724, "uuid": "5f92624a-8901-472e-8b04-6235522ee9f3", "value": "1a2acef4058282242f918731ebb2ae6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8862fa12-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478278, "uuid": "a67d30dc-ade4-45e9-b144-5df3ef8e2e78", "comment": "Malware payload (Mirai)", "value": "a1fbd73b655122b2690fea975c82f8a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478278, "uuid": "ed8a1c31-d0fb-4f46-906d-4a09ffea3b70", "comment": "Malware payload (Mirai)", "value": "abdd574f0af452e3df4035e4d829c5ac324b5829a9f00411c5a6ee9d8a94fa42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478278, "uuid": "64d81c4b-5381-42fe-898c-9f9096e1d983", "comment": "Malware payload (Mirai)", "value": "f3fd6620044341dca25f8719cbef2c87970c2b80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478278, "uuid": "b632d83d-e24e-4948-999d-507db1b66a77", "comment": "Malware payload (Mirai)", "value": "a56e05ad5d4af078b0945217913948c0af00f8da05585264fe545c1bb6ad297db38001bdcb101d6b91dc4d9fb10f2442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478278, "uuid": "f860ed70-763b-4fc9-b012-31bd57d51386", "value": "T12204A61E6E228F7DF768873547B78E25975833D626E1D680E1ACC2105E6038E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478278, "uuid": "611c7cea-928e-4983-bf35-0b730959565c", "value": "3072:vPriURH2E8uPiz3LmM1GK2+BH6PvaD/8uj7Tu:vjiUR2Epiz3LnLIPq/njvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478278, "uuid": "cd22abf6-ee81-4826-b740-da61c008dbef", "value": 186872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478278, "uuid": "246a0478-7a88-445d-8fa6-c743287eeff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478278, "uuid": "1a63f856-abc3-4e1b-9928-6515c2f50065", "value": "bolubotnetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195ecfc1-607b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752474227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474227, "uuid": "57d9f155-62d5-4e84-b6aa-3011d483673c", "comment": "Malware payload", "value": "e2e2e72319fb3492e2634a568ac3b5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474227, "uuid": "4e0cc09d-c998-4038-9554-dcf43d9fae35", "comment": "Malware payload", "value": "ac0e9da6bf49f4e57ca53f21b754670944480668b76ba62cd4a10dd089ce114b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474227, "uuid": "4857100a-9fc3-4eb9-989b-744946e81367", "comment": "Malware payload", "value": "aace64b94f5980f70cc9a8141f35b9c022040612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474227, "uuid": "0b22a667-5984-4eb6-a8a5-2309e6ef1745", "comment": "Malware payload", "value": "d82674f8a3d7879b2f73a6404d45e365b0b76acd3c8852bc9393b5ec879fecd8bfd56fb248a8ce55ef9a077333b45405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474227, "uuid": "963b22ba-d3fe-48ca-a19d-d4a321b49261", "value": "T1AEA41212E290D8FEC4DAC070429FD27BFD767C544234BC6B6298F7322B3AE601B56A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474227, "uuid": "cd6fe86d-c1e7-48a1-9ad2-d7df96a5afca", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474227, "uuid": "613590d5-6509-47ab-9038-cfaab6896783", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474227, "uuid": "97acfb56-3a4b-4532-b762-9a7b242ec756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474227, "uuid": "c3c70fd4-85f5-43b8-8327-46b2c9b81121", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acac53f3-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503680, "uuid": "317482ab-63f0-4658-ba21-b3b9db32209d", "comment": "Malware payload (Gafgyt)", "value": "384b9fd2467a1a74733d02e59baf6243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503680, "uuid": "0270bf65-85d4-4853-93b2-b3d85aabc6e8", "comment": "Malware payload (Gafgyt)", "value": "ac91a85e026f5ef730e48aa48c85ef5701c052e8eb326309659868696677f9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503680, "uuid": "9c7a5b20-f4fd-4ff5-98f6-393cdb428e65", "comment": "Malware payload (Gafgyt)", "value": "a057db5060dcc4d4631be59ffb2818cb8d0448cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503680, "uuid": "1073743b-70b8-4a60-ade0-e444b945efd0", "comment": "Malware payload (Gafgyt)", "value": "b083c65226dc94ea3e85fb2e2685a3ece9d0f9bc3227b30d5e9848eca5c6085cd149763f614f216430b8c6c7504e74b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503680, "uuid": "3fb7fb9f-0456-4406-9a98-c8bef02af0b3", "value": "T1B2E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503680, "uuid": "d71d7de4-7546-45bf-b5bd-ea9aed3944c7", "value": "3072:fuNaNpF4uVN++dkhnxRQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnTQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503680, "uuid": "4a978c3c-8e2a-4f5b-93d7-4e29fbd44d8b", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503680, "uuid": "4e4d049e-052e-4552-b1b4-612a1854a78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503680, "uuid": "ad0c4743-2487-4675-9355-da91c35f368c", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cba35a-6082-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752477299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477299, "uuid": "ddcc5023-ed41-4b09-9db0-9d94b363f647", "comment": "Malware payload", "value": "3eb14fdc4d26c8c36efee23ce777f0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477299, "uuid": "97899434-100d-4d43-b3c7-7267c1882e2c", "comment": "Malware payload", "value": "ac9273b0b8a81c60ea94a3a0aa29bddd9fc66d08dac9461620ec170bf93be295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477299, "uuid": "4d2ba7bd-d2a4-40ad-852b-bf2a6a65bb84", "comment": "Malware payload", "value": "ab0b29761f3f0dba6cf8a4e03c228315efa9d929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477299, "uuid": "5f22727b-15f1-48f9-a605-91ff9bb0885e", "comment": "Malware payload", "value": "cd50fae00d93e85b9185ae20983d0b2b773930286ca85d8e83fa5cb9a46e9b114745d145bccd3a730ed89cc412d219d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477299, "uuid": "c2cbc692-e3bd-4532-808b-79a33ac81377", "value": "T188956A0BFA9E8095D2AD407881B6A73BCB363C19572826DB35D1DE056FB3AE01F35B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477299, "uuid": "dc9b18d7-621e-4b07-a263-74e9a9cbb171", "value": "398b2b243819e754a4d4e5dae3353536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477299, "uuid": "6f261313-e2e6-4406-91ba-c9c6a6996c74", "value": "24576:JwvnYmvEdceXVzOoASaedmlr9i/W4YYSVEVb6pRkxepz0tWZQ1U7Vg7vLLN86FkM:qXvEJDmlr9iu8SVZNm1U5OCf83r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477299, "uuid": "4ad42978-36a8-4df9-a73d-319661dbdc78", "value": 1996720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477299, "uuid": "89cf68eb-a286-4829-b0ca-c82375016218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477299, "uuid": "edbd0de3-e0c1-4b09-8c1d-3105c676a294", "value": "EXIMBANK HOI SO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc35b21-607c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752474769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474769, "uuid": "9470f3c8-3362-4035-b4cf-17788e4047ee", "comment": "Malware payload", "value": "36bdc0f67aab509971dfbe908d880e09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474769, "uuid": "969b440f-ccc3-4580-a849-50da8956dfb9", "comment": "Malware payload", "value": "ac9f92cb318ab6e8f7af4fd0d17bac0acfe9af1486ef03c6c5c1dfe110456544", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474769, "uuid": "89c57800-fe88-4d15-9443-8ac77c6fc6dc", "comment": "Malware payload", "value": "77479fba608500b77dfd59fb73e57eac548e670e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474769, "uuid": "be1e90ac-8d3b-46a2-98cd-ed8b20c0590a", "comment": "Malware payload", "value": "d35f50efb631b827f211a935b980c4c3099bdf9ffa02cdf9cbc77045de024038c90c35fa29694cbcaabcdb73a5b8d46a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474769, "uuid": "c690a7cc-32de-48c5-a3de-b10d5f5cdfd0", "value": "T1C0B41228EE4E3891F3D1E378DA0A4BB1B05B7DD0C166C1B2BA41E25D95EDEDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474769, "uuid": "8e2da340-bb41-4b2d-860d-45188e5faa03", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474769, "uuid": "054219ef-c5f3-46f7-ab93-68c436b58cbe", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474769, "uuid": "c77d1c4e-71e8-41cb-aa8a-6a11cbd66fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474769, "uuid": "cdd61057-39cc-4777-bd37-04276bd0a485", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdc3193-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Plugx)", "timestamp": 1752517697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517697, "uuid": "e4c3e877-8fec-4fc0-90ed-72793d0969dd", "comment": "Malware payload (Plugx)", "value": "6fa8404a4e4b32697ea39b9afe2024d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517697, "uuid": "057e3fad-53a2-4bb0-9f40-15dbaa5bd396", "comment": "Malware payload (Plugx)", "value": "aca7e809786e068bf306abb8dd0dd4d3325d8f9ffaca42bc6b5e506f681a0522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517697, "uuid": "c8c7b992-8180-4620-9c5a-44a2dc03c8e2", "comment": "Malware payload (Plugx)", "value": "143e6be54376bc3e4d7c5d9cbe3803f6fc8db828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517697, "uuid": "f2f657a7-3a3b-4ade-9a26-6b64a8ae5da1", "comment": "Malware payload (Plugx)", "value": "75a3fff2a5e71e5794abf03e35bc8a152d3b62b7f4fb93bef219b4ef508cd9a48e77fcd468ec59b66c72aaa4639f88dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517697, "uuid": "b9ea238c-2574-4c4a-8882-4dbd01219d96", "value": "T131E75A42A6EB05D0F9F79E7195F652274537BD066F3084CB620C1B2A5F332E08A77B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517697, "uuid": "212e9835-9d7b-4d85-bfb7-72c86ca08b37", "value": "d16b0653830ab3e19afc6486413a4f01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517697, "uuid": "d19dd041-2992-40fc-ac0c-b2a8f53e4b94", "value": "786432:BfcPh4edWXRFwsJHzmrcEgi8P3J5rs3wbEJ:BfcPh4edWXRFwsxGcEgdP7qwbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517697, "uuid": "6bb63cc5-de81-43b3-b083-62a11a92dbb6", "value": 68236249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517697, "uuid": "c608af10-a35d-4472-925e-36aa343983c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517697, "uuid": "2d82f1ec-0378-4833-9f9a-b49329eb1cec", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2280feec-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492281, "uuid": "31d65361-d99e-4319-9a4f-fef61d8fe931", "comment": "Malware payload (Mirai)", "value": "62644091f2958662f07e6bd2020176e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492281, "uuid": "c64b47a8-11e7-4edf-a019-5e543aad8455", "comment": "Malware payload (Mirai)", "value": "acab764c4921e0662fc5222f302c033d3a238c76a4f15b4a7e47a1bc08063b32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492281, "uuid": "c90c306e-9791-48f0-b215-515905c85542", "comment": "Malware payload (Mirai)", "value": "41ff14b491175a4c35b3968c7d2510951764f1f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492281, "uuid": "eda711f5-0aeb-4a58-a81e-fdbf6a7d0999", "comment": "Malware payload (Mirai)", "value": "8d10508335779ddb29ea12ae91ddf7b3d4bf4a17733454a10e0938ad8ee17bbccebb03a228e5da6f286e9c29bfcf0590", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492281, "uuid": "0500092a-be1b-4c20-ad79-dccb18997184", "value": "T154F2E0909E8E6935E280247BEBACEFE157BF09B980E2106591045B78968701D77B8F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492281, "uuid": "dafd933c-e046-4615-85f3-538e902569a4", "value": "768:XPxgexIZSPs1AaY7KpR55aP7XYgyfMRB6j+zPChDtws3Uoz0:XPxgrZSPEATsujXryGBhPoHz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492281, "uuid": "23c0cfe5-30d8-4b28-afac-9ef718f77b5d", "value": 34988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492281, "uuid": "d7b01a83-089f-4f2e-9058-dd826e913c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492281, "uuid": "ae53e22a-658c-4987-906a-8193c1041b81", "value": "top1miku.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72be8f8-6109-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535453, "uuid": "20b1ea0c-67aa-4196-98dc-a1abb796ee44", "comment": "Malware payload (Mirai)", "value": "e0dcd85e0fc4958664b7c68bf5d60c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535453, "uuid": "3b1080ae-facf-4e6a-9749-659e15e1d1a3", "comment": "Malware payload (Mirai)", "value": "acaea1f23c5e23b24add29596b8e627a16ff5ab582dba6307aa858100ac96b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535453, "uuid": "d22c61b7-03a3-4e6e-98b0-6c71f7d542e9", "comment": "Malware payload (Mirai)", "value": "264ae5e023e7ae2f598203be6693cd4044f6d8cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535453, "uuid": "eddbf393-23a2-4a48-a399-1ae11ca885c5", "comment": "Malware payload (Mirai)", "value": "63ba7d1665f33abd50d66cdce1c3382030f7716f12d9b4be6a19d99fa8a1cc89c716a3f5747b960f6294bc5a4c1fa6e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535453, "uuid": "6f045fdb-2e79-4efd-bc71-adab0da2d485", "value": "T17D4319AAF800EC7EF80FD73B8457090AB530E3D506821B3623A779B7AD761950967F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535453, "uuid": "44102dd2-31b8-4804-a9ed-7a14c92b8ac9", "value": "1536:1FNYQYOLrv/883qYwjkvSBVkR738JNIuvrB9Xk:5H3v/dlvMVQ2DB90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535453, "uuid": "fc7535d9-40c8-47d0-b538-d4a1e7c78088", "value": 57612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535453, "uuid": "bbf67406-5eae-44d3-aa99-d81a68abe2ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535453, "uuid": "26a7984b-47d5-4415-92fb-fd8892e26a45", "value": "fsociety.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da62dde-6078-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752473160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473160, "uuid": "55612f24-9b3c-40ba-8a11-a9d40e85e06d", "comment": "Malware payload", "value": "2b2befa9fa01778363dcdc3e54906403", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473160, "uuid": "c78a4136-d748-4a25-b9e4-1ad27cd75e3f", "comment": "Malware payload", "value": "acf6ee1d706dc19037d50cc62112f5306dca9465c7027d8f04e4afea89b342ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473160, "uuid": "bec9a02a-9c84-4e78-b1af-e8ecd3539986", "comment": "Malware payload", "value": "3eb2ae5e132a5617dc5f10a3af9b436e9c812de8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473160, "uuid": "66a6c1c4-8fd0-48d4-9888-2da2397b6b62", "comment": "Malware payload", "value": "6c272200810736064e53e0d6b78278eda63fdd54e02fbae640fe84bce8f9723af2a47cbad88001df40ef2e748c6cbe17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473160, "uuid": "d1927b8f-4a59-40b1-b88b-9f5c23e9104e", "value": "T18FC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473160, "uuid": "e9c3cabb-ab8a-457f-a1f1-2ceba37bb3c9", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7ze:W7v+mrY2xzf03yvZ/YI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473160, "uuid": "29c86990-b61a-43fc-a8d9-3c840d146e50", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473160, "uuid": "58d0a18d-5ff8-4dc6-aa7b-23a0fda98452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473160, "uuid": "d80ed842-8e61-4ef7-ba28-271503e77f30", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e742b40-60a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752492918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492918, "uuid": "d70c2ef3-6bbf-4942-b88a-df63904e59c2", "comment": "Malware payload", "value": "b84d4a0560cc2c75eee59284498ef121", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492918, "uuid": "986fbd94-bcbb-4fd7-a711-80e354b23607", "comment": "Malware payload", "value": "ade46a0d8ff07aa841197e1f2986e62b85ebb3e693d2884a9b641c34b4152437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492918, "uuid": "206cb388-361c-4b59-8f45-5fc94215e473", "comment": "Malware payload", "value": "7c41d261fd1f2f435297414bf07fd497ee9ad3d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492918, "uuid": "c90b3ca0-548b-4cc7-8f26-0f892d086a01", "comment": "Malware payload", "value": "be479e18825dd63b6933485fefc8d711068dcdd7be33f077d7c963e0746967dcd92607dd5677c71d26dcec7817f98c41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492918, "uuid": "a248b8d6-e154-45e7-b647-35cc90f8e39b", "value": "T120E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492918, "uuid": "daf06a64-1648-4254-b230-fe25d2384dc1", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492918, "uuid": "2bde36e7-46ad-4837-a7f5-c13429459fe0", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492918, "uuid": "d0338c77-f1de-479d-a2df-31de024deaae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492918, "uuid": "d04016cf-f85f-425c-bb2c-91b25985d209", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cabbef6-6055-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752458019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458019, "uuid": "4e7c93fc-f3f6-44a3-8495-64023d06a53c", "comment": "Malware payload", "value": "1cad08573ee41c29bf9164df42cb7334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458019, "uuid": "44713eba-2a37-466f-ab21-b7743c472ff2", "comment": "Malware payload", "value": "aed5031839626ee6903b1bf8e23a51ca7111edc2ea68f0060a629162e8dc653a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458019, "uuid": "80e488f7-312b-4ddc-89b3-16cdff08635a", "comment": "Malware payload", "value": "4ac1f87a7e48b441fcf18cffcc2bbb102cd8289d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752458019, "uuid": "755516b4-460d-47d8-ae2e-02dc46c562ac", "comment": "Malware payload", "value": "0cf45581d450815705cb5f4fa15635e277c9312e9e8992502d699819f3d5581c7fe7ea46178af163bee3e0ddf1627d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458019, "uuid": "9c4de3b8-5dc3-4c4b-927f-e7e637210496", "value": "T14667D0A3F4438901DBCB4A75CE926B500D717C19FE69562F3088BE099BF33C136667A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458019, "uuid": "af4da5ec-4e8b-44fb-890f-3396356dbcc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458019, "uuid": "68c7aab6-8622-4850-94cb-25e8a64d8d2e", "value": "786432:fg+Lv5hb0cKKUiL9SEmadwePGLZXMfsEi:j1t0FU04+e+LZXMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752458019, "uuid": "7625e733-0080-4a7a-80e3-944e4a35478a", "value": 32440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752458019, "uuid": "09998b3a-90d0-4345-bde8-68115b71b314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752458019, "uuid": "381ae44f-f960-47d9-8a84-d68c92b5619e", "value": "Halloween Error.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49377a3e-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503942, "uuid": "c6cd794c-bc6b-49ab-8b44-c6027e4ae781", "comment": "Malware payload", "value": "95c414a679e049c9a00f5d6b2e6635d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503942, "uuid": "b7eb99d6-fe93-4765-860f-a7f6c0752a46", "comment": "Malware payload", "value": "aeef546c528add8db731ce595fe64f6ab15347cca4f3b3b045727e4d500feb98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503942, "uuid": "f616315b-064d-4cb6-8759-7bca66807a8a", "comment": "Malware payload", "value": "52336e1b5c055f93898d8ca67bf7b9a0f9c482d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503942, "uuid": "d2bb4ee5-787c-4090-bba7-6d103f76ee63", "comment": "Malware payload", "value": "8b404b0ceaff41a9df756ae930d5e6e8135be3dc7ae76bb4b56182bd76ea59e976ab05d3083bded9054d68018f3aec32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503942, "uuid": "8d5e549c-b373-464b-969d-fdab3cafef4b", "value": "T12443D61AEF514EEBC86FDE3346AD0B4235CC954713B4373A2674CA28F64A54B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503942, "uuid": "ef5e3ea3-be58-4b14-bd38-377f2fa42445", "value": "768:ctHbk7wE41zuauUJA3G1coNTXiuaerEJeXe5DFx/CHBzlxe5drjav3iKRrQoOaZG:6vf4G1cqQ6EJyyD7/Chh0PjHKRrQxHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503942, "uuid": "1518c1fd-9c44-4f60-82fb-4c8a17c8c5d0", "value": 59684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503942, "uuid": "2a7c0a87-7f3d-403d-b4e0-9305faba22bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503942, "uuid": "50114124-f806-4e94-a7d8-f47fe92e38b4", "value": "proxy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fb1e7e-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485086, "uuid": "102149d5-3941-481e-a1be-3e5ba1e7d45c", "comment": "Malware payload (Mirai)", "value": "355af19eda8947f3e8ee3c78fac6ff10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485086, "uuid": "cfeb3810-c6ae-4cb5-b074-a8c926cb3e8d", "comment": "Malware payload (Mirai)", "value": "af35034b6fcd374d373859d3ee34b32c765580615800ac6a5453692f8d959fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485086, "uuid": "6c34e5d0-23b4-4722-94f5-7d08f3d0980f", "comment": "Malware payload (Mirai)", "value": "0bc002f92ec34d57244256027989e8447e0d23b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485086, "uuid": "d9831766-a973-46ce-abce-8fe796aaca33", "comment": "Malware payload (Mirai)", "value": "b3d1e5eb5d8a955e62e8291ad2d4748ea976b4b469d0ec0f2f005121d3b7b02a8bfdca54bc45fbe13260a45e47ddd645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485086, "uuid": "a818af01-7a9e-48d6-adec-10c8d80837d9", "value": "T169B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485086, "uuid": "c2fefcb1-a61c-4f89-bd35-39aa1d462dcb", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDC/LWW:8YSZ3e8ZE3MYlphDgDCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485086, "uuid": "5359aad0-34ea-4c1f-9cf0-62d26b80ed97", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485086, "uuid": "b08efcae-c5e2-48d9-8c86-56413fc91ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485086, "uuid": "566cb613-014e-4e6e-81e0-f44be7a78d92", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6138d987-610b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752536195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536195, "uuid": "531b2dbb-4e5a-493e-8bc8-101e9402a050", "comment": "Malware payload", "value": "6d0208af1cec44e507968629020a50b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536195, "uuid": "656cff52-36cd-4c8a-ab29-629793349cf6", "comment": "Malware payload", "value": "af444df1eb9bfa66264765e5312e293ded5a25b9be80738d5c8b39fdd759fd71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536195, "uuid": "4a116423-a85b-4976-9860-4336aa9e3e1f", "comment": "Malware payload", "value": "2e4ddd35257ef10093723e15eb278a3916b6b93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536195, "uuid": "b96b7529-3332-40cd-919c-53aa6d9b0bb6", "comment": "Malware payload", "value": "d625591294ed7eb0fa481d6003d16ff52072aa10273b6bd0dee57c79b2a579d0222c1aca6bdd98eda576374adc078d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536195, "uuid": "14767c77-c8a7-4513-98b3-63282cbd7057", "value": "T13A6533046FA6AC71D1239FF612FD69B57E71192DDFBA27A26000E7D8EECF46003158A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536195, "uuid": "db6df735-d3ee-43e5-91e5-e6a1b76c54a9", "value": "24576:82nva8V0cFTBtQPbJUax9JIU4SunsEDMK3NQcHeKbxqpasl1HsnJYY1zHtbR:VaC0cFDQzJVeUvusEIUdeaxqp7lZsf17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536195, "uuid": "e1d5161d-a4c3-475f-99cd-6103b634338e", "value": 1514024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536195, "uuid": "71ca6532-e6f4-48f1-8b68-b09313ccfc4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536195, "uuid": "be7d5c54-67cb-47ba-b03f-816828c846e3", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3519d3d3-60da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752515075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515075, "uuid": "7c447a09-da62-455a-904d-4a0ecba6318d", "comment": "Malware payload (Gafgyt)", "value": "695d6cb05336834f924c1b85ed2cc4ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515075, "uuid": "386b6e37-4085-4955-9483-93dbc71f6068", "comment": "Malware payload (Gafgyt)", "value": "af4eca4d83eb65a910d15b050384a943f7180428a8f4f67d1ee10555d4b700b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515075, "uuid": "d25162a6-baa6-4aaf-ab3d-6f8934ad4eb8", "comment": "Malware payload (Gafgyt)", "value": "a1832b36d70e65f11b6642c46bae27e733347d7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515075, "uuid": "0aeae98d-ecc0-49ff-acfa-49728836714a", "comment": "Malware payload (Gafgyt)", "value": "268ef9fd67e33713b96b0653ba3d4c4198467434e3983e2aa70835768b9fee314d47d35542daf4734748a7b99f73d3b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515075, "uuid": "4c873b79-941d-4d36-8dfa-55b6311017c8", "value": "T130244A65BC808601D2D71A7AB90D168D331787BCD7EB7227EDD0AB2027865DB4F3E606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515075, "uuid": "b14ffe88-837c-484f-b6b9-185fa2c04359", "value": "3072:pK8mtJZQBRiuJbdz12Fk3aKdbpIw3aau03tlh/UtZJaEhP0GFUXokytveGTrZ:pk4JEF6a2bpIwx5dlh/UtZsEhsoMGT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515075, "uuid": "8f32833f-a615-450b-a19a-006e53804c01", "value": 220668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515075, "uuid": "d780361f-5c54-4457-a8b5-13ba1e7dabf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515075, "uuid": "9ea069b9-e3c3-4c03-aecc-9b5a88c9aaae", "value": "narmv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef26599-606f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752469377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469377, "uuid": "e224c600-86c8-4e1b-bb56-ab8a0448a8b0", "comment": "Malware payload", "value": "67a22f00be0eff6e30cfc81513728b89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469377, "uuid": "279fb735-9a9f-4a7c-b5c1-cb44056be581", "comment": "Malware payload", "value": "af7bc0bcb3b3134a8e771409b59ce9861a058d8c2cc9b885a995862832bdb1a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469377, "uuid": "fe92b87d-604a-406b-8769-2966c33de5b3", "comment": "Malware payload", "value": "ff27abe2d2264dda99e377706ca275909f8c486f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469377, "uuid": "6d65cc26-835b-4558-bb3e-fccc66548385", "comment": "Malware payload", "value": "d0b9a8f781020cbbf411a19b7f6891a89a7abc0f9a3c949fc30ea515f2a70afeed54c0e9fb6432103849a34a9fff50ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469377, "uuid": "f483aaa0-899f-4cd7-91ed-200a5fa10eb5", "value": "T153B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469377, "uuid": "f583a1e5-5be0-4a74-a91d-f96e8686a8fc", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752469377, "uuid": "16e81bf5-ddbf-4b87-9931-48696d59defb", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752469377, "uuid": "71c29d96-a7a1-4df7-8a74-150dc80ae79d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469377, "uuid": "6de77457-06b7-4eb7-9a1d-15a92ec92848", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ba0c3a-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514617, "uuid": "b1c6c19f-09f6-4b75-b3c7-4fdef701a3ee", "comment": "Malware payload", "value": "33d433ae74fa81178e63a2a05448e693", "object_relation": "md5", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514617, "uuid": "745dc120-d978-421c-90a3-93165840df64", "comment": "Malware payload", "value": "af8e728394bd2cbd8fd5082bf683eb193e9df1a8a0fd18b9af93871057c29ae9", "object_relation": "sha256", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514617, "uuid": "b18ac198-0020-4cc8-bbe2-75e659cb4336", "comment": "Malware payload", "value": "ec2cf72a944d0fdb5757566a5b93fca25af7f2b3", "object_relation": "sha1", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514617, "uuid": "5d233b51-c753-4b68-b7f0-c96bf0a54775", "comment": "Malware payload", "value": "5183b9412d1cc76dc7d7df175662781edb2bc612c21a3fbe3e2b9c102335a20599d1c80d68d42195e1531d8677a3d180", "object_relation": "sha3-384", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514617, "uuid": "4f2ece3f-cbd4-45d5-b8ff-8ac494ff490b", "value": "T1B1C633549C090E77EE0B09303942C6D79AEA9EB938C8D7FAE335D851934D2F1F3A5819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514617, "uuid": "9f900d29-7499-4e3d-a125-875fb3c1f718", "value": "196608:gA0Cg2RJY6+y7RXdIdq7hZTJr6K/ypAhcrdFasnEEREHAK+wI5wAxxz/r2F306:gApg69bRvJBypACXGEQ8wI5ts3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514617, "uuid": "414db8bc-d620-48a4-9630-4fa2273ddf57", "value": 12271994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514617, "uuid": "3948c99a-162d-4f07-84ab-109f7fd40251", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514617, "uuid": "4d8e76e2-90f0-4514-be22-64c0e5f6fedf", "value": "upd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14797f6-6048-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1752452604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452604, "uuid": "36bffbe4-c816-48d0-bae2-effd9dc60cbb", "comment": "Malware payload (Xorbot)", "value": "1a7d9abccd25587d69aa276c43ebe91e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452604, "uuid": "64c35600-1433-4864-9002-8ed0808a2903", "comment": "Malware payload (Xorbot)", "value": "afc8d8a2ff2792c2a595bb9f7807be5d00e850aee87e5a3664670086dbe5a315", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452604, "uuid": "18f220b0-b434-4e03-a1f0-2614d3b6c51e", "comment": "Malware payload (Xorbot)", "value": "b06798cd2c1c76f1dd61d127fa4c09e4b2add651", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452604, "uuid": "34c80196-7051-451b-bb38-a20d4b04ae1b", "comment": "Malware payload (Xorbot)", "value": "7798370a0813018c517b3365978c2f7ef395166403dd6edd38c49935eb48684a917be83c652bce9e37b2097a100a0e3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452604, "uuid": "6d1b4f62-325a-486e-adea-36526b9f9f0a", "value": "T15422CDC706C479309A814D59BFB155E09715C2C17CDB3BCCE7C8AC49418ABA7B099EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452604, "uuid": "af069654-9e79-4345-8a12-a63037d059c6", "value": "192:srhTN1oBVNQZri0yS06uK3MX7ovvYoN1oBV2Zry+yS06uKSX7ovvo:srhTN1oBVNQZri36AoN1oBV2ZrypX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452604, "uuid": "7da21624-26ba-40ec-9b91-99c2cc682ef7", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452604, "uuid": "8f0ad256-78d8-41bc-b429-0f47d2741818", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452604, "uuid": "b4ae8ddc-183f-49cd-b4d1-df7989d84940", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb907c7-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752477856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477856, "uuid": "62cc3994-c726-4bb6-beb4-16e6da8e7403", "comment": "Malware payload (DarkCloud)", "value": "611861c4ab963dc61c0b17c36069508d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477856, "uuid": "0d4171f0-114d-4fe5-9ac5-29570bd5d753", "comment": "Malware payload (DarkCloud)", "value": "b066a0efafda980b2ba710601b7464d42dc5985efa712b789d376a5c01403731", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477856, "uuid": "d8d37798-669b-4d91-9f20-4b4e056c6a1b", "comment": "Malware payload (DarkCloud)", "value": "1fc3fa85c869ccba33cffedf137da9abf6fa10d2", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477856, "uuid": "84e2f99e-6936-41a1-af8e-a7510a0dca15", "comment": "Malware payload (DarkCloud)", "value": "d4a34a8a42f63e9b75a752d6170b4855eb7ce8289ab0b2b8dd60a986e09b27b9225da398389c2b3fedae1a34c592ef4c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477856, "uuid": "f84d76c7-349d-4c9f-af94-f33171e8b180", "value": "T1A42522B4668EEA01C9469BF41322D77CB3749E08A422D3479AF97CD7BD637622C11393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477856, "uuid": "8386fd34-3cef-4693-8959-0d87e6b14673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477856, "uuid": "4afaab64-7f9f-4503-99e6-59d15b545209", "value": "24576:mZe4CtKHJ5YPf/31fkuki0cCbfzZbmWlL9AAf:Me4CtIJ5Y3/36ukiirzYWnA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477856, "uuid": "948682bb-8ca0-4766-8658-3f06ee32003c", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477856, "uuid": "cf778422-1b90-47c1-bff9-28f8d9dd4b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477856, "uuid": "23c2506e-1a01-46b0-aeea-041c586cf742", "value": "PO_Q469685948637.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b3aec9-60fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752529511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529511, "uuid": "a57a0018-5990-45ce-8041-b5bf8a1218bd", "comment": "Malware payload (RemcosRAT)", "value": "586cc03955ef6800f23367c0a8cff4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529511, "uuid": "44eb68b2-f5e8-42ef-a848-3b78618585a3", "comment": "Malware payload (RemcosRAT)", "value": "b0f0699a48ceeb75d122bcdb44cfd2b03ad09f07fbf511498c358ae34412ca99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529511, "uuid": "b9ab6830-b9e1-40f3-b4cd-4758b02e119a", "comment": "Malware payload (RemcosRAT)", "value": "1fa1d470a32087db53fe7a0def4ff80db5c0507a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529511, "uuid": "cd7c0b17-0bf2-4aaf-87e6-60b68a0a34cf", "comment": "Malware payload (RemcosRAT)", "value": "3045b87bc694e5fe7b65de46eda66975b0e0f07f644af10971af83a77f6fb4027d6bf2ae0243c74a53dbf08585ff35c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529511, "uuid": "c35a67fa-1130-46ee-8733-c7cf41d36d63", "value": "T1DEA4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529511, "uuid": "11102329-855c-4121-9726-9398212c38ba", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529511, "uuid": "0a9299e3-265d-4a85-8c59-de69c7abf478", "value": "12288:r13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS:xak/mBXTV/R0nEF76gFZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752529511, "uuid": "eab4ea51-6e5a-45a8-9d7a-7c3b5ab3b8d0", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752529511, "uuid": "5a1c3371-0181-4038-b652-23a285787be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529511, "uuid": "b188a0d3-a246-40d9-a785-2efbc96d40a1", "value": "586cc03955ef6800f23367c0a8cff4de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17537638-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505147, "uuid": "4e95fffc-645b-48b1-b150-945cea9478d8", "comment": "Malware payload (Mirai)", "value": "0b1b8288ec746cf4516724d6bb024e11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505147, "uuid": "a4577a71-f9e2-4368-8e76-c355cfb48e91", "comment": "Malware payload (Mirai)", "value": "b137904d8061a5c392f0447b1025049878fe16cc9a65025671bd4997e84fbe48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505147, "uuid": "b73e13c2-6868-4ed9-a838-5a26641d45f8", "comment": "Malware payload (Mirai)", "value": "fa37718856279c76c4cf7beb0021754d8541140c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505147, "uuid": "f62fa083-a763-4e32-bee6-a6bb135bf00c", "comment": "Malware payload (Mirai)", "value": "45e4b154b189659df5980fb2b6ea3687db9b3cf2663d5ab2f564b6c900f7c91c9c14203baba729bf2488219c363bf71c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505147, "uuid": "bbfce661-2ebd-4347-957b-88be65f6cc99", "value": "T126733A85B841A626C7D15A77FF1F018D371993D8E2EA3302DD291BA4778B85F0E2770A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505147, "uuid": "d2ae2b7b-64a6-48f5-ad0b-da2a115caea2", "value": "1536:GVIeOhtrtTpB3uMNV1fU2+8AP8E2+ObEOCI8KkCKn1:GVIFtTp8GvM2X68E2H8Kcn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505147, "uuid": "33828458-42c8-47ab-9b72-d30026b3487d", "value": 75144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505147, "uuid": "8eda8828-8b48-42ca-b2b7-5791cc23409c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505147, "uuid": "8ad55e47-7d0a-4034-9b25-c1eaafee3063", "value": "harm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab885a9-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514226, "uuid": "4e0f085d-c9ab-41be-8dd2-f086a0a7f1c6", "comment": "Malware payload (Mirai)", "value": "2c6ca26d2adf0047f9cd1731fde39df0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514226, "uuid": "09905f96-a894-4702-854e-5167e481ac7d", "comment": "Malware payload (Mirai)", "value": "b1617f83bcccfe32de6b0dcfeb06b2bb3fae3887c92a797b9e1dc65af25d7b47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514226, "uuid": "a6cc8d18-4e59-44f0-a0af-4b7a0805f1d2", "comment": "Malware payload (Mirai)", "value": "e24a3c084ec6b20ff4aeb480a19436da4192b46f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514226, "uuid": "9e65d7c9-fb97-4ff5-a298-6c7ae0a5407f", "comment": "Malware payload (Mirai)", "value": "fbd193e48532eaf60ac59524cf9f57100644ee6fd6a553c9f114c534afc933c801833e644f6d3beb3ad897d7e741406f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514226, "uuid": "97348342-185b-4a54-908b-1cb0253c08c1", "value": "T120936BC5E643D0F1DD9601F1583BF7364333E53E6019EA56D369AE32D8D1A10EA2A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514226, "uuid": "9cf6913a-d6f4-4767-82e9-767742e070d4", "value": "1536:/7HzFgCW++C8z2Iyx0KiN+mRSjsc2qaVU5ZMtmSrPz4:/7HaCWBC8Kx0KiNZgoc29VIkfrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514226, "uuid": "4f5cec84-0a98-4465-ae48-88dbe6e7fb29", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514226, "uuid": "e9e14c65-ef44-4d8d-8c9e-3716b77ac655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514226, "uuid": "d6f219a1-a126-4640-a257-a1e472ab3524", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa8c098-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481074, "uuid": "6a6cd159-e7d5-48ff-b924-f356d2a68761", "comment": "Malware payload (Gafgyt)", "value": "e39134df89ac7c2cd53368afdb4cd160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481074, "uuid": "20f97298-ceee-4079-a1d1-51afd6cc157d", "comment": "Malware payload (Gafgyt)", "value": "b1e3ea865d15a1ae587b8154db49d80f640240f36f70c3aa15f1d308e7e6987c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481074, "uuid": "2a4aa305-74ef-49b7-bf72-11aca8b3df8c", "comment": "Malware payload (Gafgyt)", "value": "2ab70fe7179d9ca1810bbe48eb0d250a3254fd94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481074, "uuid": "bea0ee8d-a46b-4603-9d2c-238e915d9056", "comment": "Malware payload (Gafgyt)", "value": "509d8923c67c9ef1fa7468e2ec21179f62ee12dae588cf1bec94c8d7213376804f4f5e6df0ad09ae1b5449076c13996b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481074, "uuid": "a20325d8-08ad-4384-913b-5bc46452e0ed", "value": "T137B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481074, "uuid": "9dd4d234-c64d-4f02-976d-803bccd1ee77", "value": "3072:b6an17WtsWhdgYJp0D6mbPbmTQOWsXAOn:Wan17WPJp0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481074, "uuid": "738ab5c3-a28a-455c-b4bf-d30e349c46ae", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481074, "uuid": "b2d2465a-df2d-4c18-b998-38f1861b829f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481074, "uuid": "ea97b9c0-4808-4dfa-85db-f46500e2d43c", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e3b270-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516582, "uuid": "08450cd6-4c75-4a99-8394-e5dff3e5380b", "comment": "Malware payload (Mirai)", "value": "37a70400ea29b707c4664502bef0c08d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516582, "uuid": "69545cb9-d2dc-4872-9618-035faf276191", "comment": "Malware payload (Mirai)", "value": "b2214748e9a473533a402500adbb87a416aa494091073b8c7f2347e2a59fcebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516582, "uuid": "09490f02-5fc5-45dc-85f6-13a6f4f6f15f", "comment": "Malware payload (Mirai)", "value": "b5bed73da0558e0b29cb392a2b25fa9392d8d0d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516582, "uuid": "7950a752-3875-4351-81e1-c3505ebc8701", "comment": "Malware payload (Mirai)", "value": "42d97b31d1afc29654105ca7a8c7ed76bb23129ac78c68035fa654f0fc4e7748e2d81d623b64f797b4ae9e9661892660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516582, "uuid": "f3303ae1-a1e7-4fd3-b415-b42dd1915c31", "value": "T12C03F19D019604E5C6E8C0BE13FD076512D1177A93668849AE9CFA409662E3D3C63EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516582, "uuid": "bb3acf4a-76cf-41a4-ad68-ceb63f04f84c", "value": "768:Vi0BMT7TPwqHunfXX3ByQLMADH8cxLujSeUxHHm2FZZhtjxsmzeiQo1FghPJgGlc:Vi0Bc79H8ftVLo5UxHG2FZZTKmYJVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516582, "uuid": "12ea84ba-d318-4595-bcb7-11e7dc6fe9c3", "value": 40216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516582, "uuid": "8fbaec2c-fd2c-47d0-8548-27ca6c07ce63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516582, "uuid": "fd49092f-806e-45e2-bb96-85e9cf143d36", "value": "top1miku.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f288f3-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752479905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479905, "uuid": "79c62ae7-14fb-4969-a1cf-50914b1e0cfc", "comment": "Malware payload (AgentTesla)", "value": "089cbe21093055e69cd41d9f6b6fcee7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479905, "uuid": "79955787-9d22-4160-a531-c68980fad364", "comment": "Malware payload (AgentTesla)", "value": "b263ccf265c4b850d92dccb1561dd0ecf049f795f6bcdeeb259bce1e7878ecd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479905, "uuid": "f2405ccf-87d3-4f50-a4ab-1b89096e0ef6", "comment": "Malware payload (AgentTesla)", "value": "16bdeaf6730ae5bc8c16fb6f92fb38d9e0dc14e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479905, "uuid": "cc1b89d6-e345-4669-81b7-68cbe8e4f592", "comment": "Malware payload (AgentTesla)", "value": "b7b1d39c4a3bf9a500627a599c265c65c79915b376451d6fc89c414aff86673831ed27adcf26890b63948436f1cb0d36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479905, "uuid": "551476e3-ec93-4d28-925d-83a70b6492e8", "value": "T15635BE1267DD8270C372A9737B15B721EE7F7C2506A1FA5B2F94093DA8A01A1730F663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479905, "uuid": "b6f4605d-cb15-4b79-9c67-bca4c4e41401", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479905, "uuid": "7186fc4a-a57d-47da-90d4-6c52ecd75845", "value": "24576:vtb20pkaCqT5TBWgNQ7aF4H444tLnBvoSKy6A:sVg5tQ7aF4H444tLBV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479905, "uuid": "cf65f069-54ef-44c7-acb7-f7541b3c0aa1", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479905, "uuid": "1a615cee-d38b-42e7-9a44-947d7abf2410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479905, "uuid": "73a289ac-9b95-4b98-8688-239e7e22dbdd", "value": "Ball Valve-Datasheet-0331-DY250326K470039.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23276a3c-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492282, "uuid": "2fdd7b0c-2df6-418a-98da-f94e088c9d59", "comment": "Malware payload (Mirai)", "value": "bb21848d5fee72b36c28b5b0abdb58ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492282, "uuid": "be51bd50-f51e-4a4f-a956-ea5e6287a9eb", "comment": "Malware payload (Mirai)", "value": "b28e94db8602a9aaf9c60c0051f3d03b524d8e5c98e00f9af4044983a1297b87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492282, "uuid": "5cc9ad47-8daa-46a6-a085-2e08febb79d4", "comment": "Malware payload (Mirai)", "value": "a3e3fcb2bdcaa1eee076c8429cc68d7bbf6e0748", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492282, "uuid": "c2df91b1-7ebf-4960-a2f1-a09c74959d29", "comment": "Malware payload (Mirai)", "value": "3307d7a8a88a0fcc25ae4acb565ffc2352979f5104c71c2f18f9884f7e39be3d613dcebcb75033bedea4f2258302cb7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492282, "uuid": "b263a84d-6d1d-4575-85d6-1cc30994128a", "value": "T11AD2D0ADE57442C5FD8D5C3E808C3FA10D1AE181631BDB9277218C4E5B36C57F2AA4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492282, "uuid": "bde1373f-9c1c-4106-947e-2eeb5a2ab227", "value": "384:d8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjnGjRWGVCz0NvY:aMYHb62x4ahQ3CfdwLjHWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492282, "uuid": "4ac9bc7b-bf87-4e16-a828-46903cb93787", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492282, "uuid": "550d5d7c-49ee-4756-86cb-f71bb53c4ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492282, "uuid": "f96ba967-5de7-498c-a395-a6502cb8f945", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526c8674-6087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752479476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479476, "uuid": "40d90409-19a8-4b22-bc5c-a46164b41465", "comment": "Malware payload (VIPKeylogger)", "value": "29043088397a18c40d714b7c5e0ba647", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479476, "uuid": "5507c983-bb46-4b14-b02e-c4cf88e249e5", "comment": "Malware payload (VIPKeylogger)", "value": "b2ba3d311964b3134b3d71fa38aedd7749574ce172d24f663a3e02ffe584d83b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479476, "uuid": "13d84ba0-9de3-486f-a293-88939824d0d0", "comment": "Malware payload (VIPKeylogger)", "value": "2feba303c0ecfb87f57c5311fade943987d4d97d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479476, "uuid": "8a5c9546-d545-4147-ad3c-e24771570927", "comment": "Malware payload (VIPKeylogger)", "value": "a66d7c53873878e2c3186f6a70f716b46e08e779d026d72670dd7a7c98591aaa83107b8bcb4ec88539a78bcc34cceb2c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479476, "uuid": "de187f35-d606-4d99-a77c-c1a0cd2af9f6", "value": "T1F1852373B299C829D0A504F409BDD06B1AB2EFE46023855F3E1CF95D6B3139279ABD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479476, "uuid": "a6deff17-c7e1-4550-a17d-bc875cfb5f72", "value": "24576:ObJ7s7dSaXLTSyAt5TfxLgJ7pf3PjSNwzynm/:mJ4dSanSyeTf+J7pnBzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479476, "uuid": "f7960ad5-08e1-4100-9f8f-59fe2a1fb48e", "value": 1787904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479476, "uuid": "dc3e38db-e1fa-4f66-9af3-af8b11177ad2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479476, "uuid": "5d288b5b-b68b-46aa-8db6-0335955090e9", "value": "Aviso de disponibilidad de d\u00e9bito directo.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d062c5f-607d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752475145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475145, "uuid": "049672e2-9aa4-4a8e-b9d4-a41f8ea368d4", "comment": "Malware payload", "value": "8bcc8a2216c54be474f3f3dfd85404ce", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475145, "uuid": "cda5925d-fe19-4cab-9302-f8415ff1bfad", "comment": "Malware payload", "value": "b2f10942041bd83bc65a9bdc2309385984a8e4b00fe9a612c11c131cdddf6709", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475145, "uuid": "72902e5c-978f-4b54-8846-dc47c8116332", "comment": "Malware payload", "value": "49cbb673bd0507eb89fdccb563c79cbd23273254", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752475145, "uuid": "1e67ec17-71c9-49fa-9da4-1bc592989ff6", "comment": "Malware payload", "value": "9e2bb1459c18652685ec0d336bd7c7bfd596ba49d9dc61b1a916991b976656f90eb49ad5d752482e7d80857a6e660272", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475145, "uuid": "186015aa-cb74-4f14-8ed4-2504459ed9e8", "value": "T122C2F1A43048EDF1964F8D96C0C18D8D219E4D9FBD034E78673AE887C69637F85351D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475145, "uuid": "ed808a36-a458-4500-bff2-b20e996071b8", "value": "384:QM9Xd2LEyYa9o98NdXilr6kn1Z7uQO5M9bZXDcmmh1mpA0RMW5/ok7p1c6Z+E6Ow:5hao987SV6k1Z7NOUZcGNlp+6ZW75J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752475145, "uuid": "1ec12c4e-7520-421c-90ff-1fc5348986fd", "value": 28066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752475145, "uuid": "ae8382a0-0b61-4335-95aa-902468b44f92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752475145, "uuid": "310c8cfe-52eb-4be5-99d4-d3076ba810b0", "value": "RFQ KUSGROUP_Materials-Specification-ASTM700-BOQ.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f42606-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503668, "uuid": "39df5a31-4172-4db6-ba10-35bd64e99ebd", "comment": "Malware payload (Gafgyt)", "value": "928580cca9dc3ed896afd72762d94f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503668, "uuid": "26b95eaa-9fd4-4cb2-91c8-5f7c9292279b", "comment": "Malware payload (Gafgyt)", "value": "b34e8cc316b275c2e028b73ea5b52485dff4864bfd15eb04838a9cdc2cf2d808", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503668, "uuid": "8eea674e-d118-4c62-b5c9-9c3f87e378e9", "comment": "Malware payload (Gafgyt)", "value": "614c00ec9721cea384dab6bbef0dea7caad05873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503668, "uuid": "e0122a8d-1c34-4c08-b309-7b3657de9fbd", "comment": "Malware payload (Gafgyt)", "value": "4c77375f1728334d1d219e95a3bd2856c904d31bf8f4340e3f134691de9f64f523c3996f2c835a44de755b6fbe3034c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503668, "uuid": "acf611c2-c0ba-41b2-b252-09ea4263fcd6", "value": "T15A931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503668, "uuid": "586031e8-b601-4492-a590-7ff94e4ddd71", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcveNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGeNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503668, "uuid": "9f265275-d8b9-4ca3-b37c-7375cebeb93f", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503668, "uuid": "2bc66e09-0e6f-4cdb-8876-5634b31d9b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503668, "uuid": "a45c9717-7b51-4982-971e-837ebf27e016", "value": "a-r.m-4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff92633a-6096-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752486209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486209, "uuid": "74aea4b4-0d22-4ff1-9b15-c62ae165145e", "comment": "Malware payload (VIPKeylogger)", "value": "33107e31785f866443e3168d5d9e69ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486209, "uuid": "589006d1-b7bb-42aa-9d2d-19700696158a", "comment": "Malware payload (VIPKeylogger)", "value": "b37ff76776a38f2a0ded7ae2220a44c0dfcb92ed88f135bb3f4443ad8b98548a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486209, "uuid": "75c4f658-e13a-4e98-acc3-7f02ed304e35", "comment": "Malware payload (VIPKeylogger)", "value": "0d91da0186ab9d9b1159bd758a85b8f41e01a32f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752486209, "uuid": "de03c01f-a738-494c-ae5c-3dd026568139", "comment": "Malware payload (VIPKeylogger)", "value": "22b87754539a117ce81c9d38226dcefa144293202ab1d5ef516be36ebe59b6e7f7292c961e62b6b55f3822e88f088100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486209, "uuid": "e70c7c76-61bd-4d46-bcc5-798a7f8e1997", "value": "T136F40115A639CE12C5960FB06722EEB013BA6D98F421E7435ED6BCDB7377B8010D1A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486209, "uuid": "84d44084-73ce-4605-803c-23f75aa42101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486209, "uuid": "fad02a60-8322-419e-a99d-094711a937f6", "value": "12288:lQ1/3plPNh04F5Ym/LqiPwsYjQkbvpFCs4OjlK9BjqBdUE5yK:eF5lPNhxHTqiPLk92rGKzjsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752486209, "uuid": "3166c986-7f59-44d6-8607-93cc2b790d3b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752486209, "uuid": "f139848d-1725-40ad-8387-5e551c9ec110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752486209, "uuid": "cc31372b-2cbe-4dcf-8309-083a2b6dffed", "value": "Quote#62810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf9ff45-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752515785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515785, "uuid": "8118dc6f-0763-45d0-9e95-ce1a00f2bdb7", "comment": "Malware payload", "value": "97988582f0a6328ea86b9ae897ec4b43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515785, "uuid": "cfbb9636-396b-4dec-9d82-9e32b5cf313e", "comment": "Malware payload", "value": "b38d9543bee6f523868658e7360a19339fc1afe7e734ba2ffdd16f06491c6fc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515785, "uuid": "ff4ecab3-7a79-4f24-93ac-fece58e00cf4", "comment": "Malware payload", "value": "359da4a9f67a892152f5448f3aaf5a313c7c0889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515785, "uuid": "6d0d1e97-31c6-4673-9f66-5a2a71721232", "comment": "Malware payload", "value": "755a922cfb851ddb990147bf1b000d623fb06595d977ac5a4d80e0c3acaa89b7702733cdce8a24dd131b42ffe875da59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515785, "uuid": "c94df58d-d34d-49f1-874d-a9377597450b", "value": "T145E6F163F0539605DBCB4A35DEE2AE500A61BC1AFD561A2F3048BE04AB737C13A617F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515785, "uuid": "03b6b6ba-c769-43f0-b0e8-49b1874d9954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515785, "uuid": "049b1399-772e-444a-a3f1-4b2e4c5847d7", "value": "393216:2ujBz7AYmzgsSuqmpyW5jVPP+DLxNcUPnQ:T7Xsdfy8jVPpUPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515785, "uuid": "ccf821b3-bf3c-4675-a850-f328714f363b", "value": 14074880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515785, "uuid": "2d64aa95-4745-4eb3-84ca-6444990df1b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515785, "uuid": "6f031658-682e-492f-b6c6-2ee02daf2fc0", "value": "BEN ERROR CLASSIC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7812d07d-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485123, "uuid": "ff193adc-1cf7-4f08-ba3b-8fb45b98a4b1", "comment": "Malware payload (Mirai)", "value": "55c7ffe0f9752fba69035d83850f8c59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485123, "uuid": "a309d977-da35-457c-83b4-4979dc5dad78", "comment": "Malware payload (Mirai)", "value": "b399c11c6596a51c6ec9ba70fbd1b4da76901df37630fec478c4857309d04002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485123, "uuid": "86295808-b92f-4e80-bddd-289d1185c551", "comment": "Malware payload (Mirai)", "value": "b5d008b1dbc6cff3790c945e4fcedbb88e19b0e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485123, "uuid": "1653b2cc-bdd4-46c1-a0a0-5b31e7e632c5", "comment": "Malware payload (Mirai)", "value": "18ec30ccd62ba470ab6779b34f89b0dbb6b85004a8f700b6ffee1512a9f9937f1165b6c60160695090751f63c68d6f1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485123, "uuid": "8d6d8593-cafa-4890-b0b2-d4315370145c", "value": "T1BF732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485123, "uuid": "38162b4c-8c84-4c98-851b-e8fec2f9f4a7", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WG:927jqCt8v3GI/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485123, "uuid": "905c96f9-6b36-41c5-83e1-f1111faa4d91", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485123, "uuid": "e867335e-015b-4198-9a70-b1075a81b832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485123, "uuid": "5befcab1-52c4-4585-90ab-83470d285216", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e6bbc4-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514001, "uuid": "b6b42569-e350-4aac-a5d6-42a01b2819fb", "comment": "Malware payload (Mirai)", "value": "af38428f8d125e7c0286fc7bbedf017a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514001, "uuid": "c3d22fe9-b9ed-45c4-8f0b-9026f88d2f71", "comment": "Malware payload (Mirai)", "value": "b3b330acd754a31fb2209aa7116035e230f9d5ba211b13facb4067e625eae1bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514001, "uuid": "a94b6bf0-6178-4746-8831-41946b4ffb37", "comment": "Malware payload (Mirai)", "value": "ce4633ac1f57309dc8d872f590045235bc26e24c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514001, "uuid": "08d1ad35-6911-470a-8ce3-e1a499e6efa5", "comment": "Malware payload (Mirai)", "value": "c7c6ecbfdeb1176b0ee293db42308bf60e2e5ba11d1f18524bed216224286a384dd55f97b0f07dd900b3e6a6fb460051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514001, "uuid": "9f6d9137-f4c7-4169-9214-ad483855d609", "value": "T13B335C86FCC29A2BC5C00336A76E6A4F3711A3E1D2CF7703ED185F22328661B5E66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514001, "uuid": "56d12485-5096-47bb-bb63-f08c7c20fa8b", "value": "1536:Go9nOAQqeo2XdqxK1MacVaV4JKa+a1UQwG:GeOAQq0pMacYaLBwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514001, "uuid": "cc549be5-413b-437c-a3f6-054935729973", "value": 52336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514001, "uuid": "42275865-02e1-4a60-8a35-9a120362524e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514001, "uuid": "8f2f0513-f3d5-4936-8e85-d60eb2abcf51", "value": "top1miku.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5ab3ba-6079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SharkStealer)", "timestamp": 1752473504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473504, "uuid": "577e6afc-f389-48a8-9c62-0327f41d07a6", "comment": "Malware payload (SharkStealer)", "value": "406ffabed1c198adc99fb6516e9ba5fc", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473504, "uuid": "8b60ae02-0318-4ff3-9a56-2e87964a9604", "comment": "Malware payload (SharkStealer)", "value": "b424d54700f44d073114dfc618c4d402f9db377f813fa6e529b268fe860677fa", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473504, "uuid": "a1dc1a59-d5b5-4598-8415-ed826c5155cb", "comment": "Malware payload (SharkStealer)", "value": "a1094f76b4aa7eddd7bb8a72bcce72ae7ad8c921", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473504, "uuid": "ccd7b89c-8efc-44bd-ba29-bc37fad62789", "comment": "Malware payload (SharkStealer)", "value": "30d5e8dd4de9f473c21d8669cd86b90a0120f158f8f13be3e414936bf1e0798ae6bb0c787789ac93e87500f295b656ed", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473504, "uuid": "85229dd2-c855-47b7-8ab1-bc851d67a95e", "value": "T11E36E1192C84EB12F15D093B98A7143443B82C2C861E9D5777D227CB699E33633DFB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473504, "uuid": "2bfadcd2-cd4c-4bcd-826b-a51fc4d376de", "value": "07be6a8015faea66f11ca5e3c8e1478f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473504, "uuid": "871651ba-c543-4bd1-a2c0-d6c4fbc38a22", "value": "98304:wuliCQJ+9bJc1UEf25Q+lraJaJ+ubaoNM:wuDK4b2qEeDrSaPbxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473504, "uuid": "f850bc4c-e091-4822-a592-dd41cd1f6d37", "value": 5319456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473504, "uuid": "e4bf40a9-b5d8-4e77-8fea-df289dfaba3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473504, "uuid": "5650306b-4a36-4585-a28f-f0037dd4789e", "value": "shrk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0220d837-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516278, "uuid": "ec36c2bc-6653-4bec-aefc-302ea5d69ba3", "comment": "Malware payload (Mirai)", "value": "e946c6b812c062863a84eb7f7742b062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516278, "uuid": "e80fd359-64a5-4808-9347-c378b5b9e473", "comment": "Malware payload (Mirai)", "value": "b47956522c66866e7b5356a4f242b2404169f22c94305b722999c0af8f0a0afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516278, "uuid": "04cf970c-504f-4f48-8b71-5434d75c3efe", "comment": "Malware payload (Mirai)", "value": "d36859dca81a80e50fb180999128258732e0b09f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516278, "uuid": "b8cd0d53-9ed3-4d14-a5ba-1858d03b6031", "comment": "Malware payload (Mirai)", "value": "f8a2d0d7a6877e32d3182d039c18e570e6d044e24c074c665c0f0351c4a6cfc7b7162f56cd86aea7a8e2dcb6a7d2701e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516278, "uuid": "4089b957-7fd9-431b-b101-2bb51ad6206e", "value": "T11913F10085D58AC1C9B02EFAD4AA02AA6917FF76E09F73BB2504CF84595240E43F46BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516278, "uuid": "90b7738d-8e4e-4505-bdbd-8d600586a1a1", "value": "768:EXTS2dODPTF5wPyks+lSjHfZQ7+QOqaiI9q3UELk1:EX2OgwPyZ+gZUacLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516278, "uuid": "dfe728b8-f3fb-4de9-8afa-5f7288982f3b", "value": 42440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516278, "uuid": "3ae93a54-e4c7-49e4-ae49-3a8f150cddb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516278, "uuid": "5c42bf37-f592-41cd-bcb8-362de58a01db", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090f1f26-6049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752452724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452724, "uuid": "3b659e55-e411-40be-a40b-aef862a87231", "comment": "Malware payload (XWorm)", "value": "692ef17124834c5807a313055452a917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452724, "uuid": "97ea2be4-1dd8-49ba-abbf-caa54bce200a", "comment": "Malware payload (XWorm)", "value": "b4a61b88c0684bb843e636a3650ce63fdcc485f4c0b47c6d290377e56cf2e9b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452724, "uuid": "0d9b3481-3634-408e-baf0-325d72b74bab", "comment": "Malware payload (XWorm)", "value": "7eed22b9509aeb2aee206f788cc7fc108f226e86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452724, "uuid": "c4a76ebc-4d1a-48c3-a8df-fb0465badebe", "comment": "Malware payload (XWorm)", "value": "bd7ffa9931205b68aebbee8fbae5cf4a16a3c67e99324d0a7ac387eb983770763c27b654fec9ddef95d463cbaaaa1cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452724, "uuid": "cdc43916-c8c4-47ec-bd3c-bfb45049a969", "value": "T19E637C6C7BE54519E1FFAFF40EE136129B35E6235903D66F24C9028A2723688CD507FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452724, "uuid": "f956614d-d8dc-42ed-92b8-932058ed1c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452724, "uuid": "66d23e72-b767-460e-872e-c6b381caff4a", "value": "1536:x8BfMAXDL+ZpjjSdM4SBFryuNkUJCFbF6/kpBS6QO7qr0/9:oMjjSNSLryy/CFbFuOa0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452724, "uuid": "fbebef27-67a8-4c70-8aed-2cb7bf724ec8", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452724, "uuid": "6fbcc0c9-4ce9-4bc4-828f-f9b6b2b622d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452724, "uuid": "136087c9-0fd4-4076-9c54-9ccc12ba8e1b", "value": "692ef17124834c5807a313055452a917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad09dcc-6085-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752478766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478766, "uuid": "f3e54e9e-46a5-46da-8c3a-8ed7b5239411", "comment": "Malware payload (NetSupport)", "value": "d0c3b7921a04a358b0d5bb04b29cc830", "object_relation": "md5", "Tag": [ { "name": "5-181-159-200", "colour": "#632AD9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478766, "uuid": "6d5d5e3b-ef42-4e34-bf7f-711d5aea3be4", "comment": "Malware payload (NetSupport)", "value": "b4b339dd784f0199313e260822b3a4787a4aed91fff7f55012f8b4bacdc67360", "object_relation": "sha256", "Tag": [ { "name": "5-181-159-200", "colour": "#632AD9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478766, "uuid": "85977432-8670-4633-b060-e2a788aa4cd9", "comment": "Malware payload (NetSupport)", "value": "bd22a56bc1fd573541b47b70c99398de8894e81d", "object_relation": "sha1", "Tag": [ { "name": "5-181-159-200", "colour": "#632AD9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478766, "uuid": "dc9dead1-852f-4812-850a-3766ef552b50", "comment": "Malware payload (NetSupport)", "value": "69ec9df1e45faa4fa746e258a6c2f6c8db273673ee50cc5715a6373c9abb64c222a5b91eb807590d9b783b5b3afa155c", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-159-200", "colour": "#632AD9", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478766, "uuid": "a5b7fcad-f5a7-4d41-a6a8-021444c61c88", "value": "T15CB633F1E40B4A77855584BFFECA3E6B5213444D474E884BE863B094A2C5A7CD6B3A3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478766, "uuid": "7f41c1ba-728d-43a9-8e64-c206d86bd6bf", "value": "196608:Ur6GPDBYNsp3kDJ7XMc0aASiDJ7pMc0kSSsDJ7zMc0aQSgDJ7HMc0WsSQDJ7PMcH:Ur6e6Nspk6yADY8SN2SQ5KustqKYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478766, "uuid": "82e5817b-4f8c-47d6-a6ef-f095203d1c67", "value": 11336074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478766, "uuid": "15478135-c9e1-44f1-bf7f-dba3e0e568b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478766, "uuid": "bedd1df9-1603-42e9-8f82-2e6064ba7e26", "value": "5-181-159-200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da4b4f8-6087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752479441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479441, "uuid": "ebcd8f78-f87d-4e95-8a3b-d05f889a3b61", "comment": "Malware payload (Formbook)", "value": "9a4a118b88d3527b5ffd89220c02ec0e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479441, "uuid": "1085e1d6-d0ba-467f-b14f-f37341ab3fd8", "comment": "Malware payload (Formbook)", "value": "b4d21194fab3530c6d5cdc235f81f5510f5d1b72641c078332ca475316d617bb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479441, "uuid": "cf66fc25-6c31-486f-9d17-fd6c1937029f", "comment": "Malware payload (Formbook)", "value": "2b2ef035cacf6c18b53bca2204a61daaa9156185", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479441, "uuid": "a634c469-7771-47f4-96df-26dcc985d93e", "comment": "Malware payload (Formbook)", "value": "3a45bf5d29b8205fb01296a936907990e605ab9f7f2b294ad9c939976e4fda4a425fb6199859d4194e7aaafb1507c3c2", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479441, "uuid": "d1b1a7ae-d277-44a1-9f32-5159abf56d85", "value": "T123E42390A51636F2353120DAA80249D9AECBF9B745C17779E8DA70AFF148C4C5FE2E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479441, "uuid": "471c05af-e4c3-4829-b3e4-5c3b48a1cf05", "value": "12288:u5RFDyLx347DfMgDoiNklcvW3obR3j2WO6X9QFvIA/TrCqqi0wl/FCg6:SF+N8DfhcceuR3jFO6X4v6qqi0OId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479441, "uuid": "11c4287b-6b90-4a9e-9cef-3450d2911b54", "value": 704111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479441, "uuid": "4b3fdf13-27a3-41f4-9d6c-9ee1dbbea913", "value": "application/x-ace-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479441, "uuid": "05c90787-b6a3-46c5-8e9c-849b31fe8b0e", "value": "Pending Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6145de48-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504412, "uuid": "39598d7d-3fb9-4f57-a90d-d5a0e8438be8", "comment": "Malware payload (Mirai)", "value": "c7dbcf0f128ec6b4591673639e3f92b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504412, "uuid": "f17ed986-c113-46be-a5c1-68a4029918bf", "comment": "Malware payload (Mirai)", "value": "b4ec0a24a1a7f3cf122ed7e4fd26dfcef76b7ee584cb9f76dbe74328e3818e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504412, "uuid": "83b7dc25-6c24-4f7b-b5fd-a2b8104a4eeb", "comment": "Malware payload (Mirai)", "value": "a17e0010e1ae923982a4933bbe7901abc9b6573a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504412, "uuid": "934c1c25-4b96-4c12-b536-56b8838619b9", "comment": "Malware payload (Mirai)", "value": "0eae8eb7aa3048808cb72da951f30f44c79eac33843c9ea5d734e14e67b136e5c14ee4b1696db9aa48fea64f1fefd3c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504412, "uuid": "1dde9eaa-8614-447a-a6e2-2d3b83bba6c7", "value": "T17414D50AAF510EFBD8AFDD3706E90B0225CC655722A83B363674D524F54A54F4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504412, "uuid": "31f1e1b8-c5b6-4421-820c-121228f69f4d", "value": "3072:r7lwMpTz1cCjDWxDLImXvPQFNURgF3iI7g:r7lwMpjjDYLImnQARs3ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504412, "uuid": "09eab64c-9b37-448e-997c-5a5da23d4806", "value": 196144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504412, "uuid": "4704c50a-eaf2-4318-a06f-c928fcabde6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504412, "uuid": "702003d1-e53c-4f30-afa0-78310c283a70", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f59ec0-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503670, "uuid": "2e8f00b0-74d7-488f-baba-70e1f1009d03", "comment": "Malware payload (Gafgyt)", "value": "c893c7523a50955bd79924bbc206d921", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503670, "uuid": "54988ef1-b378-4aba-9d8f-9cf2a4ef83bb", "comment": "Malware payload (Gafgyt)", "value": "b63b8771395df2ad7991a1281ea18a8d497a93bbcaf4c664289b4916cb0ea67c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503670, "uuid": "a7221f3c-042c-480a-a28d-e658a5040131", "comment": "Malware payload (Gafgyt)", "value": "b30d09f1b50a7978630720570ef4093831ac8940", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503670, "uuid": "133c8f66-be1b-4615-8fd5-09c7d60c4b40", "comment": "Malware payload (Gafgyt)", "value": "be3058ed538c4b0e74788ca3f7809e419f875146d4f2007c1c16ace7873840c33b2590e444a43531ddb5a1790b72d078", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503670, "uuid": "c0784335-8498-42c5-827f-8c846c08d298", "value": "T1A6411C86F1A108F56C94D52773FA488070D0A4CEA9D65F0F69EFFBF9088DDD56A40683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503670, "uuid": "ecb6d6c9-249d-4798-a0d8-99c1b68ff953", "value": "12:q0FEgUV5ew0FEgU00w8SA0FEgU590FEgUOoj0FEgUHqs0FEgU8m0FEgUHkq0FEg4:v+AhJ0dSxllog5ZT9Xxj482sXxjha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503670, "uuid": "fcfd9650-26a2-42c1-80e3-33d699c80484", "value": 2124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503670, "uuid": "38ccf195-ea70-407b-9ea0-44c177e200ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503670, "uuid": "27768fbb-0bfd-44b5-a926-c173234dea39", "value": "SnOoPy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec5a56e-60d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514608, "uuid": "dfad7a26-35b0-48fc-bcad-3be5f014e21a", "comment": "Malware payload", "value": "5c5fec7868f607906b66f3cacdf8aaa4", "object_relation": "md5", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514608, "uuid": "f61a99c3-3f26-46a9-9c22-7b657d91e5ac", "comment": "Malware payload", "value": "b667b41364efd315dea9812e90b9680b06f1dce6773763ecd311a9d90a715047", "object_relation": "sha256", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514608, "uuid": "28d4a48f-e3cd-4f4e-bdec-461710d03b97", "comment": "Malware payload", "value": "434f39501a1c79dcb3027678fe9fa496d43fc477", "object_relation": "sha1", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514608, "uuid": "e2075cf9-d383-41ee-bd84-dda5d7218a8c", "comment": "Malware payload", "value": "c661ef03add03292fcce680fa65685f50b8e51791d8ece4e175259dd71a87e1534195ae9f6389e5fd14a149ee01038ba", "object_relation": "sha3-384", "Tag": [ { "name": "cryptotabber-com", "colour": "#117602", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514608, "uuid": "d66a1a0d-5e72-4041-8280-42d11322deec", "value": "T11F46332988E0440CF129A717E1C9E0E0A5DA2158A752D0F5BCD6FBCC78BFA64245F7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514608, "uuid": "2f585fef-7f8c-48ec-aeed-173bb8bc96f3", "value": "98304:yhiP8PVCTujNOOFmOjakdEuZ6Hv006a4VFn2j1SdsLRGxYfKkORmHn:yhiktVNOOFzjBqHv0LLVqcsLgxYfK1mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514608, "uuid": "512cb9c6-d05b-4ff5-9766-ff46efec7aad", "value": 5445825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514608, "uuid": "2d7eaac0-9de9-49d4-93fc-a8d420524242", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514608, "uuid": "26ebef14-1e52-4567-8049-3e1e537e4a4c", "value": "b667b41364efd315dea9812e90b9680b06f1dce6773763ecd311a9d90a715047.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec496930-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504645, "uuid": "e6aa96ac-a47a-4d76-9ffd-b9e756627b0e", "comment": "Malware payload (Mirai)", "value": "687aa83753aa93e7e96011d2d5b35074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504645, "uuid": "55b1e907-ac39-4b1c-87b9-f2ee32ed3c03", "comment": "Malware payload (Mirai)", "value": "b667c1dfb122bcf9bca7c3b315f6fc5ec4626665a98e42c5bb1ac9b825c0941a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504645, "uuid": "91a62b03-8255-4391-a9f9-9982465ca00c", "comment": "Malware payload (Mirai)", "value": "abdebbee02e29e80cff4fe0569f15ebfd9c73ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504645, "uuid": "e2cad98d-815c-4dbc-b7c7-486ce3fa2900", "comment": "Malware payload (Mirai)", "value": "9c7d63d6a541618ee3de55545d8548b63030f2477e20c8af10141a7f24c1c24973d510af81ec496bf89209cea0d5538c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504645, "uuid": "355a1900-a20b-4b96-8900-08fc7c5b0865", "value": "T15A538D75D11DAEA8C0414A74A9198E705F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504645, "uuid": "691cadf5-530d-462e-863b-d56320d6a4d9", "value": "1536:ragXV1f1Fl/wtkLyPQauiufs3Ii7O/qyD6EZeCc:r57f1b/wQHf+Iiy6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504645, "uuid": "3a509c40-1377-40f3-9358-72ff2d5bf48d", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504645, "uuid": "63200482-3db0-4f32-9eae-6c2f87d47a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504645, "uuid": "9ace18c6-2057-4944-bc4c-4f19d8fe4f20", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183df02c-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1752517174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517174, "uuid": "ffe37f2c-db86-466f-965a-894f970a700b", "comment": "Malware payload (Xorbot)", "value": "b476527e77c1b30a4afcc6c7a8bd3306", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517174, "uuid": "469852f0-b41f-4c5c-976e-106c9f2062c3", "comment": "Malware payload (Xorbot)", "value": "b67ea4f1227318f88d91e57907e021241b6f63fe969fffc2d6468ce27529928b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517174, "uuid": "23b4e960-0fa3-460f-8d78-49c89e24cf7b", "comment": "Malware payload (Xorbot)", "value": "7fe7640e31f8a917df689ed9b650cb49f38d1b97", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517174, "uuid": "14898a25-d573-4e5d-960f-14e0839ac059", "comment": "Malware payload (Xorbot)", "value": "c51bed2c2c4f36c3cd15ae08c6f421c83b025b490574087a8d56b893126b72998e99f773d09d31133579634eed262a51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517174, "uuid": "a8e810f0-c536-476a-bbec-786ef0dbac54", "value": "T1C422CFCA01D0B2255EC18D897BA1A8949343D6C1B8E677DCC6C89C5D52CFABBF048EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517174, "uuid": "e40da009-c841-4b9d-9662-dbc405508efa", "value": "96:DwpVqSkhBjQNSmp6Z1WP6Z1WxiDUHJpVqSkhrRjRVeUQW:DwpVqSkhBjQNSmp6Z1DZ1zwpVqSkhhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517174, "uuid": "5e312aa2-556f-4a1a-abdc-a191e77cda52", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517174, "uuid": "69cda4b7-f3b4-4aba-aa82-5c51256529d1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517174, "uuid": "c2d8d55e-4b80-409f-a3b9-6c7c14995bb7", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0d5f8d-60ea-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752521882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521882, "uuid": "5c3c261c-0928-4cd7-839f-ce9dd39ca569", "comment": "Malware payload", "value": "0e3e68cb103c9e4b82c88da8a65a185f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521882, "uuid": "2d90663f-08ea-4425-886e-562672fe2fd7", "comment": "Malware payload", "value": "b72158c1c37f7ef6edfe5511acd3c9f7131ee6093688290b33d250871d7b74fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521882, "uuid": "f9afce50-3add-4497-9bc8-27e2975fe190", "comment": "Malware payload", "value": "1ec2c18dcca78281e1f0c55e8b1b4b788100e4d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521882, "uuid": "635c2f9d-704c-42c8-a990-ca3fcb679a59", "comment": "Malware payload", "value": "2687496344b8bbb2764ce614a88a2b2062f1bb4a623d6dc95df062e8b40a7eec1821685573c960477fee1a38a15305a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521882, "uuid": "05f1b863-eef8-4a8b-8c3f-af6503d14b87", "value": "T1DEF40115A576CE11C0A60BB06B21ECF0137AAD98F814E7275ED6BCDBB3B7B4111C0A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521882, "uuid": "40538266-5ba5-4297-a827-42ae67f3fb58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521882, "uuid": "38a4f301-a7c7-4804-94ff-bb8990ead8e9", "value": "12288:V11/3plPNjCSrwCaQwkJjaUSY9a0GD8NuPIANG8mxT8dHTQaIuong3+CXqp:vF5lPNO5QwSpaYugAN2xu3hKgOCXqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752521882, "uuid": "beb9aeaf-60e9-44f2-b672-7fa27a9ea774", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752521882, "uuid": "19e50886-998d-4e7f-a696-a67e5f3135c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521882, "uuid": "93c21815-5bc8-4fc9-9309-7563d7073a5b", "value": "RFQ_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e177ae3-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481080, "uuid": "0c9b37f5-2ab9-46ea-a4f6-1cb5a9f2c021", "comment": "Malware payload (Gafgyt)", "value": "8e960fa331a9627c1cc5605772cae8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481080, "uuid": "215b5b16-54cb-48e2-ac19-d7fa099b4248", "comment": "Malware payload (Gafgyt)", "value": "b7874923d5e6a8603cdccf40f0e392f1466d9e7d51236062f90cba8b12051aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481080, "uuid": "10068e77-b9f6-4f29-99bd-8ae7708fece0", "comment": "Malware payload (Gafgyt)", "value": "34a6cc1cd50a8a38324ad9b310c8e93918e9cf20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481080, "uuid": "a89f6452-accc-48cc-bb2e-328eb0e41a96", "comment": "Malware payload (Gafgyt)", "value": "73647487920e9cb9270d377a6fcdb9a3c1a051f12c17599802be51529c55a46349cc06baac2db26a7955ac92b35d1e45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481080, "uuid": "29b3fb79-3073-4f46-ba6e-9689fe28f13b", "value": "T109E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095528ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481080, "uuid": "14c366dd-5439-4d68-b12c-3b3f0d24dcaf", "value": "3072:fuNaNpF4uVN++dkhnxMQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnmQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481080, "uuid": "e8026773-fcdf-44ac-b7ef-5b403208745f", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481080, "uuid": "ec3df5e9-ab7c-40ea-86d7-cb4f6c2b854e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481080, "uuid": "359d698f-7cc7-4b06-90e7-b18cbc309c51", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde37bab-610a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535948, "uuid": "10927e8d-433c-49f6-b672-40e42f41032a", "comment": "Malware payload (Mirai)", "value": "cfa9a7a71fd0931886f4ec21add0deea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535948, "uuid": "91b4b4ae-1a3b-46fd-8982-f5153b791e92", "comment": "Malware payload (Mirai)", "value": "b7d2d9df8fd2749fb6b2053d58058fa5cbc5c58c0d2ef06bc9c6914541316ca9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535948, "uuid": "b3db52f2-814c-40fe-9cd2-2ae06cc86d4b", "comment": "Malware payload (Mirai)", "value": "05a95a5cc970c2a71801d99f275298634ed763bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535948, "uuid": "bf4b1137-769a-4ea8-b241-57916a640d21", "comment": "Malware payload (Mirai)", "value": "cdc221afb81d9c28575af8fc714096bb3ecf6979dec6986440c780413347c452c8346c6b27d6318c1bcc17d5a73d6026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535948, "uuid": "510c244f-66c1-4a4b-8fef-b14b9db308b3", "value": "T1DEB3E85E6E218FBDF66CC6340BB34B20A79923D617F195C1E2ACD9005F6028D646FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535948, "uuid": "be990faa-1513-406e-b139-68226d8a5358", "value": "3072:A9Nk3FN3V731op8FSPCenIFjGqdlFDF5nb:A3k3bF7mKSsvtvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535948, "uuid": "dc582e44-c993-4ae2-99d5-e2ce544e6a49", "value": 109848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535948, "uuid": "4540e009-6cc5-4a81-8636-be6d9d858330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535948, "uuid": "5bf21840-f867-411d-a1fd-92d0e3720292", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae2e049-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494442, "uuid": "8465766b-b0f5-4a4a-b9c2-2aade179ddf9", "comment": "Malware payload", "value": "e2dc002cb0089108938b6eb210c048d1", "object_relation": "md5", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494442, "uuid": "86582cd5-1f84-4e38-91a6-f5e8d096f804", "comment": "Malware payload", "value": "b822f39521f043a07c15d8ca6c9ad49d963dfa877bdcedd6d0bfc73c03b8f1b7", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494442, "uuid": "17a9499c-34b2-4be8-96a7-5f515f6e05b1", "comment": "Malware payload", "value": "ce19709aa92d135d09ef5e37a82b8d9dec03dce0", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494442, "uuid": "e8620a1c-d5ae-4299-b9ba-fbc6604d5fa4", "comment": "Malware payload", "value": "69abc4b49b88580ef989ca6f612dd92908a56cfb63afb496858c6abd1b95d695ef1532f91033aa07d7399c9aba00941f", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494442, "uuid": "799e8874-9e10-438c-a39c-b4e98235869b", "value": "T1135301082AF486C8D71BAAB4936541DDAD8967F0F5523C4F1B1C19EC4AD436F0787A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494442, "uuid": "6a786fb9-4ad2-417b-8a9c-ac22741e3784", "value": "1536:yzwZZCpN66w+tkW1XMDy9qvBNuXm5/9G3Yq3+ZfSxSc:UieTw+l1XMDbvBf5/9GEdST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494442, "uuid": "2fb4d579-eb25-4a98-a56c-831199403bfd", "value": 62298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494442, "uuid": "f89b8616-061a-4ba7-b691-d600361f3304", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494442, "uuid": "e5a36a9e-ed17-485a-9979-77e2e393b629", "value": "b822f39521f043a07c15d8ca6c9ad49d963dfa877bdcedd6d0bfc73c03b8f1b7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69747c02-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528478, "uuid": "be2f5a21-7bc0-453d-b41e-a63161481adb", "comment": "Malware payload (Mirai)", "value": "211d13e634cd55e82ee97d35a2c1267a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528478, "uuid": "09b19732-b445-4d92-9ba9-8439e11fd27f", "comment": "Malware payload (Mirai)", "value": "b8dd7bc5cc0dc1bd5ebc96330a2e973f7b831d4950cd5434efd38e724517a644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528478, "uuid": "5bd2e080-ba04-4fd1-80b6-60b5fcedc1f0", "comment": "Malware payload (Mirai)", "value": "2bee99cf45e4a81e5cac229c223a474b0cc6f529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528478, "uuid": "8bdcf18e-820e-400e-ba37-c76193361826", "comment": "Malware payload (Mirai)", "value": "5595c5eb624134d8328c2dc934d8b4d99863914166d4c7d3286891992b738c39fff4be9f80604bb087eed4ef6265dacc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528478, "uuid": "5bef88da-95e8-4d8d-9924-406bd7b01cca", "value": "T18A734B21F9391927C0D5A17A21F74B23B5F643CE20A8861F3E710F9DBF615803A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528478, "uuid": "5a262c4a-797b-48da-a2ba-d2383c8d15f9", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTofT:7PQbrL7SYOBR2ofT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528478, "uuid": "16830f7a-66a9-496f-9ead-d60f2a94cd2f", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528478, "uuid": "88c19d3c-c94c-46c6-a900-768085168689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528478, "uuid": "88e8c21a-28c6-4282-86c7-216d6c11ea39", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48687c0d-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503941, "uuid": "e78cf394-eabb-4c1f-8373-faab7d6fce36", "comment": "Malware payload", "value": "1e11f53d6f3ea4dcbf5562d5e7e3770d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503941, "uuid": "a11f0de0-c4d0-41d5-8078-a5737d0b36b4", "comment": "Malware payload", "value": "b93312b9058c3302f47c1b12d200967f28cd1122a9da2592c99730e9eaa6a203", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503941, "uuid": "ce1c4117-dac1-48af-97e0-196b4942af3c", "comment": "Malware payload", "value": "bd424656c50030bc6622a04aab74619a8294f0bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503941, "uuid": "349070d3-a680-4c3a-a89a-1f692521035b", "comment": "Malware payload", "value": "c710e4c06282f65a17d250827df145f3984a198604c6ffedc4db1177e8c57f1a1eb4bba6109576ccc8639fff3e86ddf2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503941, "uuid": "c8aca55e-c6e7-49d9-9b2f-faa69bbfe8cc", "value": "T110112EBEF0953005CAFC8D9160768B45B888F7EB63504726D686B4F6ACC86247151B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503941, "uuid": "9777a76d-0b34-4875-8006-78cce794dd70", "value": "12:2TLTTL/tOTLTNIbkTLgUKhfTLITLITLVGDTLVLDjvTL5fTLXTLjkTL8Uv:2zozNIg9KhfooY1LXvZf3IPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503941, "uuid": "d5245f71-8e5a-4ec1-be63-ca29d7f5217a", "value": 862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503941, "uuid": "1bb4244a-932f-48c5-ad14-88006ade3395", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503941, "uuid": "6adf1021-c5d7-40e6-8bbd-bcbee3bcfab8", "value": "wgetproxy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5eb336-60db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515437, "uuid": "077083b4-7b72-4aea-9641-4361ecd090a2", "comment": "Malware payload (Mirai)", "value": "a6ff390f105fe8bd1837ebd1a42a72c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515437, "uuid": "f2e82eb1-377c-4a20-80a8-8e1e86cf70c8", "comment": "Malware payload (Mirai)", "value": "b9cd70105799d4ff8693c441992a256ee15bf66d49f9dd2b125496b7ddabba1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515437, "uuid": "ba0c2210-d9d9-436e-af0c-2d096d9872ee", "comment": "Malware payload (Mirai)", "value": "872c54fc75dbb02e4803f3dd15590a85738d4206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515437, "uuid": "96514034-3427-406e-b60e-8cb208d0841c", "comment": "Malware payload (Mirai)", "value": "28d7f6ad29fc60c2671ef12f163bc0dab3d6691af44791dc2ff38282f727ecc31a5a52457b2a673a3e702c64b8d85ee6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515437, "uuid": "38409b0a-9535-4cfb-b4f6-0a2b5c9ba832", "value": "T16AF33A76E6408E13C0D217B5B69B82523F2397A7D3E733055728ABB03F4369B0E67949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515437, "uuid": "08576101-4992-4243-8994-8cf57b362ec1", "value": "3072:bHq9Te0LYd//iaufKmTSh5hSNLhYyh9DLW0kM/9//mM8wkHOVKNt:j+giaufKm+hihYgFLWzM/9//mM8wkHOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515437, "uuid": "4c5aea96-4e61-49e6-a952-635229465df7", "value": 166454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515437, "uuid": "140ebc45-a41f-4d99-88d8-f714c14357e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515437, "uuid": "eaa4acc9-8ea0-479e-baef-d9a29e3da27b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e67cf4-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752514491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514491, "uuid": "d8e18b25-ccfd-48fc-bd50-6bc4fc806b79", "comment": "Malware payload (Mirai)", "value": "ee31c612e54f8648ad0ad3a0098de315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514491, "uuid": "79026dc5-6251-4a09-8973-06bfbe7a7ef0", "comment": "Malware payload (Mirai)", "value": "b9f849fdfb4983df52995c87a4444ec02a5bb516001e26f18aa6cd1ce685a155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514491, "uuid": "37b18c5e-dfcc-4953-8a06-2d18e2ee7cf8", "comment": "Malware payload (Mirai)", "value": "155b7db3b16b5b89a72ed1c8b1190e7c55253251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514491, "uuid": "b160aa87-d1e8-48c8-8dc8-ad5a6603a8a3", "comment": "Malware payload (Mirai)", "value": "47421fd979ddb55b0e3b5739107c5c1b3fe3a410c0598ca2f5e8ea2c52d0b0413f424b4434e5c794a316c8b8d1b8c900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514491, "uuid": "8a63a9cb-4280-4ba9-8af7-c97b216275f4", "value": "T1A8835B22F5391927C4D0A03621F38B17B6F647CA14A8871E7E710E9EBF255803B57EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514491, "uuid": "b0a2bce2-0f77-46f3-9a64-28da7e3f1fcb", "value": "1536:RComUxIersdXP6MNmF30805tFVYk5qcutUaufiVkwnul:uA3EbVYUqcnabRnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514491, "uuid": "fbf90d11-13d3-42b3-820b-207784d9b498", "value": 84880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514491, "uuid": "edd4c896-f20a-47d7-954b-5c96469d9aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514491, "uuid": "06930074-ccff-4f20-b030-bee637200d60", "value": "top1miku.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fb4ce1-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504413, "uuid": "7b30bf36-8ec4-41f5-b0c3-2b03f48c9165", "comment": "Malware payload (Mirai)", "value": "05516a429d0ec91734c9ea02b41b0e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504413, "uuid": "519447ca-49c7-4a06-86df-eac05153ef96", "comment": "Malware payload (Mirai)", "value": "bad258d045c59c0f2ccc8f7c1284e7bc9527768057833232579d9d0e8c309926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504413, "uuid": "3884cc21-38f9-4b06-8291-c18a01616e2c", "comment": "Malware payload (Mirai)", "value": "95c02be23299b7b69aba848223a74e6fffbe4993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504413, "uuid": "456e0294-5017-4298-87c6-8c3e30e69db5", "comment": "Malware payload (Mirai)", "value": "36c0e5b3b33f1abde9187645b82be2d9a383bd8f32ba96320063e6543405781248c6cff946e44e53513b821e2ffd78be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504413, "uuid": "db9d368e-1615-4092-b8fb-026c53946cbc", "value": "T175142A45EA418F03C4972BB9FADF424533239764D7EB73059928AFB43F8679A4F22502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504413, "uuid": "c7d2d533-f5c2-4511-8aaf-bfc073dae119", "value": "6144:xBzcQHnV/XwSoKn3S4kx+pZHaZhrGdawBxjWfOiPr2KgV/Bq7Rbv8:zzcQHV/XwSoTX+pZHaZxGdawnC2iPLAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504413, "uuid": "a8439805-4984-4399-b93c-734dbeea8f2e", "value": 206037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504413, "uuid": "9156c03e-ae7d-4c9b-b0ca-6982573fb7f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504413, "uuid": "f663a451-22e3-4985-8850-d91f54a3ef2c", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafb0053-60c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752508106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508106, "uuid": "0f709dd9-2e3a-478f-9df6-64a8c4f17e0c", "comment": "Malware payload (Mirai)", "value": "9489694b40c53cee5378e52b884fe5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508106, "uuid": "c721521f-e6fa-466a-9ee0-a04ad2d51113", "comment": "Malware payload (Mirai)", "value": "bae0f257798b4e1db9411115b46c5616170cab99cd21a82cf498a28926b53a84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508106, "uuid": "1e6b18d3-4ca0-4aed-b536-a5084df14c20", "comment": "Malware payload (Mirai)", "value": "c67c7c2fa93d65d5b47c98616ae5d9dc76f9d48e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508106, "uuid": "af38e0a4-2ec7-4b6d-879d-03111b2535de", "comment": "Malware payload (Mirai)", "value": "3e58f9fd641097eacc48961ce9b8d2e7453ac989f97ca55577abcfcdb62ab45d9999deee97eabecd1a20267fd9b686a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508106, "uuid": "3225a3fa-2249-4e24-9a93-abc6158e357e", "value": "T131E32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508106, "uuid": "6fa261a2-d5ba-4406-ba51-ac4bea937a5e", "value": "3072:FYvMxqixyDJAmUzdnJXu9WRtotmLFQTihv7X0clM/9h4b/kP:yvMxqixyDJAmUzySotmLFuiNX0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752508106, "uuid": "ca3a1221-22ae-4f4b-a24b-9f1aa7ca9e13", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752508106, "uuid": "f8779a96-66c5-4e9f-af66-4c8fc31937b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508106, "uuid": "14b2222c-20b0-40be-89f7-53fff63c7d84", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d22b943-60ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752495439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495439, "uuid": "5a2bfeb0-7fb0-41de-bc1c-147297b571a2", "comment": "Malware payload (Formbook)", "value": "0043863384843eef317b7c998cc4e754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495439, "uuid": "da75e67c-d343-41ce-9f65-31152fa238ac", "comment": "Malware payload (Formbook)", "value": "bae9c509299e16792064c4219babb32f5acaf456a067228c77320ae69c678d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495439, "uuid": "9c709cc8-6ecf-48fd-9fab-11c2253f6386", "comment": "Malware payload (Formbook)", "value": "607cf3ec989142ca79e078c5238b858586babfb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495439, "uuid": "fae1d635-80cb-4090-8f15-887ee4271707", "comment": "Malware payload (Formbook)", "value": "830d8891495b02cf5497dfedf993be83c2ff4ffbb777903226d9918c9b31b54e1ebd950b6354d5ad24100f40ec3dcaed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495439, "uuid": "568a12d8-fb76-49e9-b8e9-51a805f96558", "value": "T1D7F40105A536DD02C4960BB46722EDB0137EAD9CF814E2136EDABDDB737778124C0A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495439, "uuid": "8f6b4757-41cc-4e88-a304-940caebba56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495439, "uuid": "e4c0b8b4-dec7-4cea-872a-6de6b0b32596", "value": "12288:jr1/3plPNyHGFzR+Nbt3G5uTzJBEgAKk+TgY+spjyEexyvsRHKBO1oeK:HF5lPNymJRMM0NBJAKdRRb8oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495439, "uuid": "3eb918a2-9f4a-4141-a30c-438ec277aa7a", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495439, "uuid": "f3f2c13a-1c7e-4ffb-bc1d-bdde4d158c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495439, "uuid": "d9f74ff1-9eb9-4430-b8d6-88e62c8647c3", "value": "SecuriteInfo.com.Trojan.PackedNET.3367.19506.22702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80608c8-6046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752451810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451810, "uuid": "7b132ec9-e94e-4a9a-95b9-263c847a5dc7", "comment": "Malware payload (Mirai)", "value": "ce4a6336dbb62fc10410df262f8654f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451810, "uuid": "8281b336-dd6e-4572-ba9c-6fa8b843b3b4", "comment": "Malware payload (Mirai)", "value": "bb81dfd70f6753b7142b53f565f85273be0561e66c1bfef8e80de95066e681fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451810, "uuid": "4d7d996f-617d-4f99-bee3-da7a2336344f", "comment": "Malware payload (Mirai)", "value": "1d4730cfd694c5f4db967b47dc6bd35dc52ede35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451810, "uuid": "aac61e3f-9353-4dda-9402-8c641ee126c2", "comment": "Malware payload (Mirai)", "value": "87862001c318be1b74ea40a37fccbd3f5102e900750dcb08a37bb7e78fd325651fee87389cef7df2bd451fcbb228bae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451810, "uuid": "7879a683-60ae-40cd-8c44-3f84d8469107", "value": "T153B3E70E6E219FBEF66CC63547B34B20975923D617E195C1E2ACD9005F6028E246FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451810, "uuid": "4509a3df-ea77-4e13-81d8-9959102bee63", "value": "1536:Y5wQ4C555Xmhs/I0zAq9NdIBoZZCyH2iNL7zTJW2izjUJNcneFky74WcC72:UhdtXVP9NdIBoZZjlvJW2izj8Nwy7cCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451810, "uuid": "59f4525f-46eb-4995-8796-4e4874b21317", "value": 109828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451810, "uuid": "256c37fb-21fd-4814-ab26-52ec2b956168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451810, "uuid": "8b1a8fe2-97ec-4640-858f-222a4d2db2e3", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1185dff4-60fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528760, "uuid": "0bb260eb-2831-4848-9c7b-095215f8c357", "comment": "Malware payload (Mirai)", "value": "727fdc8751c39aff9eb7ee2d63462644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528760, "uuid": "3dbec1c9-c625-4350-8dff-74f10d047185", "comment": "Malware payload (Mirai)", "value": "bc8713cf16bea845248717d8efb828e099fe64393e24a2601a88dcc67a48a620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528760, "uuid": "93f01c91-f54e-4f81-a6a2-e3776dc31dba", "comment": "Malware payload (Mirai)", "value": "91a24abc0fa6f5ffd76bf5521783787e445aadfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528760, "uuid": "c4eee7a5-9e7c-4ad4-9686-56bafaf0f69b", "comment": "Malware payload (Mirai)", "value": "11b822138fbcbdbc16c9145be3d53c2521f6339103241b464a557979bc1f94cdb180760190b1c084346c4916e4e37c5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528760, "uuid": "9878609e-eb2e-4b1e-82ee-b9b79b412820", "value": "T1A5236BA3E8262D28D1DA84B0B4585F7A1F63D2C5D2835FAB5172C2758013EDEF819EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528760, "uuid": "fbf9cb40-5b00-43e4-b14a-ab1b473672ad", "value": "768:HcjSK1YauA+WqQJr/DX83KT5/WakRoP4nK9CJBMZWfshGCmwPI:LyuA+WnJDqKT5/RkGPX9CJEhl/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528760, "uuid": "fe02e370-ddc2-431c-b00a-40ecbdee1a71", "value": 46392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528760, "uuid": "659a5cc6-0b94-4482-8fde-1c64b6d10cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528760, "uuid": "82b4a921-72a4-4d78-ab1d-5bc9f6c457f7", "value": "fsociety.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba699c2a-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503703, "uuid": "361fdfe3-a906-4080-8b75-79f9f67ee348", "comment": "Malware payload (Gafgyt)", "value": "1f0721df9e63003bb6078b9dfdcc96bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503703, "uuid": "226690fb-959f-4ceb-acc0-52c800eea6a1", "comment": "Malware payload (Gafgyt)", "value": "bce81eaac34bd057c225c67e48e86ec4d4328f1e76e5dfc7bad8a39d3104c3fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503703, "uuid": "70b7daec-406b-4672-aee2-37a714a17528", "comment": "Malware payload (Gafgyt)", "value": "666b45f0cb47322090410b01a1908e3d877e4d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503703, "uuid": "9ccec0f4-1340-4a15-846d-0bd9aab2010b", "comment": "Malware payload (Gafgyt)", "value": "7a239c0c22b8e6be149c0892d981d9dc562dc2d32ae5e97814b48ee45d94e7ca21f0601f1ab33ae3a63a98979cd7459d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503703, "uuid": "343d9933-09ff-4bba-b3cc-b2ad363eab43", "value": "T17CA3F967B950971AC9C2163BFA0D9245739307FDD2DEB2129B1FDF2827869670E3E840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503703, "uuid": "1bd4f034-ac4d-4d58-b2e1-83bc3fcf773b", "value": "1536:W4kn0fGubV2NzS1thtjbUaFOdCHJFppi0BRoNJsi3e50k/QYHVT3Hf:7fGubV2NuvhtjbUaFPRoNF3efI+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503703, "uuid": "17e2991b-b7b2-4aca-8521-c51f7ab49046", "value": 100980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503703, "uuid": "52cbf24d-a29b-4098-8a70-9d552f4c5411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503703, "uuid": "1975a461-00ea-42bd-bdff-14dfd831aa47", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a05c79-6049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1752452796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452796, "uuid": "10beda3e-6091-441a-b435-93680e6a8f39", "comment": "Malware payload (Hajime)", "value": "07c0b3ea455147146dd5e724a9701feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452796, "uuid": "2b32998a-a29a-4935-ac5c-5d3249e03d4a", "comment": "Malware payload (Hajime)", "value": "bd38841d57bdde3f865bc64040335527d7866b4e0caa6bd211202209e1390493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452796, "uuid": "d37df989-750b-40fa-a2bf-173b2582882e", "comment": "Malware payload (Hajime)", "value": "0476688bf8b8b3279b908378b3da62896db521f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452796, "uuid": "1ace63c8-f072-4042-9e3b-e6e24a1ece68", "comment": "Malware payload (Hajime)", "value": "7b3428dc238eae07d709494f8d19f397a6455e8bf0303a668d883aa3ad919c2d08f606a285d531e74ac820f59798688e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452796, "uuid": "e14fb5c6-9989-460e-84ec-ca523875e8d3", "value": "T18D73121623A924A5D63145F1E3FD2FC8EA4D6B688FF1EC24AC117C98E93336D2CD5518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452796, "uuid": "d43d67d5-909c-48f2-b63e-b8b956900ad9", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J2:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452796, "uuid": "5d74f067-594e-4ae1-8471-a67819c714e7", "value": 78942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452796, "uuid": "631e730a-fd40-4081-84af-b7e2928b42a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452796, "uuid": "fbce7917-27e0-49e0-b7c3-e151e97f16f1", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe1ffd4-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517805, "uuid": "18663dd1-8b29-4173-92d6-198deffbe6c9", "comment": "Malware payload", "value": "cb9a6721d083f4b0827b42ca04bca47b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517805, "uuid": "e5890d17-6a76-42b8-9ff0-9857f6957813", "comment": "Malware payload", "value": "bd3efc3d9062c212d364e013088ec9a417dfa598d2264ee4b8049f9474c62e56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517805, "uuid": "8b68e02e-e4a1-4d59-8b0c-d8820f16c905", "comment": "Malware payload", "value": "a88a18a5ef4f496fb1dc07ca00098de9a90955fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517805, "uuid": "bd81b7ef-c18a-4457-b227-f97d88dd985c", "comment": "Malware payload", "value": "a8524a78a3f7cdc8a6cdd8b4824de22009dbcd20b325a498a6e9b9f6108fc18b2ea9b4fede43174adb0d27cd68ecca0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517805, "uuid": "042df587-3764-47b2-98db-41014abbf926", "value": "T1BAE412117F152032C9D21AF0A8B747B4EB914CD610B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517805, "uuid": "a5f16de7-e6d7-4a47-9262-3bbf4beb99e1", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517805, "uuid": "00a32555-b88b-4fc6-a82e-280791fd757d", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517805, "uuid": "c27da0b3-a713-4e13-8d1a-640ac7621088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517805, "uuid": "76fe36b0-243d-4d8c-9bcd-da6e914eca23", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e8f30c-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485114, "uuid": "a5ce8c96-eaa8-480b-b398-e20d3c8586ee", "comment": "Malware payload (Mirai)", "value": "98b6c45de809615d42fc1c731b5fb3af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485114, "uuid": "d3c2e2d0-27ce-41ee-b7e4-ea2b71c9d9aa", "comment": "Malware payload (Mirai)", "value": "bd8b6e34d1460222baf798810bf9889564010634d0071d60f55e56c3a0e318d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485114, "uuid": "6f5414fd-4df5-4823-b965-551dcc4b1192", "comment": "Malware payload (Mirai)", "value": "e92dad451536f87a88b853d40df6abc3375260fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485114, "uuid": "55bb89ca-de7a-42e9-88da-d83a6cd94d0d", "comment": "Malware payload (Mirai)", "value": "7edc988bbb90f140a6a6dd05322c812f8ccb09ab40a17729c0562488b5820a00220e5a9fb493dd998c157463c2ceb08c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485114, "uuid": "2bcc15e4-3d08-420d-8130-5ff725321564", "value": "T13AB2E162A1863E72D760713AB97CCA0057BB97F8A4F772713524B7AC4BD2C4724B814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485114, "uuid": "3f77e42e-192d-4baf-bcd9-d4312a8cd9d9", "value": "384:MZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdvVhymdGUop5hKi:nX1De9kONQG5xD+jHMDzuvVs3UozYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485114, "uuid": "fffa9d4e-104b-4885-b4ff-9e743622e89b", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485114, "uuid": "a8eb3719-350e-4178-8bfb-b4ca3151ceee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485114, "uuid": "4635e47c-c83c-46f0-abc2-3c6732dd7bb1", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e741d525-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513656, "uuid": "dc2e41fb-4cc3-469e-90da-477e3f9e3775", "comment": "Malware payload (Mirai)", "value": "b082df8bcbb163ca94173192b211833f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513656, "uuid": "7315bf05-d30a-40ac-a095-af647dca3521", "comment": "Malware payload (Mirai)", "value": "bde9c17a42a2070c9cfdc102d4b29d941b2d46020195a5b3af1803d7b95825dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513656, "uuid": "f23f5386-63f6-4719-88e6-4e91ce7d6327", "comment": "Malware payload (Mirai)", "value": "9cd9a6bc969980516f01a68762248d5c33cc22ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513656, "uuid": "e7ae60d5-bfc3-45ee-b0e0-a67c307ad71c", "comment": "Malware payload (Mirai)", "value": "dfc5cbd87786c3d3e50ff2608a32782095af4f4d4f7f9f6c9cd8aa5e556d8462ab481124060e9085a58a532e2c6f9508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513656, "uuid": "13a921d0-dd4e-409d-a6cc-01ef77c9029b", "value": "T17392D0300127BCE2C7212833A63FC602CA5917FEC6F6317A235459A8D79564F2EB558E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513656, "uuid": "13bb6396-0f7a-4c73-9106-7f2864368ada", "value": "384:k93CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8KhymdGUop5htjK:QCyEPgoKRwZGx04nIns0t2Vs3UozLjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513656, "uuid": "28703dc5-7f66-456a-9985-ff7df5edb67a", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513656, "uuid": "51ecfa0a-ea72-44db-b63d-9949c2bfbaf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513656, "uuid": "232cfa25-a27d-4b88-af94-6018e365f5e1", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c09e34-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503688, "uuid": "8dd5e1fd-1214-49a9-b342-1a1fa9fd1b5e", "comment": "Malware payload (Gafgyt)", "value": "87ee8c1fb3280f3e24eed1e2c74b36d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503688, "uuid": "bce8b223-7836-40d4-8ea2-e80ff0d085fe", "comment": "Malware payload (Gafgyt)", "value": "bdfb0cdfde548220d59b3a6e8aea604752d5826008f7926ec0fc8f25dc3cd45e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503688, "uuid": "a4ad27ec-fb39-4c99-a43d-500cf0d2dd9a", "comment": "Malware payload (Gafgyt)", "value": "abb5a998c488bd8b048c8582fb33f041332513c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503688, "uuid": "da0cde1d-caf1-482d-8978-33b5ee3b360d", "comment": "Malware payload (Gafgyt)", "value": "8abe4f17ae441a9eed7f3863d01c6d5b74763b8701fc810cfefad336f561f1ed6fcc16d481b2949e0210e7e59b192dda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503688, "uuid": "a73b4a84-82ee-45a2-a605-6de7c0737b22", "value": "T1C2B3E8137B200F6BD47BDE374ABD4A4124CC4A8B67953BF67638CA65BA4C84785A3C34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503688, "uuid": "772959b1-154e-484a-af80-76ac3c9a535f", "value": "1536:ciUpoyXex1gj31UGke/ssdRPzciGyEZTMlvzDxHqNRo1tVw4mVT3vRIB/8:NUZux1s1UkrG9yvEgtlYvmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503688, "uuid": "5048d123-16f3-40c9-b58f-2ac0355a2c4a", "value": 114264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503688, "uuid": "e91a0573-61b4-4f43-b37b-2e7029338b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503688, "uuid": "ff485f29-d083-4cb5-8c9e-d1f2384444f3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54691b88-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485063, "uuid": "ca274d69-b82a-4374-b68f-923476ff35d7", "comment": "Malware payload (Mirai)", "value": "3fd979688e46a1aaa0ade32f4936cf58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485063, "uuid": "5fbdfd28-a007-44e6-8d02-ed685468a078", "comment": "Malware payload (Mirai)", "value": "be0351be0f31a241afa95d41bef9c5a49f4f1b4116890dcbfaca4d90a982faa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485063, "uuid": "d65adf21-5185-4d8f-9ea4-654856577fcd", "comment": "Malware payload (Mirai)", "value": "2f2973e97a282c115212f5b914f61be11662bf03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485063, "uuid": "0fb251f1-f2d2-48d0-8be3-19dfaa5dd85b", "comment": "Malware payload (Mirai)", "value": "fd503fa00436c3365418e84e5f40aa5e5876b1a7682a322a1700654a2ee4a1e8bab8b6dd162855348ab68d08ac589354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485063, "uuid": "10020a2f-71d9-47ae-b700-2335f00c942e", "value": "T1E5533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485063, "uuid": "d8550e27-665c-4e2f-a530-bcdc93eeb989", "value": "768:me4gpsM204GEkRbjveXyonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozjE7Pp:mo3EkRbDFDiDHIFy1X48B2SEzNfAuJlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485063, "uuid": "6d3e2ec6-98c3-44d2-bbeb-7dc91652e5bc", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485063, "uuid": "a8a63213-6cf6-4ad6-854b-8f6d7edb6faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485063, "uuid": "0a6c35c2-726c-44ac-b87d-80f92800ef96", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfeaad5-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485103, "uuid": "99684a56-86a6-4d56-a230-2bdda25bdaad", "comment": "Malware payload (Mirai)", "value": "8f3b33700f586682683720cf48d02212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485103, "uuid": "67fbb2c2-6cef-4b7d-b43d-00090af02f4d", "comment": "Malware payload (Mirai)", "value": "be4d4f075beab4a4b055eb6c529a97d0d134bf77a2e819fd0e6915215b430366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485103, "uuid": "bd589c3f-ca7c-48ea-ba2b-a7c9b935cb5c", "comment": "Malware payload (Mirai)", "value": "1cb4b4286d0ee126d2dab52483fcb444c8582625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485103, "uuid": "ca56d564-4242-4512-929a-ad29303b9ed2", "comment": "Malware payload (Mirai)", "value": "42c680a3604f153d4d29f44afee48bfe0c109370e58a120d1cd8587d7e64a7b72731a1014fa8a81b818910732111e926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485103, "uuid": "24b925ab-bfcd-4bf7-9816-f0a75c8b12aa", "value": "T17CF2E1553249A0B7C1F4ADB3C87086E12E7B01B6D5E933A11FED8388E146612997AED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485103, "uuid": "b55c0e61-75e1-4c2a-b125-ffe6c323bccd", "value": "768:7rFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GJQkVdNs3Uozr:7/eRSnQjMgVuP7qtqxgtAnwdQzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485103, "uuid": "0c501fc0-af3d-4de0-81c6-c35da09f71bc", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485103, "uuid": "70aa9dc9-6866-4873-b5e7-7d5cca614324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485103, "uuid": "e561dc1c-6154-44d9-90e3-dfc41debbf8a", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b871721-60a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752493343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493343, "uuid": "1ed9dd01-a37a-4ff2-ac9f-3fe2c49a6eca", "comment": "Malware payload", "value": "a02af9f2da7cc23ceb873ce6a4fe2ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493343, "uuid": "f615cc59-7059-4769-a570-ab219ec722d1", "comment": "Malware payload", "value": "be8effa52a3592c3f37258db79adb122db280a497ef169538ca371f51bf53403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493343, "uuid": "a428b39d-22ff-48bb-a890-5fee346acde9", "comment": "Malware payload", "value": "2d7bbc4a391193612a0a534258c34fd706ea28ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752493343, "uuid": "9e5270a5-ba8d-4b2a-8181-99b10d125af7", "comment": "Malware payload", "value": "8dc408ac71677c0d9ea2d4e9192dca3109fab90c11f44618630e13380b1aeac681d10d09142a5cc5f22be32c97fda58e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493343, "uuid": "32fee594-8cc3-44f7-ad3f-41032263d391", "value": "T133A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493343, "uuid": "254c2690-74e2-4e5e-9edd-cbc62d4f9f72", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752493343, "uuid": "0c85852e-00d6-470e-bd8b-f5b71c237d22", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752493343, "uuid": "738a7d10-264f-4ebc-9f54-a52d48a9a049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752493343, "uuid": "2a7f87e0-d6dd-4fa4-b187-ae4c63001f72", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89277ad9-60d7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513928, "uuid": "3d43ed16-7552-46ac-b094-be10c65c1f10", "comment": "Malware payload (Mirai)", "value": "ef00bfb7cf55fd31f6095a1943dd86f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513928, "uuid": "532ddd67-a1da-4168-836c-e257bc9e972d", "comment": "Malware payload (Mirai)", "value": "bef7db398e3b65547f52610d9c23c948528d8bda12152dd833237c6d293c285f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513928, "uuid": "1d9bfaae-8c9a-4fed-a414-53277145b4e5", "comment": "Malware payload (Mirai)", "value": "b674c4182fdb1db3db0943cacc5da7aed15bebf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513928, "uuid": "11fd0666-4714-4a5c-a55e-1e28e5793d06", "comment": "Malware payload (Mirai)", "value": "e530407569e71fee56fe13d09eb48d2c78a0cbf3fbe3796f813362f30eb2287575397e025bf9b4f871683f35be364a22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513928, "uuid": "99c85179-43d1-418a-ab3b-a71fab65dbd5", "value": "T1A8E319D7F801DDBDF80AE73748174809B630B7A248925A373257397BED3A1991533E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513928, "uuid": "6caf0cfc-8d4c-4f0b-9820-2f44a44a7299", "value": "3072:QWxJvdnmprRFzDZJTRyXAlHob4JJEoVGjbiILt9My7LZc:rxJvyntJTRyqHouJETLAy7Vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513928, "uuid": "55af1b38-69d1-4667-bf09-c19cf128c0fa", "value": 155168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513928, "uuid": "545821a2-77dd-416b-aa80-c43a90855db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513928, "uuid": "76a22738-167e-435a-bf56-d3fd861b1c73", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbba42c8-60f1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752525206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525206, "uuid": "9ec8b861-4c2c-45da-863f-8a28d79e14ae", "comment": "Malware payload", "value": "f09a763a199d3f35abe9c7d57bbcc405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525206, "uuid": "12b52e99-65d7-4b3a-97c0-e78a6ac8a23f", "comment": "Malware payload", "value": "beffc080a7b23bab486a11ac588ff44a261f94e03505eca2e810d92269e4b9f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525206, "uuid": "49a5ad0a-a8ef-4d7f-ba93-5944e7d282ae", "comment": "Malware payload", "value": "fe342fa204ec74a37e12fd3d7f7ea11d709c44a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752525206, "uuid": "78719fd7-59f6-4e55-b65b-0ee6ddffbd46", "comment": "Malware payload", "value": "087f42bdc1bd8ed1f5970e00ed4ad0be1225b3e97633aefa6071cb3a300cf82f181bc406961c7cc73b1d5eef845cf96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525206, "uuid": "a530e433-b1f0-4d8e-9cfd-c8a68cbcd318", "value": "T147B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525206, "uuid": "2c0cac7e-fdd4-4d7c-9bd7-f12e99556b52", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752525206, "uuid": "0ff676dc-03ee-4a7b-9894-b298f227d874", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752525206, "uuid": "e9574f2b-9632-487a-b96c-b42581137dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752525206, "uuid": "1ef1b6a3-9e1c-4eb1-af54-60919271e975", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e2a4d7-60a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492333, "uuid": "cba6d7df-476e-434d-a210-4925e4fed67f", "comment": "Malware payload (Mirai)", "value": "482d30365a6f5ebad52a52e53a2e6808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492333, "uuid": "ae49f492-fbbc-4641-870b-192120f8584d", "comment": "Malware payload (Mirai)", "value": "bfb9572d8778f6a8fb2a3b6ef9f35ccf5903b3ae7a5d7e518c50b1a7ce26d640", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492333, "uuid": "406a8113-37f9-4c69-adbc-a0ca11399ac2", "comment": "Malware payload (Mirai)", "value": "59d75d995fc83cab74ac4c09447758a5360d44ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492333, "uuid": "5fb4888f-0f04-4b3b-8a4f-0eb3ef2f387c", "comment": "Malware payload (Mirai)", "value": "36f1055049d10152ae9e32b75a75cae4f4d3fbed16bab41cbab4cccc1ba2422dad88d1e67512bf6918fef176d94b41f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492333, "uuid": "86407efd-0b76-439d-9b6a-95e10358b2e0", "value": "T15A733B46FD824A23C6C11277F71E028E3B2A53E5E2DE32039E25AF6133C795B0D6AD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492333, "uuid": "f7590645-01c6-434d-be82-b0165856a62d", "value": "1536:ELZbcYoaYS6q0ZuW/1BAy0bJrojLFa1DT3o4hAht4VZvn04:ELxcYgAygs41DBhIIn04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492333, "uuid": "b9374171-b7f7-47b1-bbb1-6dc0926de74c", "value": 75336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492333, "uuid": "c2cbb709-b67c-425b-a93e-8f62f2ef2439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492333, "uuid": "5bf96c6b-7562-41bb-8108-57d1beeccf81", "value": "top1miku.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7d76d2-60af-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752496893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496893, "uuid": "0b538acc-84f9-444d-84d7-55f144422a38", "comment": "Malware payload (Mirai)", "value": "9986a1d5182965a99f6966e902bb5e2f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496893, "uuid": "9c30540e-82d6-44fd-a737-753d8841c255", "comment": "Malware payload (Mirai)", "value": "c016060c3ec2de7f915465962cb5c0313f2e3cf8a886cad74d4feaf9f42f54a6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496893, "uuid": "7c3bac71-7475-439c-95f3-9d34d32ce209", "comment": "Malware payload (Mirai)", "value": "3d5836a1a1f2c9674b7408af4e20e65af9e4c515", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752496893, "uuid": "a07c5749-f25f-473f-aadc-bfea2bd92441", "comment": "Malware payload (Mirai)", "value": "e6a930efee7df8c3a36a854c2b03b35f6a54425f13f60991c250c976e56da4008cbe2bf598b2555e449f320ce07f34bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496893, "uuid": "60d09417-bf30-411e-87d9-38ad62713f0c", "value": "T1D5213BFA0098A0241488AB90705789396DDBFBE030311BF9957FE4F7A5CB9A47301F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496893, "uuid": "20f7e0f0-2790-482d-8c1d-c678edf4d8de", "value": "24:s3MYMKNIrM/KTMs50F5MKM06MsM8lMc0MUgMsHA:s3MYMjM/CMs507MKM06MsM8lMc0MbMsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752496893, "uuid": "49983176-79fa-4b9c-8f3d-ca5dbe5b5614", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752496893, "uuid": "4f07e706-880e-4c43-b29b-2a4b2559ed22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752496893, "uuid": "6e96068f-1bf5-4975-b017-b66c2e065b07", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ddac7f-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479990, "uuid": "235b8e5e-22f7-40a6-a127-17ad12f682b7", "comment": "Malware payload (Mirai)", "value": "1cbde83d453f527f052488ee79743376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479990, "uuid": "99560b6a-a587-45db-9ea2-68ce50caded9", "comment": "Malware payload (Mirai)", "value": "c02160f8d032f14899c38d499121cfc735f88f944dc86f1c43625c2decf599e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479990, "uuid": "331fc6f0-4b22-4b1a-9e48-1795f433166e", "comment": "Malware payload (Mirai)", "value": "1df07d487f2088e88af6c6d7a7ad3452d0d334cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479990, "uuid": "652e2089-ba03-4138-97e6-6f24e35117f2", "comment": "Malware payload (Mirai)", "value": "2f95d9f18435dc6eb2acd6916330ae23fe28cbb52892613f693b0caf592ff3d2ad9143a14e7e298fff3ddab9b7b7d006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479990, "uuid": "3d1a0390-54ac-4a3c-a95c-6ad7a17d1972", "value": "T1FE03E1F3528B59F7F51616710B669680BA077C0B36562BF644CE38EBC4BAD643D342B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479990, "uuid": "1ca2f79c-d644-45de-b7e2-d788518df947", "value": "768:Cmx1C/OapSOtApkdXx9G2JG4ofN7DntEeeorIHetAFwnifz6v6drDXJAViSrEx08:CeC/OQSOgkVxA2xoFnOoie6unifk6drZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479990, "uuid": "2161ddac-00dc-4de8-b9f8-4ec4009e7b6d", "value": 40588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479990, "uuid": "37b82d6c-5ce5-44ce-92a5-a490871bd568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479990, "uuid": "68d1d5f0-c8ac-4dbf-87a9-9509d45f2cad", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fe9cab-60da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515072, "uuid": "a015e418-fefe-4743-a92e-32dc950f97ed", "comment": "Malware payload (Mirai)", "value": "736165d8c327c6df493b9078e536070c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515072, "uuid": "b734862f-9c8c-4e9f-af97-7f14a0d59c2e", "comment": "Malware payload (Mirai)", "value": "c03ffaadd807c770d621afa87c7d0dcf52d26bcb4520eba4ee726a241524b0f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515072, "uuid": "17bd756b-46da-4e1b-8a71-b3110791e859", "comment": "Malware payload (Mirai)", "value": "0ec649c007a3e2e11fba0a5cd96a9754db356a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515072, "uuid": "8ec14938-02d5-44cc-997a-cff5232c55cd", "comment": "Malware payload (Mirai)", "value": "09d20f8e7e8aea841e385a26ba9c55b08cc74f44aa04b406fd97e35434280de25600197ee4ca94f288435fedfac221ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515072, "uuid": "ac771ad1-4b2a-4e15-8390-25d3ee797a8c", "value": "T1D7639E72E4251998D18601B470A4CF394B23DAC05743AFF626BA87B6A007DEDF909FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515072, "uuid": "8cfe06dd-2f04-411f-bef2-331c6b0178dc", "value": "1536:v/LgT9G5q3THFE2OhQdk5EK7rEUsSqmCW5Xp+a1UQy:vjgTogjHhKDr7ESqmbpLBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515072, "uuid": "81444842-2862-4602-af4b-e495a7947f63", "value": 72640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515072, "uuid": "d5529487-37bd-4801-b90f-5818ee4e28f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515072, "uuid": "4bd6ce47-aa2a-45ae-b971-e5176e07e78e", "value": "top1miku.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958c4c91-60f5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1752526834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526834, "uuid": "8ea1402a-4c11-43c1-bc02-fb814ce1dea4", "comment": "Malware payload (PureLogsStealer)", "value": "4df89e434dd5fc8eb2f104cde23a5752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526834, "uuid": "7c9fe26a-4740-462d-b305-4e6567fc97fd", "comment": "Malware payload (PureLogsStealer)", "value": "c0417ada92ff95da8c88113088bb2b1e0a9d9a443b43627f852a0d3fc2ea19cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526834, "uuid": "2ffa04e5-ee6e-4e50-b863-492e36e07706", "comment": "Malware payload (PureLogsStealer)", "value": "18c041b8f7caff4bcef05fabe2423e4efe979ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752526834, "uuid": "9c1cf3cd-ca8a-4cf2-9d7d-3f17746ced9d", "comment": "Malware payload (PureLogsStealer)", "value": "ce47d0655a7b7ff5e99bc5e7b30451b9a0006693e35f76d4f5f776e66315556a6d638c586fd581aca3eadfe76a7a41b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526834, "uuid": "8714ec93-4bb7-4f3a-9f57-57c2729ced3f", "value": "T1F01733513ED1ECE3E834213A15A08978FB74F10599E84EC7DB600DBC9EF63D9562B90A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526834, "uuid": "b4d6591d-694e-4e63-a6ab-c95f2cb62884", "value": "15d53913ba494ccc61512607f46fddf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526834, "uuid": "edff5be9-a24a-4625-b033-610750358eeb", "value": "393216:WKG5B4L+vEO5C18uM9qCofElZRZshBCX84sv1AM5WVmieBRErD4v:tG5B4WC1D0qy5WvBcBeBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752526834, "uuid": "fcec5509-2ddb-48d3-bc38-81144f669ced", "value": 19957237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752526834, "uuid": "f69ab68a-e35e-4f3c-8c9d-19a44afc84d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752526834, "uuid": "3ca156d7-8bc2-45ee-9bea-c7e41c31fb8b", "value": "4df89e434dd5fc8eb2f104cde23a5752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2226a3-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528479, "uuid": "88bafc79-2914-48c3-bc78-bc54b0c5784a", "comment": "Malware payload (Mirai)", "value": "ce336fe29a63479c2150035270fee58d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528479, "uuid": "069d655e-fbe9-40b8-857b-fcf59703d15c", "comment": "Malware payload (Mirai)", "value": "c0e6bac04abc4c5f62f2a60797fba8006dc0d433b9e54963936f1427285f15d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528479, "uuid": "12025cd7-73d0-41dc-a7a6-37e1a46b504d", "comment": "Malware payload (Mirai)", "value": "d5f14ece4f0bd0db5b1aa277683797d727f7098f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528479, "uuid": "779097da-8bc7-44c1-a1f1-166c6bdc223d", "comment": "Malware payload (Mirai)", "value": "1f2796182bf6e9233edc68c9847003781ffe0b1ba409ed73f0fbf93baf07bbff414d1e9282ace3a4665c11dde64a1d21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528479, "uuid": "c3c2c4b6-b987-47ca-8be5-ad97c614ec9d", "value": "T1ABF2E165224DA47781F4AD72CAB047E13E3A00B6D4E933A15FF9824CD546213A87FEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528479, "uuid": "4bfc4550-48bb-45e2-84b2-c5f7a3994d64", "value": "768:qrFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GjpBBVs3UozH:q/eRSnQjMgVuP7qtqxgtAyGzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528479, "uuid": "7f090df0-8df7-4f40-990d-44e2a00670dc", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528479, "uuid": "25cdd79d-94af-4cfc-8ec4-55af6aa8a9b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528479, "uuid": "892245db-7844-431c-8ccb-5303a5f78cf2", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201bca76-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494854, "uuid": "90619676-5c49-4b01-9c8c-452fde8e46ae", "comment": "Malware payload", "value": "dceaad250210ae832dc87df5864e2160", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494854, "uuid": "22e47fed-fee3-4263-9f57-0fc529633cc1", "comment": "Malware payload", "value": "c120cc26a84044c0b72b2cb0fec760fb73b9c6631a36c3569d6a2719130e8ab8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494854, "uuid": "8b01a7cd-1b69-4710-a856-c84803e1e43e", "comment": "Malware payload", "value": "a15c3e58e163197b1a816a9c9ac153fc27e47274", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494854, "uuid": "f17c72e6-5e11-4e1f-972b-0cc450c2fdd8", "comment": "Malware payload", "value": "1bf1ad138cc09f94d11ff20fae9a05a263c6668b468dec829eef8bca56ba9dcd9a3d05e1afedc7012df1e3f617a9a83a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494854, "uuid": "20a5a123-a5de-4aef-a0fa-b82c8538dcfe", "value": "T153E0C0105B482134420A30C7271A840CA63E231E06428CEFF0C98A184E04F4336EC733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494854, "uuid": "fb1156f1-558e-49c1-a4df-bfad83cd3ea0", "value": "6:ZU0/XA+TLMRrHPXO9nslT+MyvhOFfafZfr3B4lZ3uOMK6huhsmev:1Q+TLMRjXOZsN+MyvufG3B4n3gJBmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494854, "uuid": "0d245cb1-f510-4378-9aef-04d87eeec8bc", "value": 337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494854, "uuid": "5f5020fd-af7e-4dc9-a855-e3e2409bc1cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494854, "uuid": "eac62973-ae50-4835-a7ab-4158b8f716f9", "value": "aduna", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8657bb8d-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478275, "uuid": "b3f6e73c-2a14-4f5b-82e1-3385f710b8f6", "comment": "Malware payload (Mirai)", "value": "9b6deada551f0276123ca68d0167b72c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478275, "uuid": "00dda29a-eef6-4947-bb9d-6084a512de55", "comment": "Malware payload (Mirai)", "value": "c22132fbd8dc0601d62d33adecd8d0faf16ead35cd32fe0f55d5a675767d6b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478275, "uuid": "ac597db3-ab29-41c9-8ac6-4a04faec01db", "comment": "Malware payload (Mirai)", "value": "4f5287febe0af1bce4c9cdb905e8608eab426e0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478275, "uuid": "403bcfa4-4089-4f01-b9cb-6416b0238e32", "comment": "Malware payload (Mirai)", "value": "a4df4c14f55d71a4c73d9609084d7b58a1ec83379765df99c823a08f7a1b2fe06aefdefb7c78ff8a6b44bb24bb01d381", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478275, "uuid": "80fb24b0-e82d-4cb5-9e3c-4c743e2d90c5", "value": "T126937CC0B783D4F6FD1705B22136E7315B33F83A4519DA87C329AA329CA2551DA173AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478275, "uuid": "8c6e988d-0cc1-439a-92f6-8af837abf560", "value": "1536:K9SexlmuwRDOAguoXxhgsOEczsSryhj++65Qh6PMSKjBlxHF:K9ZxQuwRDOAfkD+EOKj+R5i0pKBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478275, "uuid": "edc2ec79-5f45-4e92-b347-61b59f917d72", "value": 94504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478275, "uuid": "8da728e2-2b80-474d-8b96-59f0821079bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478275, "uuid": "706e1b6e-4969-499d-95ea-29d07f9a01e4", "value": "bolubotnetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c46e19-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503696, "uuid": "315117ca-8210-4b91-9524-3b25475334e3", "comment": "Malware payload (Gafgyt)", "value": "06742a6cd18638f835026f6f1e6bebda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503696, "uuid": "aef2dee4-e5c3-4f8e-8927-076db7d4e373", "comment": "Malware payload (Gafgyt)", "value": "c22425e406f7b40affb1cba5f4b4ccaf4713ce184bc833b88b8f2b1dc1b4d619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503696, "uuid": "607b2031-1293-4208-862b-3897f7303fc5", "comment": "Malware payload (Gafgyt)", "value": "54ef3ac84f2627c0f7aea80ce585c6fcd1d5de15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503696, "uuid": "747f338d-3c7f-40c4-997c-99d85155fcc6", "comment": "Malware payload (Gafgyt)", "value": "7e32ab447f430cc09ce9a26805530513a9856551cfab73c770004ff6ef354bc2be524fa1e6ba65665ffdbb41513e816c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503696, "uuid": "b3ef5499-e0ee-4f58-9332-ab2ec2d96c2c", "value": "T1EA931932BA790927C4C2573A67A3C335F5F2628D20585F077FA34F8C97606017A2FA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503696, "uuid": "e3555ccd-0ddb-4355-ae3c-df54aeca8203", "value": "1536:1U0ELaMf7IZ17fndxZZkuVXYNtSt2zN9531ntsWY1D3xIeT:1UvLahhZkuVXYN0tSNP3gWuxRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503696, "uuid": "4df4d70a-57de-46ae-86ea-d7b63c6cd11c", "value": 97668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503696, "uuid": "48663d6e-0f64-4b15-8785-50df1515b4ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503696, "uuid": "08845db2-5174-47f6-8f99-e55979928827", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079dc762-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501685, "uuid": "c49c0f3e-1ca0-4096-b8ad-1f790d33b524", "comment": "Malware payload", "value": "6dac2548850a42e4c6ee3b2505beacab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501685, "uuid": "f3ae8db1-1fc4-438e-ad28-ec8a7fc82c0d", "comment": "Malware payload", "value": "c253cc981550ed54bfa7272a161f8acd760477462f3db59b3ada2bb0559d3f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501685, "uuid": "259ed8b7-6cbe-4427-81c1-a774ee6af911", "comment": "Malware payload", "value": "203047d0dd2cd3390110b161f18658db1d243e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501685, "uuid": "8cb5946a-8d23-4f81-9cca-dba7eafae71f", "comment": "Malware payload", "value": "538d7a7fec3554ba397709a745500b6bb8fa66c62febbbb4cf847f3ef092f7497aaebbf4193397bf44b1503704ea2840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501685, "uuid": "1f856daf-175e-40a5-bab3-d596de7331f5", "value": "T12008594AF7428C9BF415527858878FD0A372ECB54BA0C3A732A9232D1FEE7C84DB6551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501685, "uuid": "cf38f6d0-3d85-4777-9e17-785041881529", "value": "e27f56b7f7f6a0ba38d1b7aa3bfe53ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501685, "uuid": "e1259b23-a63d-49ba-aa74-0c4538b3bb76", "value": "786432:SWvLErJqRB42/U0l2V2c7yW7tp/Zum2C67YoH0Jtx:AcR//42c7yC/ZumED6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501685, "uuid": "304496dc-d150-4173-829b-08db74333d98", "value": 82675759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501685, "uuid": "f4f3dca3-04a1-4967-b8e9-2310f4c4d47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501685, "uuid": "1775d81e-937a-4095-81dc-6011af688bbe", "value": "bii.736883002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dadb3d-6109-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535454, "uuid": "d470e081-0f02-4eea-8cb3-4bf4c7ea9d35", "comment": "Malware payload (Mirai)", "value": "0c31aba827baeedeceaa965128f0227a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535454, "uuid": "47004445-d47d-4a81-9806-cbb9d75d403f", "comment": "Malware payload (Mirai)", "value": "c33613202983e18a1a8a69764b200d241d70973fefb0b4c271e6e061566eb39b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535454, "uuid": "650892ea-e3a3-4bb5-bde1-4968342b45f6", "comment": "Malware payload (Mirai)", "value": "9f87dd33dc859f0fe4f61ac8c21c1ea2fac90871", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535454, "uuid": "57d0a2ed-ec78-4d1d-a36e-48d97e25c54e", "comment": "Malware payload (Mirai)", "value": "1c249480973f052d9afc1a2d6ad15b6c25fb34dae9c2a9ecef91e6e1d94619b27ba6f0e361f1bdd80b5d8572c8621da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535454, "uuid": "c4407f82-28b8-4cac-83ac-cd059c22d425", "value": "T15A043A46E6408B13C0D71B77FADF5241332397A5D7A733069928ABF43F87A9A0E62D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535454, "uuid": "ec044381-5ccb-4e58-9385-1c60dc2fd0a2", "value": "3072:ftAHe+UnTtSraBArmu/5OLoD/svnpRlICiaHd/KM/9GTMqzm65wAgFFbul:ftAHpQSraBArmuROL5vpRFiaHdyM/9Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535454, "uuid": "d9036e82-65ed-4178-8e0b-6876a43995ee", "value": 177126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535454, "uuid": "f2998b3e-9a99-44c9-92e0-f5f4442f562c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535454, "uuid": "e61444aa-f475-4505-a580-fa74c15bffb0", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc56efad-60b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501236, "uuid": "99ea1153-c381-480d-a654-93035bb767bd", "comment": "Malware payload", "value": "181b109542adee3651b5edf8d29661f9", "object_relation": "md5", "Tag": [ { "name": "84-54-44-48", "colour": "#FB1817", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501236, "uuid": "d5c55232-946e-4bc2-af23-e4d69a56e5c0", "comment": "Malware payload", "value": "c38af4b06807357d05314ee8c251f3de39234a3a7c9d1aee05863703428dca01", "object_relation": "sha256", "Tag": [ { "name": "84-54-44-48", "colour": "#FB1817", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501236, "uuid": "2ca3c156-e81b-445e-8419-50240caafdde", "comment": "Malware payload", "value": "7aef63bd187b4e5dd5b842aea257d950b6f0127c", "object_relation": "sha1", "Tag": [ { "name": "84-54-44-48", "colour": "#FB1817", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501236, "uuid": "7358197e-5b1b-4603-b852-26628d2040f8", "comment": "Malware payload", "value": "98867dc19aceec336292643db36e0a60382cebac97a1d4fb97f30a9b95bfe2d7bef45a60261a3679514efd2d3ddb9089", "object_relation": "sha3-384", "Tag": [ { "name": "84-54-44-48", "colour": "#FB1817", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shark", "colour": "#0F0156", "exportable": true, "hide_tag": false }, { "name": "SharkStealer", "colour": "#16FD1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501236, "uuid": "0d13bdaf-1020-4cc8-805d-0dac11f0e577", "value": "T1482772EFE837B0DFE17802BD04E837189C6D79646E838D3E609887E84B1571629D467B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501236, "uuid": "689465dd-2994-411a-a38e-6232967b0547", "value": "e2fdf6fad5a1568889ba34bc3d007260", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501236, "uuid": "44fb2bd9-3977-492c-b10e-b9bac37e3349", "value": "393216:xcDOJc5tnKIsCQNHhTiecHqa0T7LrRd+y7G4mD9NstGD/ztH4yycPPY4FWJjgDc2:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501236, "uuid": "19218ecc-924c-4a0e-ba60-d6c0073c636e", "value": 20487616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501236, "uuid": "fc51ae22-1d4a-409a-85bd-712cde808283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501236, "uuid": "02a28bc5-6636-4d35-8cfd-ec19c953e821", "value": "shrk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c946c26-6082-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752477292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477292, "uuid": "c2274bba-d6a9-4111-8efa-0b7adc2f2ac3", "comment": "Malware payload (VIPKeylogger)", "value": "b353726ad20228ff61e25031f55f3e68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477292, "uuid": "2bdfd41a-0e96-420f-bd3f-4e731f6acb6b", "comment": "Malware payload (VIPKeylogger)", "value": "c45640db87251995dc06c2ea4ef6ca5c0922df2b54819c84f4ef3477a4cd23c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477292, "uuid": "6953b2ea-d46c-4836-9701-a445a17c831e", "comment": "Malware payload (VIPKeylogger)", "value": "12713faad59e24b207f78d52a97803ce55c25dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477292, "uuid": "1e123f48-2100-48e9-b599-95990e2e5c21", "comment": "Malware payload (VIPKeylogger)", "value": "d6597a864a81d69326b8f0add22e4c3d4ae1641895939b5615932bb65aa66057e7cfb7c8f4d0b34212ba0df71cd2701c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477292, "uuid": "16243777-c65b-4140-b2e8-97be6dd11c1f", "value": "T1DEF40105B439DE05C4A60BB4AB21EDF0037AAD9CB424E3575EEABDDF723A74110C1A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477292, "uuid": "93f65be5-3f82-4a1b-abcc-562f0be95b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477292, "uuid": "e22894ed-6709-4caf-b055-11c8090cf1e0", "value": "12288:vi1/3plPNnBpQvwSUyKzNy8sKszCiG5JoZe/mL1scwMirPMmU10LwoglRS+:aF5lPNBaSyR8sx9ao8uyMDHDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477292, "uuid": "1f4d3fbf-ca80-4c12-8589-c6d626470c06", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477292, "uuid": "10f3e9b6-f170-41a2-9119-0f28a8774744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477292, "uuid": "08866dfe-45e3-498e-97db-88f2cd573b0a", "value": "SecuriteInfo.com.Trojan.PackedNET.3367.26576.10323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac6b9e1-60ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494925, "uuid": "a7a09ecb-7e58-46e6-9c97-48c188fb8f56", "comment": "Malware payload (Mirai)", "value": "b9c65c8369f790a1afc08dcf0dc2b40a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494925, "uuid": "8190d5ef-2327-43f4-b424-247ffa87614f", "comment": "Malware payload (Mirai)", "value": "c48b7da0e0eeabec2bd938d6a951f873d15b9f54accb4083d58b50c7cf682f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494925, "uuid": "36088f21-29ac-4760-8df3-ca449dca7df1", "comment": "Malware payload (Mirai)", "value": "70adf6aa46869bf9606a0beae968ba9373eb74a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494925, "uuid": "b8d997c4-4fda-480f-a0f6-ecd458cff59f", "comment": "Malware payload (Mirai)", "value": "ab776b748d754df9bd2fa44fb3656669a707399a99e351b55e39f1fb6c9d7e64f3e27f7cd3d01a3cba4f4b711fb34acc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494925, "uuid": "7bed6345-0ed0-4dd9-9d67-a49d82b1571e", "value": "T1C3E32A46FA418A53C4C61775B6DF424A33239BA493DB33069928BFF43F8279E4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494925, "uuid": "1f11f0c6-9524-439f-b927-67b6368d02eb", "value": "3072:pKvXOlAe3rUwwaDms0Q0y+AgHexGusMZh2pkvKxvM/9WXbBZ:pKvXOlNPwaDmsJ0yBGexPL4kvKZM/90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494925, "uuid": "2679b5d0-f5bb-4f3c-a613-5f14e017db82", "value": 156622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494925, "uuid": "7d5ff1a9-0b27-4929-a543-ad4946d3f26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494925, "uuid": "c9aab560-f140-48dc-b227-47a442c4957b", "value": "top1miku.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5574f17-609a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752487910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487910, "uuid": "ad8f2f18-f96a-4794-a9c6-815e9b8f3042", "comment": "Malware payload", "value": "1da7a04105561fd2bdeec72d6fcec43b", "object_relation": "md5", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487910, "uuid": "40e55daa-8657-4eba-9371-d25dc939bf4a", "comment": "Malware payload", "value": "c4dbbe381e5c24cddcd02ddb3d21b35c097f0e8e986b04330da89cf1dadf10e1", "object_relation": "sha256", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487910, "uuid": "8044eee5-5588-4857-b0e8-627764aec5f5", "comment": "Malware payload", "value": "19ef7fd4141b5ed3f6de034f603c627c74293e58", "object_relation": "sha1", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487910, "uuid": "cd2ac599-8192-4333-835f-509b6796a154", "comment": "Malware payload", "value": "49b9168c9961a4db79fe9749ffc4422d39419cc234b99350a3c71dd06c8de92fef7bd8b01afb36d047e065f184705932", "object_relation": "sha3-384", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487910, "uuid": "43d1fd85-4f25-449d-a843-50b3bb4afc9d", "value": "T1CDE2B8BA45152D12F9FE00BEE68F629457917D5AF063C8A6D8FC165300C74FAEC2283B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487910, "uuid": "ff7e2312-8537-49e5-b76e-a6a48bfd2d38", "value": "768:EyBxR9+iWvjdq3ILqYwWg8VJi75r+R/GpDr:99yMga5fDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752487910, "uuid": "7ec3dd85-159e-45fb-af22-d58ab41fbb1d", "value": 32955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752487910, "uuid": "545ec282-17a5-471f-81ae-08518a0a2392", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487910, "uuid": "855a74b8-b557-4bc0-bed2-453bee6cce99", "value": "LICENSE.pyc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7106458b-60b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752497137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497137, "uuid": "ba63b7d9-386e-4ca0-a82b-d9d97d33c936", "comment": "Malware payload (Mirai)", "value": "660226480eab0d1418833d3f68ff9c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497137, "uuid": "44dbeccd-c595-4024-98ac-55d595c57737", "comment": "Malware payload (Mirai)", "value": "c60234225b600cea6fa0525a2507218454eeafd0376a9b47b755459edfc35c4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497137, "uuid": "d89777f6-dcd6-494b-91a3-c00cf275a6b7", "comment": "Malware payload (Mirai)", "value": "f6c1377021b5081f09331d772f82a1233adc8745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752497137, "uuid": "b8861169-d983-4278-b02f-26a44dba51ce", "comment": "Malware payload (Mirai)", "value": "f6685e9119aadaeadbde44c38cb80ddd1c7b38808bbe396a9b73457e5960e89b16ddc2b2ad26f028d90cdd63e2db557a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497137, "uuid": "3b686d7e-de13-4c02-bf5f-a334057c633b", "value": "T15E93E896B8C28E15C5D423BBF92E00CD331267A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497137, "uuid": "2297a8ff-720d-4c23-91a8-2d46c28ed764", "value": "1536:lwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8UWj6XLw6M1HxCwU85u//5CFYcpIziIy:lFP1sYu7JPZ2oP0r+0UWj6bXMFHHq5Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752497137, "uuid": "ec9d3de3-babe-41b7-ba7b-9ebd2ce6cf08", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752497137, "uuid": "65eaf204-9b01-4728-bf8b-e823446a8963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752497137, "uuid": "5812f4a2-06a0-4443-bbee-2297d6955eb3", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bc33d1-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485065, "uuid": "67bfe9e2-76a1-4d71-b557-0d751ca283c0", "comment": "Malware payload (Mirai)", "value": "b55829066bd976decf737659809b810a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485065, "uuid": "760823c6-dc92-4646-8de0-54dd6bfc1e9d", "comment": "Malware payload (Mirai)", "value": "c608d45160b79000a8e4c9754d03a7126de74c79f531050e24f91342fa7a645b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485065, "uuid": "916b16fb-ad81-425f-9c92-9ef81493434b", "comment": "Malware payload (Mirai)", "value": "fdecb1fd60838091ba6cd55f7f068727eb812005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485065, "uuid": "f4b4620a-68e8-4bef-9957-8f0933cdd173", "comment": "Malware payload (Mirai)", "value": "d0f54c0c27ba113121fb54850a86f2ff003953447fc392010e713150233c1902cc71615130b51aec49d8a4c53a215a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485065, "uuid": "2569d4c8-04ed-45d1-adcd-34179dde4b1f", "value": "T12A732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485065, "uuid": "67115504-b163-42b6-9763-3b6f7fac2d87", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXbSKV6v3G78nN9WU:927jqCD8v3GI/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485065, "uuid": "14cc66d1-9624-4e1d-8112-5c45bab9177b", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485065, "uuid": "0d47eff4-101a-4754-b5cf-6e7b13372fc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485065, "uuid": "b18f0ea3-103d-4dda-a1b2-1daefad41b0d", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965a45b7-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752518245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518245, "uuid": "f5836384-276e-4f67-ba50-b55ec2ad7651", "comment": "Malware payload", "value": "73ba1b093985d6b09ff3107b9f635630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518245, "uuid": "c546e895-0d22-4a25-8588-8a99b8f6e216", "comment": "Malware payload", "value": "c6874a0e7add4cc916b6dbe67326898f48ccd6cfc3f47eb15cd7545b409b7ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518245, "uuid": "06aecb56-f5ed-46f2-b1f1-353681320ddd", "comment": "Malware payload", "value": "a8528462159913b96bbb1e870f0a738f363f2fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518245, "uuid": "279ec786-f0f9-4524-ad66-998098c52af0", "comment": "Malware payload", "value": "77d5593eb2886919e44f348d43786ba4ccce7999fa0c2a6d6d66a56f66993356bded81bad7057605dd3cba6cb9cf43cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518245, "uuid": "ea9f811e-8253-4421-90bc-bbcbea871ba8", "value": "T1C9159D4662F411E8C877A03891AAB21BFAB0346417144AC723F455587FF73E4BBBA762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518245, "uuid": "caeee0ad-6c3b-4c03-808c-ae35c3a3b2ac", "value": "9a3c3f11aff0b97435f0372e2ac2ed88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518245, "uuid": "4723f1c6-aafb-42ab-a8d5-98b1321db85c", "value": "24576:obWeUBlipNL7vRznMyW+nVq3R72tM6MLiFs7eHt3eh39c3CnULu:NfBcdelkuR7X39c3Cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518245, "uuid": "1dee893d-3f11-49c8-b210-a19758b4075c", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518245, "uuid": "5b6f5b05-f88d-4591-9e26-a0654c8d26e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518245, "uuid": "44066685-1208-4ce3-b23c-1a7bd615324e", "value": "UniversalNoRecoil_2_-_Copy_1 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a21513-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752477838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477838, "uuid": "7e3d7da5-dda1-4f71-800f-3e481b1117ba", "comment": "Malware payload (VIPKeylogger)", "value": "0cca7aea9270ec0799a7423850fb7a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477838, "uuid": "6c5ee929-f239-4358-be0d-4c4dde57a60f", "comment": "Malware payload (VIPKeylogger)", "value": "c6885af6d0681ae804ab5884e059e276bc28496488eaa88f20a6f9bfdedf10a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477838, "uuid": "9b9b710b-8d82-443c-a5dc-efb2bd642832", "comment": "Malware payload (VIPKeylogger)", "value": "2b2f7b9afbf27af645eb5c8e3cfd16219527fa4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477838, "uuid": "06f460fa-5f87-4e4d-add7-1adea484282c", "comment": "Malware payload (VIPKeylogger)", "value": "83ef235774f8e56ad94aa659521029d644f20ab9b7a3f4d85fe8bc32cb762971cc39125db112aaac09da129cbf2a5d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477838, "uuid": "a4c7b614-97d4-43e1-89e3-fc47da47d795", "value": "T16A05D0AC3150F19EC857C6B58A64ED78A6203DAB971B820391E75CEFBD0D987DF140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477838, "uuid": "1fbe98c2-1487-43b7-af17-3801da5e03a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477838, "uuid": "6e9366c8-0ac9-4210-af0b-3fc3f35ba373", "value": "12288:+P2SelyAFtKhq6FmFmWzxPZ5zcdw/iJN1veMkpNFebY12K5WitNZceFraOeZ:Ce4CtKPmhlTzcTN1mrpNFF12K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477838, "uuid": "1573dfc7-d49f-4ee7-8e4b-a54ff11d966b", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477838, "uuid": "53351654-d507-49c8-bb3a-89c4e0d52cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477838, "uuid": "a98eef6a-40ad-40a3-a45e-c1704ca63e25", "value": "IbEhepThOl8XIFN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f374a01-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752495926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495926, "uuid": "b4aab5dd-8977-4da3-8273-1b7871768e5f", "comment": "Malware payload", "value": "928f77b7a8bd7e5bd2d56917629ad870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495926, "uuid": "862cf6a8-3d9f-4f28-809c-9e241c48c1e0", "comment": "Malware payload", "value": "c6f799da5bc4fe0e59e731249d401ec32fb581f96a0cfd49c821c1dafef79b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495926, "uuid": "8be99f65-461f-45e9-98ab-d796d6cf6a03", "comment": "Malware payload", "value": "dc8501bd6e17ac28f44badcf811f5e399c8f4b33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495926, "uuid": "8147e79e-2dd6-4a1a-aedf-038870ad0142", "comment": "Malware payload", "value": "7bf5cd59a66351cd87fd4ffde32fe26969148b859150d5c398b2b1225ac7db341d538504aa3a151c962e1546c6c240a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495926, "uuid": "15f971d3-e836-4af4-ad43-6ffb3bc2329d", "value": "T18FB41228EE4E3881F3D1E3B8DA0A4BB1B05B7DD0C166C1B2BA41E25D95EDDDED5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495926, "uuid": "24ab2181-0a0f-46fc-a28f-ed4cd76101b9", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495926, "uuid": "7811e914-0aaf-4273-83db-7c1314b316bf", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495926, "uuid": "bf3197f5-ca06-4fd5-a498-8a053db5317b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495926, "uuid": "60810d39-0a50-4220-89fe-4ae2d79a29a4", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c88df01-6062-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1752463521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463521, "uuid": "da24fdc6-93c5-40b1-910b-d18ef8a295b4", "comment": "Malware payload (PureLogsStealer)", "value": "82b58238b18090251c2dbb1f74702939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463521, "uuid": "84edaf36-d238-42b2-9fa6-82e457991b2e", "comment": "Malware payload (PureLogsStealer)", "value": "c71ab381c16b8f14e2a83fbacecc33895966eb98de97bfe21b97c604241a7d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463521, "uuid": "68a45bc5-8e49-440b-b180-69516e662b5a", "comment": "Malware payload (PureLogsStealer)", "value": "589faa808145933c43f34e5405c1595299f0cbb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752463521, "uuid": "d36148d7-a133-47d2-9af3-370b2940dfe0", "comment": "Malware payload (PureLogsStealer)", "value": "636460a98f676f6e8e49b4adef0723cf82f3468dfc46d94b92e21a71d038c49f21ea702ebe60e791d9e5eb000376469c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463521, "uuid": "28c33465-02ba-4edb-989d-ab1152ae76dc", "value": "T14536331196BC4513FCB11BB148FB46D702BEBEA3D6188B0B2723BD5E19F20E59271A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463521, "uuid": "81a499c8-2086-43d8-b813-c7dd429fa5cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463521, "uuid": "730c772d-dc6a-46ea-ab3e-e096a50fed82", "value": "98304:pslfvpXZ6gMHoJrQ8IwEDRGcb7lTWRM5sdEe1VALd0/8MCK:+sYJc8QkcbNadEe740UMCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752463521, "uuid": "a57db187-a96c-45ec-a74b-2b9a7bf07566", "value": 4946944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752463521, "uuid": "d5d1eb56-3c6f-406d-8483-b936b9fd83f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752463521, "uuid": "dc372074-50dc-4ed9-ab96-5d5342a628e1", "value": "82b58238b18090251c2dbb1f74702939.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7edf3cb-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503672, "uuid": "4151ca39-15a0-4ea4-b093-9b44663db989", "comment": "Malware payload (Gafgyt)", "value": "68ca514e98c96e94ac8c1af88d3bcf16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503672, "uuid": "2621bd65-198c-4bfd-a121-2bcf340669bc", "comment": "Malware payload (Gafgyt)", "value": "c765576b5d4d467d047ccb6206152ce0d6b02899788a7f1c3b853b7547591e06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503672, "uuid": "7dab1672-001e-4a2b-b3b5-312e28a37ad7", "comment": "Malware payload (Gafgyt)", "value": "68525445fee152264ee11f671c69197b8f7d88aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503672, "uuid": "7f7124d4-73dd-4914-bd27-1cc9784ef89a", "comment": "Malware payload (Gafgyt)", "value": "979a31b0b9e6c6d2fc1cbbd6c179e732905564dd2dde69fd785ba09db50103afb220597704b8c51dffd1e2f34826cde5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503672, "uuid": "9713eab4-db3f-4735-9868-6c814a05dc73", "value": "T1AD733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503672, "uuid": "6bbf314e-2309-4808-906b-096b6f8cfb24", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMdMmLI2VOCjXUfJRk:45omr0xKFn6J+OSMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503672, "uuid": "0e8ffd5f-7f0d-43f5-b213-906448e5e495", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503672, "uuid": "73d1e53a-d172-411f-a825-63f4add10db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503672, "uuid": "bfe00e34-8d5a-47f4-b389-1e2356aaf2ef", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2787eac7-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494437, "uuid": "6536595c-e65f-466d-a132-143b83b302cc", "comment": "Malware payload", "value": "0bef3bdaca7867215fe0967fb74ff614", "object_relation": "md5", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494437, "uuid": "29aca4f6-f93b-4a2e-82e2-c85916480488", "comment": "Malware payload", "value": "c77eeb4b0af7e7fb5e71f998cdb41c7800844f447986bd7500511a075ac51523", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494437, "uuid": "784588ae-7bf6-4106-913b-f0e0fafa6152", "comment": "Malware payload", "value": "3e90b286e929816657bcdd707a16e74b5795521c", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494437, "uuid": "baabd6ff-f013-43dd-9574-d24b0ae9d615", "comment": "Malware payload", "value": "174be027dd3cb76037436c9b3defc8d44cae615e969717edecb99de2278eefdff3e8c8237e41347a9c5e7fb86b9349ea", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494437, "uuid": "1af0bc46-0d60-4407-a98f-d158afe540bc", "value": "T1FD5301082AF486C8D717AAB4936545DDAD8877F0F5823C0F1B5D29AD4AD83AF0787E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494437, "uuid": "cfec8832-59e6-4be5-844d-41c1ac736c39", "value": "1536:FzwZZCpN66w+td21XMDy9qvBNuXm5/9G3Yq3+ZfSaSZ:BieTw+m1XMDbvBf5/9GEdSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494437, "uuid": "9d74cf08-1dae-4e4f-b6f7-d34e03033b1c", "value": 62298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494437, "uuid": "b541d287-ac18-435c-b72e-e6b781535504", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494437, "uuid": "7a96cdba-5bfd-4b99-9e6d-449bba1833a8", "value": "c77eeb4b0af7e7fb5e71f998cdb41c7800844f447986bd7500511a075ac51523.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0584c7-60de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517021, "uuid": "f47502ee-3a17-44f4-85ab-99ee274072b4", "comment": "Malware payload", "value": "8f14347aa3f7508a942e26218da8d026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517021, "uuid": "a0a69966-130c-4928-a39f-e9a2ba09f209", "comment": "Malware payload", "value": "c83f982f34492ee4e7ff44247840493bac75e39a0a694152aafc0f23d50f84da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517021, "uuid": "3bbffa86-7bf6-4907-9fc2-5264ed624da6", "comment": "Malware payload", "value": "5a65a5d31db66966db066ddea0b15572c719b2a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517021, "uuid": "0e667c6d-1b36-4b8b-a151-9dd1f4825976", "comment": "Malware payload", "value": "110d53fdd5ac865cc3d57b2810abf37f4b110637f9973aaecd0e60a528420af0a78939d1ba3bd3a0851fba7bbff07e4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517021, "uuid": "6051f211-97f5-4ae7-bedc-973a8953a1de", "value": "T19BE5333D09F5CE30EDEBB4F0C4E1214D8D6ED4999D749E5897F0A70CAACA9C8A5693C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517021, "uuid": "b4b97297-f7dd-4295-a0ee-f3eb6ddb770e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517021, "uuid": "ab913f5c-3ed4-4df1-8aba-f1734b444f22", "value": "49152:lVqNFsWYLSUandds7bUNEZC2wlDRWSMvpsllFq9sfLwPWM4vPAHAme+qoj6O:lVqNaf2dWHUNEod5OiM9UM4nAgl+qov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517021, "uuid": "e2728296-ef4d-437d-bec2-d3a0ae68767a", "value": 3289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517021, "uuid": "6048e5b4-9997-429b-b251-d34083791ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517021, "uuid": "50f0c169-2b35-44e6-9274-6955c91ace91", "value": "SecuriteInfo.com.FileRepMalware.19762.23927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642cd380-60de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752516872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516872, "uuid": "ddf48347-ec67-4a7a-a26e-490bf1c46786", "comment": "Malware payload", "value": "b0dfe9c1100691257974a1c6632c0096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516872, "uuid": "5593791d-31b7-43e9-b1f3-65fd502761e5", "comment": "Malware payload", "value": "c88a3ba68bd9b7575542364b298f9f93b1fd110fb92623845592d7c1010f8c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516872, "uuid": "3b40bc03-b055-4a0e-a5c5-316539a8d02e", "comment": "Malware payload", "value": "90b8039ece0c97e2c01b31d48df2619ba3891c5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516872, "uuid": "196f8f6d-9285-4eeb-b46f-8fcd9ecf9b20", "comment": "Malware payload", "value": "07ffee95964e4216a10c17f277242f66f277303b70cf81c203bffbc10582e7f6969c507f95798a551a66a2e33226409e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516872, "uuid": "bc6e8768-bd69-4ed0-bd69-ca21c52bbf11", "value": "T101E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516872, "uuid": "8109b9d0-37b2-49a4-ba96-9fe8d454454d", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516872, "uuid": "3c732871-a441-4cb1-88cd-9de4ddf9d28b", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516872, "uuid": "c0b1de93-6f22-4156-9742-c62ca9a6ed00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516872, "uuid": "6389816e-677c-46b9-81ad-7152ef89e30d", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b45659-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752513353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513353, "uuid": "28ac0fe3-780c-4500-9b9e-a1087a1a4e00", "comment": "Malware payload", "value": "89177c08bc2c3e393b176e033cd2e612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513353, "uuid": "05d3bb41-a481-4bad-985d-caf620c54436", "comment": "Malware payload", "value": "c8fdf0858701d9f9514a2a4faf9b01d71d98f83ddfaeb2a364700b784cf91b64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513353, "uuid": "3924279f-dd7f-47cf-9c1a-5e0214b3e7bd", "comment": "Malware payload", "value": "a953b12f04e184ae16747cf62c729a8436c21357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513353, "uuid": "3ce295a6-3bae-4123-8410-62094dcac2ad", "comment": "Malware payload", "value": "abed037d1934a416157c2def05d8c9773c370562e6cd4fad189c567828cd12fc85493cc00be974996fe466a0abb753f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513353, "uuid": "92cd882e-e17f-43ce-aba4-738147610298", "value": "T1D3B40228EE4E38D1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513353, "uuid": "00de344a-03a7-4a59-97a7-7af67ed89a8a", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513353, "uuid": "06253569-da25-488d-8537-4cc1bb0c4869", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513353, "uuid": "e8408161-a7b7-4ea4-8c40-fe9da69f346f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513353, "uuid": "bd156e39-a2cc-48c0-b166-152e2fc146ae", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321b5231-60da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752515070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515070, "uuid": "d52496ad-07a7-4d28-862c-16d52ea65792", "comment": "Malware payload (Mirai)", "value": "a378e3147ef1cb0579344617d3c163d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515070, "uuid": "b40fd545-eabc-4bae-9546-1fe69a81db09", "comment": "Malware payload (Mirai)", "value": "c95289e8ac760c943f444266dd9928cddfddf0e120f0d2f17e189b013a205143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515070, "uuid": "a40326ab-a5e0-4255-8769-98236d29a00d", "comment": "Malware payload (Mirai)", "value": "98aab99f7719fd3645d1b3d50c123685c61c1c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752515070, "uuid": "bd273ce9-1fa8-4e84-9d8a-9586fab09a18", "comment": "Malware payload (Mirai)", "value": "9b7772487d8b0c25239d2c2630a6224bb807039090b0631e89227e43fdab95b94ee50133210b13c6af539c488e49bae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515070, "uuid": "56db0204-3d13-471f-b4dc-34629021ca28", "value": "T15733D831640979A8F45100F9B02F6A731E910EEB39FCA2D3A7667131EDB364A1DE6D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515070, "uuid": "88e86a7a-0bb0-4abc-9692-2ac0279a06eb", "value": "384:iVuxnuQ6cW6XZf1kUJEnLctOJIDgi0+ybW+rf3Billb5a1tSzHOoJHjkBx7zktve:iV+uQW0P+UgL5ill6SzHqotJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752515070, "uuid": "d6e067a8-ebf8-48c5-860b-42d3bc64c194", "value": 50832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752515070, "uuid": "2b60b4bb-773a-4c30-9df5-953ee2dc3b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752515070, "uuid": "1349fbaa-5824-4b0e-96c3-cffb903314eb", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157e8b28-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505144, "uuid": "69f195f6-71ca-4d47-a95e-6d11cdaa7a7f", "comment": "Malware payload (Mirai)", "value": "ec3898ea68d47e8540d29ad46cc4dc35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505144, "uuid": "4cb63957-2684-45c8-abb4-5ce9ecc08b34", "comment": "Malware payload (Mirai)", "value": "c967cfd264b3daabf8a8bb881ccdab4e9044a213365198d456d82ed59d11b8cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505144, "uuid": "f86a8a86-589d-4736-9e33-831178c2fc89", "comment": "Malware payload (Mirai)", "value": "e3dfa456b95b77d562b3064db6c50a52733337e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505144, "uuid": "38a3f944-fa7d-47f9-ba64-8f2e170c1ed1", "comment": "Malware payload (Mirai)", "value": "11bd40b4f74fd8380e058761f54be3b8508ab901e2ea53cc1a359714bcd3db7a68f968c3c2ff60abac8b717f03cf1d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505144, "uuid": "61cd3169-40f8-40e5-83a0-af4732722115", "value": "T1AA734B42B31C0A47C1635EF03A3F27E193EEA9D121E4F684651FAA869271E3255C6ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505144, "uuid": "94f34a7f-8e84-430a-82fc-0f5e27303b48", "value": "1536:GOx/DvDZj7v69HO/+ML81o9x1TkIYW5bzJwg5HtDz:GiDRv6JDyfkIvbHPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505144, "uuid": "a5431fc5-d41f-4b00-b39f-9cfad2d1abd5", "value": 73824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505144, "uuid": "3d202e30-4e89-49ca-9eed-e4c18e646eb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505144, "uuid": "c7dff103-5a1b-41e5-bce1-59d8e7aae1e4", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6648244e-60bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501843, "uuid": "e7f31a17-78d7-4dcf-a82b-7e2545e281f8", "comment": "Malware payload", "value": "dccd917ce83525e6e3528ccf1f80c028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501843, "uuid": "089fcea0-46dd-4460-a5fd-2253e82a99d4", "comment": "Malware payload", "value": "c96b21aa1298617a3be584c0e5b0b1157b83746195795a393b62aebb637c8df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501843, "uuid": "2a78b19d-52bb-479a-9dca-1e0452c22754", "comment": "Malware payload", "value": "6696044de950cbdd2f0fc89f7f0f39e7650f61e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501843, "uuid": "cc25d48b-b932-46b2-baab-7438bf9e8723", "comment": "Malware payload", "value": "8375705a969880bbc7c958fdf455625e81d1937c3d6baf7a37868eaf674443001df162bffd7cf12aa5fc02090a80979c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501843, "uuid": "4c7f4177-e403-4dd2-9620-1af12cd4bf7b", "value": "T156463300BF052A49ED2CCCF9BA8E2E9EFE85D745C87D93749C8161D758A3DB6D80E211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501843, "uuid": "a2844396-9ae5-48b8-ab3a-8add34a52431", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501843, "uuid": "11397eb5-d967-404c-be9a-9c0046ce43b3", "value": "98304:tnY8dMaiZ6/AgGwXaukyG2kdgY9Qc1Ti7t3SqTNWFHLbf0YvXB+bzRHq9y77:tMjCFGwqnyGU3c1TYTNWFHLb8YvQb1Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501843, "uuid": "24e70e4d-7480-4471-8f2b-ee369baf9617", "value": 5698048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501843, "uuid": "ef9ad616-0024-485b-a552-57ec017a6e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501843, "uuid": "4a80f092-5495-4f13-8349-ef5b9c26ceea", "value": "winsilc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5eeef2-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504649, "uuid": "972f7ef1-be4e-4b03-be53-b24c2d4a170a", "comment": "Malware payload (Mirai)", "value": "12bd028181dc8f4e6822f3f5227810be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504649, "uuid": "60a9f163-c8a6-438e-ad07-5dbea6012804", "comment": "Malware payload (Mirai)", "value": "c99b8b2e6ce3f80e76c4b7fb089c3548882b1ea04d8fbbee8c3f8c3a3821de6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504649, "uuid": "482161de-2333-4813-a80a-160abd95ca32", "comment": "Malware payload (Mirai)", "value": "15740047c0c0743a1be9f702326f49a54831de47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504649, "uuid": "11d645fe-17de-4bf0-b3a7-ae95aa8b1c9d", "comment": "Malware payload (Mirai)", "value": "cfd85c46f228e3017f444d4dc48861b785d6c665d1a3d4660d6a76fe0dccdc0e2c55a1acd5b7e3536a5d4f8138452589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504649, "uuid": "32c1e7a1-cd31-43a3-a7a4-e8cfabc0c8aa", "value": "T11F732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504649, "uuid": "7558c9bf-a65b-45fe-8473-a0f728c6d318", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WY:927jqCt8v3GI/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504649, "uuid": "a5eb9eab-9821-4f68-8468-a96100669f72", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504649, "uuid": "1c6c4b25-1355-4cbb-80ea-ac736084fe92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504649, "uuid": "016b4117-e6f7-432c-9bfa-90a96fa97217", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94880251-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752477869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477869, "uuid": "12949aa5-0df4-4a0b-8a23-03ce84fb20ba", "comment": "Malware payload", "value": "ea1e03843b3ae61036b647097fada4ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477869, "uuid": "718eb6ca-6c04-42e9-ba9e-035b7622ffa4", "comment": "Malware payload", "value": "ca00550a971ffdff869dbc663272dc2654f86f1a3b1c524bf67678902accc7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477869, "uuid": "abd36543-1876-4ecd-b018-81e8ea4376e6", "comment": "Malware payload", "value": "1152ea02de062667b8fc5818ef547049b3944afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477869, "uuid": "534282ae-a72a-4ea9-a0b0-848e21065b71", "comment": "Malware payload", "value": "da023d149656beca318d2b931957b233f5d8f515e0a47cfc7663493e80093b4f07b16b1e41691b848cd5b5aea31bd033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477869, "uuid": "ab8ad03c-9e7e-49fd-b7ef-8ff9694553a6", "value": "T117F53A709352A166C19BC030CF864EF565E1B17B42356D0E5BC8DC2636AEF31AB6D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477869, "uuid": "d3fa0bda-68bd-4266-8612-c09b4b48ec39", "value": "adc1afd64fee0c4ce0f9bde81d045a14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477869, "uuid": "54c3e86e-c8d2-42c7-8d61-31e700bdb2b2", "value": "49152:RQx3QlKxfYsR9LS6GQqysQC3CXwfBhDYD5B03VWzJ8fHGvwMwtROTRrl7RNRmGxp:ICmGQqPJ/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477869, "uuid": "56ae72ab-2c03-42cd-84b1-0df934a2c90b", "value": 3617792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477869, "uuid": "758d9d76-6fe5-40c5-b977-dc0f071a5aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477869, "uuid": "1c2f6581-5b6a-4e3e-b714-521b7cbeb160", "value": "SbieDll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861aeb40-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1752477845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "ca856b4c-6ca0-4961-99ab-2bddc54c35d1", "comment": "Malware payload (SnakeKeylogger)", "value": "7ea5dd82e7da7a7fc38348dad10ffde7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "19961f3d-c8dd-40fb-9241-a9b3b7970ade", "comment": "Malware payload (SnakeKeylogger)", "value": "cb04359c16cdaaf112db4f92ce65c385cf398b07dfdf253b8ff75e1b9cbdc148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "08691a53-4122-419b-90dc-51c16009a365", "comment": "Malware payload (SnakeKeylogger)", "value": "3020ec8989c592945e9a775e54c5b5228bd262c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477845, "uuid": "4ad0ce4a-c0dc-4204-be8d-1fc96165e933", "comment": "Malware payload (SnakeKeylogger)", "value": "d8532653fa7c81e946e5fce8ba2e2de7ce359e031b2345b232fc4151a1fab416f341633805e898aec6eb1173190e4fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "5cbb7434-e668-4578-bb66-ec1678c82437", "value": "T12AF402546699EF21D9B543F10230E33517B95F9EA432E30A8EC8BCEF3A66F852814753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "196c13d2-b4fc-4478-82be-10a1e13a50dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "156dc19e-bbe1-40e2-a0aa-c25ff8628e9f", "value": "12288:aQ+Ef3XEhAFtKT+9XXJ877my3hTl9suaxwZfhstxao8gHnsNb2ho/WX+O7:/+EfXeCtKT+dcmytRaSZfh8Hnsio/WX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477845, "uuid": "dd86e4a5-d7ae-425d-8e02-c3ab2819f945", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477845, "uuid": "8e152998-91cd-47b7-ad19-e961010f84d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477845, "uuid": "71d5f278-3804-4d3d-8348-4f7340f0c1a4", "value": "LC draft against SC# HT25ZCELS-ATM02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1937dc-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485106, "uuid": "1f9a7fc4-e560-4788-a0a0-a43fbb06016c", "comment": "Malware payload (Mirai)", "value": "1b5d5f166edf6384981411642d4fcba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485106, "uuid": "7db4539e-b33d-4d8d-9df2-fe8e218d2814", "comment": "Malware payload (Mirai)", "value": "cb3a0843aa1e72c2d6cf84999dd2e1b186c2512b6d2b32476c0e9f0ebdf02bc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485106, "uuid": "be697c1c-793d-492a-b64e-c7f83a39000d", "comment": "Malware payload (Mirai)", "value": "db92566eb0afc5b3686962bfedacbbf583cce962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485106, "uuid": "b042f3f1-f3dd-436f-a406-ea5d79efeecd", "comment": "Malware payload (Mirai)", "value": "94f289e983a09006d53fde1c81e47086bbafadba358053de704d60c2876a5cd8a699d290356602de7a32729d75364fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485106, "uuid": "1a2bba9b-2481-4882-acd0-ed88378cefc2", "value": "T102B39DDBB2871590C85287F007C39F9E3E232212AE57D5FB2C0EA67A15792DB5D0A3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485106, "uuid": "6b37fad8-f68b-4073-96a4-ed9e8f3a3e0e", "value": "1536:9wQUjt2zEGxezvpbGRjvTberfxZcegNP2rga3/LWa:9wQUjt2wmghKRHber+ygYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485106, "uuid": "8e643319-aeea-4512-951b-4bebecf54d78", "value": 107632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485106, "uuid": "14a64835-7984-4ee8-a62a-6b0c8b2accbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485106, "uuid": "ccaa7061-bf1e-48ce-9786-1e41badb3f73", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fc4b39-6090-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752483376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483376, "uuid": "cd2b8d28-5394-4338-b993-95bcfec897ac", "comment": "Malware payload (Formbook)", "value": "ab2ab2e436903a1775df28dd0b322044", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483376, "uuid": "b03fdd75-ef94-4fad-9055-7f64410112f8", "comment": "Malware payload (Formbook)", "value": "cb87aec2f88166a70cf6362a435fe3d36576eec45809a9b72605e6fba1d740ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483376, "uuid": "693883d1-7bd3-4752-84c8-ab172b47f2a1", "comment": "Malware payload (Formbook)", "value": "490e26ca062bf1ef8d5f38afc21fc5e4f8fc6932", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752483376, "uuid": "41aacd41-6972-4bae-bcf5-0aeb814bfffa", "comment": "Malware payload (Formbook)", "value": "7ede7134a5cb82befc2b04c432140a54dcd624e27c5abeb9348d95183336604087e53edb0c6ed9fffc606881249a8106", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752483376, "uuid": "25934685-eeba-4306-a543-72a6907c0b64", "value": "T17D4654C6EAF19FA4B2482F983A343747C8ED41C7EA4210F452A8D536DB7D629C79D432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752483376, "uuid": "65c0f310-7012-4eba-8f3b-3cc621340df7", "value": "98304:FCjQXVV/ajnM2HVLVRrBgPBEB4OTa6+BL+hWs/1H0L79371lPnKYz7N479gCC5lR:FPcnM2TViI4OTa/BKhWs/VY9k+em7tmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752483376, "uuid": "50c7255e-7399-4f5c-b45f-16fea3401e9e", "value": 5631426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752483376, "uuid": "5282f049-28a6-4c60-bd5f-c276ecd36e80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752483376, "uuid": "bfabdeb9-d346-4e2e-aafa-dab0698af805", "value": "nowe zam\u00f3wienie zakupu pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf81fe1d-610a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535950, "uuid": "6454a584-703e-4129-bc95-19d666a1911d", "comment": "Malware payload (Mirai)", "value": "c98dd59b2d4a6b62aebb6ff6a0fd3367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535950, "uuid": "e595f68b-aef5-48d1-96ac-c5b8b16794f0", "comment": "Malware payload (Mirai)", "value": "cbfc02897f1aaaffa74c0dfce3c1cb294a2f2730cc4d400b556737d77e0b902d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535950, "uuid": "5f1c5bb6-3227-4ceb-881e-41b48e93c637", "comment": "Malware payload (Mirai)", "value": "881078a0e7e518e792b0e575ed0b94fbcbd60880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535950, "uuid": "d92442e7-8968-432c-b17f-23cf5717f4a4", "comment": "Malware payload (Mirai)", "value": "8303d5f083781799fd0dc8e9c168ea614ffbcfd50f79998e8675ce2b10ed7feb80cae2d0ac65bc73d025727f4f52b0f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535950, "uuid": "f491fcc1-61f8-47f9-b4db-9a7002f62aa8", "value": "T1F963085AF8824B12D5C1117AFE4E164E772317E8E3DEB2139E24AB207BC75670E3AC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535950, "uuid": "23a31b4b-ba0d-4613-a683-1326a2ca694a", "value": "1536:wlnHhwxNvNara9AKzeI+iGFI0jHnKU5nYO/K:dYra6FI0jHnKUxt/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535950, "uuid": "d15e1354-5241-4ef4-9657-3734cf9cf034", "value": 66872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535950, "uuid": "7633b460-3bbb-4442-9311-e789bf96e704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535950, "uuid": "e762a0a1-c3d6-4536-8aa9-7c12bf42d724", "value": "fsociety.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cd8404-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752514493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514493, "uuid": "3887ddeb-f76d-453a-b3cc-8f7f2ec4bccf", "comment": "Malware payload (Gafgyt)", "value": "4ea7eb7e73b2a941a0908c83e42fd216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514493, "uuid": "c1fa1996-fd42-4a8d-a2a7-93e0b64724df", "comment": "Malware payload (Gafgyt)", "value": "cc892279ff8c8e0a545ce4691da5eaea697e3bc4bc4fa9c5b915752cd5e71c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514493, "uuid": "ce3fd96a-e701-43b7-9db0-4e4cbe9ab277", "comment": "Malware payload (Gafgyt)", "value": "0420b29b5d81a58e8898f5e75b46a3e17d8cfb0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514493, "uuid": "fff907c4-f9f0-405e-becb-bdc354c53001", "comment": "Malware payload (Gafgyt)", "value": "256c37bdbd78560d144e20cb1657c847380a209c3eeb9736a2683d02c219560411fb35ace6c49236ff8258fffc009fcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514493, "uuid": "7ede64ee-b75e-4109-bb76-fa7db4279e43", "value": "T19E64E7866FB03FFFD46FCC3780928A06129C599592A57F767AB0D504FA8620B49D3D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514493, "uuid": "1a5214d1-b21b-408f-91b4-20b75fc69763", "value": "3072:M53Tr1HZUzOda0JR1nSO6U6cPfH6FxZiNqLFDXG2FUXokytveA+o4Ic3K0L:M5Dr1CzOv0O6viNqFXG4MA+o4IF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514493, "uuid": "0b8f2757-dfb5-43fd-923e-d99df3e43281", "value": 311332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514493, "uuid": "e4c8ca12-a2cc-406f-880d-ddaa10e5216f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514493, "uuid": "d8a4ba22-d6b3-42c1-a596-8e37b589731f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135cda8a-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505140, "uuid": "00b2a566-a1f2-490d-b4e5-f9accb0fded9", "comment": "Malware payload (Mirai)", "value": "b09e1df06b828f6eba920a17750a42a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505140, "uuid": "05605fc6-76fc-4e45-a37b-2fd43bb460e5", "comment": "Malware payload (Mirai)", "value": "cc9d8f16f4e31a8c73802b27c41d5410a470d3f6feef0cdaa7922e9309861ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505140, "uuid": "69cceab1-f775-412e-8675-76bc113db493", "comment": "Malware payload (Mirai)", "value": "0804390eac71c8e269ab7564c8937e7e1ec837dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505140, "uuid": "f9ed4295-0473-401c-9a19-55777b3fba33", "comment": "Malware payload (Mirai)", "value": "22304bb978ee029fa954c1d53097fe42e46f5705721f06010b2752f1b25b77aa65ffb13edba6307a093d97550ac61bca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505140, "uuid": "28aa8084-7b9d-4448-a4c5-7e193d2bcc67", "value": "T106835B22BE761D2BC4C4A47A21F34321F2F6474A24AC8A1E7DB10D8DBF65A403257BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505140, "uuid": "6ef1d219-01fa-439c-91f3-fec579fee335", "value": "1536:GWD44Iwi+JBkYw/kryhcx1tu3o+5q8KtEAiRt5Q:GWlUMh103omq5t0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505140, "uuid": "ee07211e-f25b-400d-940e-f77b3d4a8597", "value": 83272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505140, "uuid": "e6737af5-7b0f-4261-badf-0a0a8ad00c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505140, "uuid": "37d2124e-e974-4f3a-9710-5ac684f29f4c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d69dbff-60a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752491440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491440, "uuid": "c81c35f9-1422-4857-8ba5-569e7b25f410", "comment": "Malware payload (Mirai)", "value": "41f957bb065b992acc18fa27570bed3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491440, "uuid": "9a8f1355-bed8-4955-a9b6-2ecf0c2cd7c9", "comment": "Malware payload (Mirai)", "value": "cd4acfb802dbde08ccd006736519b3f134246d0685e766d4c49308223e5b2132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491440, "uuid": "9a19cb7a-7803-4307-acc0-0f774d1f9264", "comment": "Malware payload (Mirai)", "value": "0ce4a63cd4868dd1315cfc84dc16df5fe7fa5f1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752491440, "uuid": "91677698-a013-4ba0-b8f5-378754c99516", "comment": "Malware payload (Mirai)", "value": "1fef31028a74ef5ce92ae94667a2b9afb82418d4e59bdee1e8e7a6eedfaa93b3967c5e4588c6fa9eedf83da9295ba6ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491440, "uuid": "fbd97e02-18d1-45a7-87c2-da176c4e6fb5", "value": "T1B0F22B26B7691A17D0E0527E10EB8F1668A51FC465D0D66F7E720F3AAEB63001C16EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491440, "uuid": "5c52aa27-4b28-4ae4-9177-d7cc486ed4c1", "value": "768:cufXfvJ4n2D8Eyy3hFI2I9l8c/8PiO0YJ67e0ETBLEyp9uH3h2F:cuHvJ4Ey9+Q8P3ii0s9jpG3h2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752491440, "uuid": "59d0148b-816d-4e7f-92f5-ade52fb64388", "value": 37416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752491440, "uuid": "f0ad3182-6001-4846-806e-e83ba272051a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752491440, "uuid": "35021da8-621b-4f8b-bd4f-3764b8ad62e6", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745e2adb-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485117, "uuid": "25487403-b5b8-4791-842e-d4f2ae8c5383", "comment": "Malware payload (Mirai)", "value": "b218ceba7d740c33c1b876b2bd441f0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485117, "uuid": "e4b5e09c-2db6-4765-8961-b4005c69b095", "comment": "Malware payload (Mirai)", "value": "cd718e2d69ce4db9c8b4acd0e237c664ecfb9353b375c8ecf537df936977cc28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485117, "uuid": "7fec986c-9b5d-4530-93f2-ed1dd05ce477", "comment": "Malware payload (Mirai)", "value": "405138912680e886d72a70b264e647da3ea17496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485117, "uuid": "72dd5482-69c0-42b4-9188-d58d1799f852", "comment": "Malware payload (Mirai)", "value": "913e277507a2234f0b2602ab8a14dbedd3b579118bae7f88fea8d61ace7060f19bd67d81069347d28192cdae8b6b673a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485117, "uuid": "d3020798-c14a-4d06-9ea4-628f5121f4a8", "value": "T1CA533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485117, "uuid": "69f99484-20d9-48bc-9dde-c80e25b2327d", "value": "768:me4gpsM204GEkRbjveXQonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozNE7Pf:mo3EkRbDfDiDHIFy1X48B2SEzNfAuJ7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485117, "uuid": "33f2a0b1-1737-4aae-8515-cca80a2e4410", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485117, "uuid": "445f1573-130c-48dd-b8ef-ff92d9a86f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485117, "uuid": "6252842d-e124-4e8b-8a18-d4f4599d923d", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdbf941-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752494390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494390, "uuid": "6ea2bf47-18e5-4084-80ea-dbed2053b7de", "comment": "Malware payload (Mirai)", "value": "685e2ad5417a4b25a2a37fe94cb91f87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494390, "uuid": "e4031ac4-5b87-4006-b468-33c89ba8e513", "comment": "Malware payload (Mirai)", "value": "cd8051b9112aa0cfe3ddfda5a0db2f724bf3f63eb3d3f7e3d8a0754b23bf5b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494390, "uuid": "94b7fc7e-19be-4437-8685-c492156e124f", "comment": "Malware payload (Mirai)", "value": "893103d314fe077224d4551272cede03b5dcad83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494390, "uuid": "8b7d784d-7e74-4e9d-bbbe-af8ebfd16f8a", "comment": "Malware payload (Mirai)", "value": "45546c9262f024c8afae09bc14bc92da39578c2172b0fa3657743b3c8ba81fc2f66400971ebbadbebb3c1d4aed273ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494390, "uuid": "eede18b5-0777-4835-8975-4659a02af417", "value": "T1C9A2D07435A518B7D6B048729E6CCC4FE30301B5A0F6376A16309BB8D9AA0DB60F8ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494390, "uuid": "e8fde81d-2c98-455b-bdf2-c9e203499f3c", "value": "384:wp7jNNWEIMtDaZb615qAuv02+Cl07o0rUScQPKKivBhymdGUop5h8Qf:w1hNnztDYbMsPMklio0rlPK9Zs3UozyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494390, "uuid": "40c8dd69-8315-4618-a567-1637b7ecbd7e", "value": 22144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494390, "uuid": "4ce456b6-f4bc-4d7d-a6b2-578c994b638a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494390, "uuid": "ee3f86c8-7735-4aba-8421-b94ca4683886", "value": "top1miku.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b4fd39-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503698, "uuid": "627f8a90-fba3-46f1-90ab-a9af98ad3936", "comment": "Malware payload (Gafgyt)", "value": "30d4a39711bc7f03a7d9b113bf7b1ef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503698, "uuid": "a8162af2-78a9-40c4-9138-1c9dd614591e", "comment": "Malware payload (Gafgyt)", "value": "cdac8c039699c1b1bd7e36aa92e3d859bbbc80f7dce77a40383ce56ad073275f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503698, "uuid": "f83c9acd-c2fe-4df4-b165-ad37c3035793", "comment": "Malware payload (Gafgyt)", "value": "5113e5c523fff737f27dd3677415503ba91a83b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503698, "uuid": "8ad142e7-84e3-4cf2-ae91-c27dc9fac2cd", "comment": "Malware payload (Gafgyt)", "value": "f785d99ec806053b06d98a42e51113adac7db1b0093656c98b0e43bb692522a991801623f44dd84b3fa69c79e7fad818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503698, "uuid": "a7ae26b8-0f20-40ab-ba84-1612e22e9527", "value": "T19A833A77DB18D958C9634F70A2A0CF384BD398D845931EB743AFC935A047A9AB2583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503698, "uuid": "27516359-0bbf-4e46-9af2-99e0e5426f41", "value": "1536:FXe6m/KU2qBYW8lWKnh3YYnSSKq99dgBJoxQrFLR7CCVT3vYFs:V/8KRKYWO7oYnAqOBJdX7/vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503698, "uuid": "3da2a129-70fc-4840-9892-15f883503794", "value": 83564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503698, "uuid": "edf1f603-4567-4ddc-b236-ff4147e7746a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503698, "uuid": "88ab0288-81d6-4aa8-a8f2-fead18852d33", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a84274-60c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752507213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507213, "uuid": "f6432141-c2dd-4350-98cf-ea05eef22ec0", "comment": "Malware payload (Mirai)", "value": "36687ac8d93d69f479cbe6cec79903fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507213, "uuid": "683f921d-4889-41a1-b813-7bcf22d5b39d", "comment": "Malware payload (Mirai)", "value": "ce5ab573623ba82131f025e2ac0f83dea675521931a8e17e332e0031e9a57f05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507213, "uuid": "7b09c69d-9331-4529-9193-7b73edfc2def", "comment": "Malware payload (Mirai)", "value": "7548c960b3ecfa93a3648ab7b08e6efd20459906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752507213, "uuid": "3ede42cc-cd37-4096-82a7-a205d93e488f", "comment": "Malware payload (Mirai)", "value": "1bbc5c50f2b9db357334b4a02c13cd1002e7695aa3e70a4a5de34d5ab56eb9d950d6f84213b9467e69e17a7db7587162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507213, "uuid": "11cbbc5f-93fb-4487-b7e4-34dda607e75b", "value": "T14215BF8DFBC350F6CC5202F30926A3AB5F72C9285134DAC6E7EE2C6A9C62B51651F351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507213, "uuid": "8b2d9519-414a-4472-91d3-828113b2f73e", "value": "24576:bBink9/qiPEvyTfKrpcSL7HvVbvLChkbSD:1WbiPSyDQHtbTChkbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752507213, "uuid": "702db0ea-ce32-425b-b429-98e52180aa59", "value": 877456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752507213, "uuid": "02e9f32d-dead-4acf-9d15-f3f1011624e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752507213, "uuid": "b5c0a082-da52-4c2c-bf40-ee6f029b872a", "value": "busybox-i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a8f0da-6076-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1752472232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472232, "uuid": "6f55c5d7-15e2-488a-97e9-f5eaae27f443", "comment": "Malware payload (PureLogsStealer)", "value": "f8d9c2a8d8bc2dce633e3d49baa195dd", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472232, "uuid": "beeea8c6-4e19-4fd3-8080-f5aeaf3a0ce2", "comment": "Malware payload (PureLogsStealer)", "value": "ce789749e16a87deea5b7ed25a75e8ee5e6019ac398505f49210d5fd132278ce", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472232, "uuid": "7023d096-9b22-4877-9850-da587829261d", "comment": "Malware payload (PureLogsStealer)", "value": "24b18530172fd816d10d9b426a8a8b00c72d84c2", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472232, "uuid": "76083d5a-6a52-442b-8610-b22dece04fdf", "comment": "Malware payload (PureLogsStealer)", "value": "53602925334cf3a32bfca6533ade18a36c9bd8b1e7d608a8a5c6451e019bf4f88d057410eed2925d79a6a883b8f1430f", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472232, "uuid": "b2c87b87-8971-4a12-be36-b71aae1154ce", "value": "T1C2D5AE9D84B09CA26064FF34EA85F7C78CE943852A2B0B520FE595963342C43FEA7775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472232, "uuid": "7cc01068-8713-46da-a951-ad262b0fc9cc", "value": "24576:JFkaogqaRHmDIxYgoyUFYXrFNb4XkvQiFW//SurdIYu1QaloAG6Ag0R:rxt/QJS3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472232, "uuid": "aee4d749-0d35-4d08-9bf8-5788be912af1", "value": 2888784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472232, "uuid": "4b557ee9-df05-48ac-aead-41cb5d0cc407", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472232, "uuid": "ca85c6c5-5769-4cf4-8842-a350c985ba97", "value": "Purchase Sample.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb91165-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752536969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536969, "uuid": "ebb8a722-f713-49fa-bb7b-6f8fe6dcf639", "comment": "Malware payload", "value": "54c4b25ca5a105abb8d42996e1739c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536969, "uuid": "9ab281a3-98f3-4940-9bc8-054eed0a11fb", "comment": "Malware payload", "value": "ceb8e519abfdba1a6487e10f7994445275e84e6f1c09ddfb44f8f24da99b13b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536969, "uuid": "16a298f6-339f-44d3-af54-be0ec8f50a39", "comment": "Malware payload", "value": "cd0a8030b40e87ecce9f5c70f194bc49a9e9f78b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536969, "uuid": "4366ad3c-336e-4089-a593-98306c6a4a34", "comment": "Malware payload", "value": "faff321dd259589dc0a6901471533ed2c68769891ee7ec6360ca9e33166c400cf88974638543dc865e0405861d8cb634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536969, "uuid": "909ef1f5-f2a3-46fb-ab82-b1da0a8d584b", "value": "T1F68533B7183887B8EF1749C21ACD9401A07AE2A7F45537F1005554AA173ADEC63FBB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536969, "uuid": "6ed1c281-76ff-4517-9f6d-b6e3be7243f1", "value": "49152:yBKEUaLMRRHsafPkAelrYtPdWyE2nDbcDzBs:ysE54caXDem8ydss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536969, "uuid": "8b7bc91e-23f4-4509-82a4-d2fc764cc80c", "value": 1792856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536969, "uuid": "bf1f6c78-f48f-464a-9148-65eef3951bbc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536969, "uuid": "bfb5cdf0-780d-4b9e-8f61-445dfee2b953", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094d4050-608b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752481072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481072, "uuid": "35ed89e1-ac41-4311-9674-e8acc113872e", "comment": "Malware payload (Gafgyt)", "value": "1bba11f5ed7b5361ffe6ddb396ec2e3b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481072, "uuid": "7e12a085-db91-4ed1-b5b5-6585442da141", "comment": "Malware payload (Gafgyt)", "value": "cecdffc4277b378397b4a463e8e335fff84a9e5aed34b4b1a4e4f5bcd4eb72de", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481072, "uuid": "fd7af8c4-068e-4896-8a3d-feb7ce40aafc", "comment": "Malware payload (Gafgyt)", "value": "10697db6a769838aa9de040edf015f54a3313073", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752481072, "uuid": "50a928ba-b1fa-4d0a-99a9-b85c75a396ef", "comment": "Malware payload (Gafgyt)", "value": "542f271e5e95f55087ea6925778ab190cb1e80eaa3b268e0ff418a19b36b739cd40f0a93eafe36d36185be63f75a2520", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481072, "uuid": "62a65d1b-83b5-4aee-903c-8962c4be7088", "value": "T105413986F2910EF42C90D42733FA845034D0A4DEA6CA5F8F6DDEFBE8488DDD86605693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481072, "uuid": "ef28afbf-9b1f-4349-97d0-9207970239a6", "value": "24:vkaAhkI80dSxkJk5ogktklTkhkFjk08kCskFjklku:vjAheSW++TKSZ8dsSeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752481072, "uuid": "48ec4e72-26f9-485f-9c6b-a9a8b09f7d2f", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752481072, "uuid": "9ea9337a-3872-44bd-82f1-a0fece0de8d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752481072, "uuid": "cba3f1c7-d530-4f5b-802c-35ce5f9c2f79", "value": "SnOoPy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156c871b-6109-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752535209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535209, "uuid": "aba81e25-63a5-47f3-a5bd-76c5baaf5630", "comment": "Malware payload (Mirai)", "value": "4034083b96806826d756f12057bdbcc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535209, "uuid": "dc6995df-e443-4312-969a-350a191fba4a", "comment": "Malware payload (Mirai)", "value": "cf183e09a6d360c25db8cf39377f702d808ba587f55caffa2b3b823b4c92ee17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535209, "uuid": "1a248918-77de-4012-b9ec-1c017aba1537", "comment": "Malware payload (Mirai)", "value": "7aae5364233ee2fea53ea84afdec97975ebef7c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535209, "uuid": "b824144b-9707-4787-ab37-5a168b30cccc", "comment": "Malware payload (Mirai)", "value": "860d50a51c65ff752493d5ec6ed9e50fb596016d6017a00d2f40154514b50e7b18ea745f8fc4b5489bf8ce83ce48dd6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535209, "uuid": "151bba6c-7a12-497c-a992-843cb5543097", "value": "T179937CC5B683D4F2E99741F2553BE7365733E0395019EB83D328E932DC91A50EA2A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535209, "uuid": "9bb7ff29-70f8-4bc6-9621-70c68a7761d8", "value": "1536:5RMl1OY7kZT28Wh/0YkoZId08LLyxNAD+YffsGpttDSR5/c:PMP7kB2WYkoCdVLLwJYXsiOrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535209, "uuid": "52a0b207-a193-440d-8559-4ce22fe09a6e", "value": 92744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535209, "uuid": "a6cfd9b9-4903-4f89-9bf7-63785ca1c9ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535209, "uuid": "24c4de40-1290-4809-9751-914a5b236d46", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f676ff6-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752536970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536970, "uuid": "e5bea38b-e65b-4c30-929e-947d9b54f12f", "comment": "Malware payload (Mirai)", "value": "dda8acc16ecc0c86a3a162928a1c8eb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536970, "uuid": "58e13898-9d57-4d16-8842-a796a9040e4d", "comment": "Malware payload (Mirai)", "value": "d01e8a20c386e43b01e5d6db77c6eb0ad432aab791d8d55e28031481ace724c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536970, "uuid": "4a9ae261-71a6-4e5f-8a24-6a0bb2dc0ad5", "comment": "Malware payload (Mirai)", "value": "384531f4dc42b410b58ad5c2a477d1d2bf21037f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536970, "uuid": "a78800ff-a8ba-4d89-a362-33df75ec611b", "comment": "Malware payload (Mirai)", "value": "ae77dc1df184cbb48cf6f080acd8b66b5f033ead956e7512f4c2c4073fa9033a68890f01757946c2a83eceb6b09b95c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536970, "uuid": "a6a70117-37ce-4591-943d-c7353d12250a", "value": "T1C4B3C71E2E219FBEF369C33547B74A30975933C622F0D685D26CEA151E6038D681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536970, "uuid": "193a4ead-0022-4be0-8ee3-83c4b1404898", "value": "3072:5A3VH8WE94YrVHMyOmHQc+CDYjj5TWX5rfnA4l:K3VcWE91JOmH3dYf5TAZYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536970, "uuid": "98c2ba4c-b449-4d05-8ce7-791f24d0662f", "value": 118004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536970, "uuid": "586f644d-c3d4-4aa2-9be7-a68af1b938ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536970, "uuid": "1a18af6e-3bcd-463f-aa4e-0fb3f1b8fb1e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b38afe-60c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752508063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508063, "uuid": "05c5b4bf-0518-4a02-b0d0-8cbe0506d6bc", "comment": "Malware payload", "value": "50b6d851ca98b566f93d74cd73b98387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508063, "uuid": "5e8b8158-5f32-47a5-979f-521e9c937abd", "comment": "Malware payload", "value": "d029e62e1e9b6b134b70c44d0a8e83b71c448155e8ad99b2ed90cacc31b1e7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508063, "uuid": "c5bed515-066c-4ff2-bc5f-c18cbe7dd1a2", "comment": "Malware payload", "value": "5e6f0cef0769bee006ea19bfb89f5fb582b71bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508063, "uuid": "371573c0-1623-4cfe-b9b2-2327df640418", "comment": "Malware payload", "value": "4324838092436d05ebd8eb0b82590c185d14f4b16accc3ee201ba94fe976a8d093dc7e23c5ab245c81be1eeea083b3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508063, "uuid": "c352bd3c-3aa3-484f-a944-cc88057d3f56", "value": "T194A63385B1724C47EC73F2B9BC9FAD7E42C15FCCE0D8462225A97A4E1E3E6099921D4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508063, "uuid": "2ce8935b-2907-482e-8c97-6084019079af", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508063, "uuid": "a36a7a3e-670a-4d80-8714-97478c8af80a", "value": "196608:Nd1kLjHoy5nf+k/d7rEooZd2rSWJ3u5meChXA6BAN+oP0icSN:/evznf+Wd7rLAe3EmhXA6BNoP0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752508063, "uuid": "e6211b7c-6859-4642-82df-723ffddbb3f5", "value": 10370048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752508063, "uuid": "130f9d5e-9f5f-4100-ad5c-4bff63a7aff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508063, "uuid": "1e7a81eb-bee4-47aa-9c5a-513f835c3cce", "value": "Installer_v239_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b639db-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752479879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479879, "uuid": "56cc2daa-8075-4bd2-af70-795571cc199d", "comment": "Malware payload", "value": "f5245772930b12c8d0ce71d18e860acb", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479879, "uuid": "9e3d5584-3a7a-421b-8159-6b1865f7fee9", "comment": "Malware payload", "value": "d06f784888ad5e8069f328a79dfb60110c4ffee7eafa56dca3e986ae8e1641e2", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479879, "uuid": "95a9a8a4-a6b0-421a-9f9f-956e5945b03c", "comment": "Malware payload", "value": "731eb71a583677afd974635a60d0a9a10a01600c", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479879, "uuid": "ba565867-5851-42cf-9133-a32b49a399a8", "comment": "Malware payload", "value": "45cbafb6b1345ae5f3b882a418b98cada88205312bca5eeaca09b546b4d434f13123e5c4ab439d884446764c00a7aef9", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479879, "uuid": "ee96af38-db76-4d41-a584-36d3a77bae36", "value": "T1E2F09751D9C5C83C81348B15A6F0E89CAB13A88342C40489F9C835971B11AE11D830CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479879, "uuid": "121d9a2a-429c-4579-a811-366502dac37c", "value": "12:TMHdfptfvqUWt8GC/Kyt/vcIOMf+xlWSElyL9M:2dfptfvqUWtvthMqlWSxL9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479879, "uuid": "05a711a0-0180-4849-943a-e4bf1197f07f", "value": 472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479879, "uuid": "7e8907c0-c57e-4594-a584-787ec00b4173", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479879, "uuid": "4f8e280e-b39e-4fe0-a208-f9943bd248dc", "value": "Rechnung_RE2502005.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b3ecbe-609a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752487916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487916, "uuid": "555ca39d-19b0-44fa-9c47-4dcaf4f51ee7", "comment": "Malware payload", "value": "684d94c2b5b3de9095670f644f6295e7", "object_relation": "md5", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487916, "uuid": "34e9e825-e937-458f-aef5-78dd5f037706", "comment": "Malware payload", "value": "d0a891f47f818340d73c9cef9ae28556d4de5319fdd60139e2260a0340a5d634", "object_relation": "sha256", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487916, "uuid": "2b19271f-ed2a-465d-9d92-00a01be45a73", "comment": "Malware payload", "value": "70592c2f6e9859bef579025034c92cc430e3a827", "object_relation": "sha1", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752487916, "uuid": "2b637e8a-afd1-4d25-813f-902e1f7798cb", "comment": "Malware payload", "value": "4051e57a442ef6cd45a8c28ca4f8dad5ab248b5d6f4f9c82839e29dcc4a8d8587a1df244bb44f9009c473c419a99f800", "object_relation": "sha3-384", "Tag": [ { "name": "LLC-Vtorsintez", "colour": "#C7C59A", "exportable": true, "hide_tag": false }, { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487916, "uuid": "824adee7-e2fe-420f-af72-5945dde0eb9a", "value": "T10A6286B05600D8D0D95BAA72BDBEABD8E1350237DFCD1BDC01647BD02EF26255E4D88A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487916, "uuid": "72411a75-26ae-40e2-a110-8d74cb0b19fd", "value": "384:aVjQzU2848v6YJVk7j5qELYLIwnBy5ob5NaIW82vjw5:20zU2848SCYj1YLIwns+VNG827w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752487916, "uuid": "90411473-d641-4c46-9804-5170ab96565d", "value": 15665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752487916, "uuid": "5e707b10-0dd7-4c93-a8cd-eb9a4bb8d9e8", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752487916, "uuid": "60b5ede0-2cc7-4a5b-8e08-ba2874b1a5fb", "value": "LICENSEw.pyc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9171bd1b-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485166, "uuid": "7a0bbbb4-f452-4f09-9882-60029f4aedfc", "comment": "Malware payload (Mirai)", "value": "0ebb4c7236fe8be0ca388caca1f30fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485166, "uuid": "ac0d0e36-d977-43e0-a764-a68b9e013a57", "comment": "Malware payload (Mirai)", "value": "d0db2425e96a3eb794bfd94428c403bdcf46103e89658781aa083f95d83e5989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485166, "uuid": "56f5b28b-cb1d-4e6f-b9e4-bad96ab5322b", "comment": "Malware payload (Mirai)", "value": "3e8bba808e59a01397dd6450eb532ab486fcc2fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485166, "uuid": "d4017366-e18f-41a5-87a3-5d7c89e80e67", "comment": "Malware payload (Mirai)", "value": "9691366c4efec2016efa2e2bf02fafff9746e91b50cc75d252c3f4fc75cf53fe0732c6b56e8ffd4513066f30c854385e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485166, "uuid": "82ca9fe4-201f-4c22-8fcf-73c49052e3cb", "value": "T107630891B881A626C2D1137BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485166, "uuid": "5f421fa9-db8e-44f9-9c03-7f745046bdcc", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485166, "uuid": "35ef49a3-8f5f-48f4-bc93-ba5ae3f5e609", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485166, "uuid": "394e22dc-4968-4745-907d-9f8adedd84c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485166, "uuid": "715c4875-197a-4c3e-ba26-7d2dd9c58be9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8490cb3-610d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752537253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537253, "uuid": "b9f6f6f5-8a58-4174-b1ce-768ae8b8edb4", "comment": "Malware payload (Mirai)", "value": "391743055d56ecfda1e7e862e891e757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537253, "uuid": "82ec3a38-62fc-43c5-ad40-7cc24a96f225", "comment": "Malware payload (Mirai)", "value": "d0e3df73040b36346c200a5b5dbd2f975354b3e061727b412294710f69a40307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537253, "uuid": "15e2e821-ef9b-4091-ba44-60e8190dc4fb", "comment": "Malware payload (Mirai)", "value": "8fd17aaa9666ac1089f8773a4ccec40182ce4b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537253, "uuid": "59415611-0e8c-4688-b0cb-c7a31699dc59", "comment": "Malware payload (Mirai)", "value": "42b0e3fd6b161d1ae235548bce7ae30ef0dce8cd586fb832a79c9a331a25a5d5e97a8f68f41b16049c0ff42ddea6d489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537253, "uuid": "55031642-5c93-487c-928e-676bc313a816", "value": "T1B4933985B941AB26C7C116B7FF5F028D371657A8E2EA3303DD285F60778B81B0E27646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537253, "uuid": "0856ddfe-213b-47ba-9092-b850b9782c84", "value": "1536:m9o+5VtIND2rcxkyKQYknIkxvfNdfU2Q5IKNYFtgakXqd/l1Oi1wdgjuIiTvoWne:m9ouIh24xkKYEvFdM2MTNOOakXALA3ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537253, "uuid": "638a0179-fc5c-4953-99fc-9886b8d74a32", "value": 93900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537253, "uuid": "09c928ee-ecca-49b5-9938-d48f71fe52e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537253, "uuid": "d79bb1ec-7f8c-48bc-a23d-f620f8082bb5", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d908ac0-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528484, "uuid": "8f221ca5-9fd8-4a1a-8d20-9381d460cd6d", "comment": "Malware payload (Mirai)", "value": "f93d3083f8eaabba23992c465743b227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528484, "uuid": "1ce3cf0b-8898-49e3-adf7-bb90dc8361d9", "comment": "Malware payload (Mirai)", "value": "d11f59bf3a006f9436252300de093d6ca84abf40c099017ab4be99a562eff3a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528484, "uuid": "6d58b259-5ff0-4b40-9633-248a6ee3878e", "comment": "Malware payload (Mirai)", "value": "fee63df5605a43ad0b1569ebd298718d63bd1a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528484, "uuid": "31197a61-0f16-4307-815a-a7a0b4fffa2f", "comment": "Malware payload (Mirai)", "value": "c5cde7c7060eec67dbd9daa55269a3d2701198f58ecbcb5f522de290647edf68ee882c9e8409053e62d71be37480999e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528484, "uuid": "865f69ee-1d97-4615-a44f-fd2a70d0eef1", "value": "T117B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528484, "uuid": "73a04245-e56a-4cbf-8fd2-feb53c6e6dac", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDA/LWW:8YSZ3e8ZE3MYlphDgDAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528484, "uuid": "beb4e463-5dba-415a-99bc-9e0971674b62", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528484, "uuid": "a24a5ebb-d173-4e25-bb83-acf49fca2464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528484, "uuid": "4e450dca-e45d-4a1a-b7c0-0fd521622400", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9c19e3-60e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752518073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518073, "uuid": "5af19eff-d554-4fdc-ac59-6e61d56b353b", "comment": "Malware payload (Mirai)", "value": "5131615e2a4b011a53a521b1be3f822e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518073, "uuid": "f46a8253-65ce-49e3-93d8-ed96d129ad27", "comment": "Malware payload (Mirai)", "value": "d1b06b6db3eb3e14adcd3cbc39d4f15fdb8d13d47bb6145eca82d65d07684e2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518073, "uuid": "6725b84c-1012-409f-9312-4feeb414481d", "comment": "Malware payload (Mirai)", "value": "5912bc2036f29621087c148791d688f45611aaa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752518073, "uuid": "7a925b4d-c7a2-4149-b0ce-8e66b1c654a7", "comment": "Malware payload (Mirai)", "value": "f6fe3db309230e3e68536a89b7be7cbed4538c042641b4d301c660e98bda59620985c64c8d788d5211f071e69c7399ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518073, "uuid": "2dddbbbf-a3c0-49ff-99d3-717e33b0ab19", "value": "T18803E1DE7AA9240FC52F5CFE60CD12362B03F601B193877A47065D685B7AC6BB5C5234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518073, "uuid": "c3ca1dbc-1de0-469d-848d-0dbb83a29fe2", "value": "768:brwcKxuovfgZ1pt6ZUAEsIC/N6/cXnoITOw17Wfm42Rb4YCdWsfGn1gX/5WO:XwrHXg9tg/2cXJe+4gBCPO1gvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752518073, "uuid": "8e257cb3-db3a-4ea0-9cfd-eb33eaaa0fe1", "value": 40824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752518073, "uuid": "2e07ac6e-3fc4-47f3-92ff-333ef34d70b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752518073, "uuid": "d3de46e1-2a98-49e0-af84-debb8b445aed", "value": "top1miku.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceab9169-60fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1752529506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529506, "uuid": "c608b971-a799-4fd6-8309-fca74f411ab0", "comment": "Malware payload (njrat)", "value": "5834608fb0c5d515bd71126fae1de28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529506, "uuid": "582c04ad-43c5-48d6-bcef-b0ce4b9d7213", "comment": "Malware payload (njrat)", "value": "d219afc52f2af04122538b0354f0a9eb4c5749ba272ecf2701baa7302b25f3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529506, "uuid": "72da9e75-6705-4a52-8bf8-c179d912aa49", "comment": "Malware payload (njrat)", "value": "078f3f24581419f74305580033a97de10d9d48b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752529506, "uuid": "7dcb891e-e5eb-4b0e-8697-56e42e9352b4", "comment": "Malware payload (njrat)", "value": "fc3395c6c4ffbe67942ef787f84e8b36f55e022bb63273245e8b2b8ed864ae8fd7be6c603960bb9236368c325c47308f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529506, "uuid": "41004dee-73e8-46e2-9060-affea874608b", "value": "T11ED36C2439FA401AF173AFB69FE47596DA6FB7733B0294691091038B0B13A41DDD1A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529506, "uuid": "c373e610-c645-4991-aa2f-d8000931f2dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529506, "uuid": "fc52ed46-46ec-48a3-b0cc-056c6141d543", "value": "3072:UXDUbWbN+M7YTrezqy79KLWP/t0gnV3vvU1yQr9+:ANs3ez55JPLV3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752529506, "uuid": "3f5e5168-cd64-40ac-82df-245c0de3eff0", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752529506, "uuid": "2daa7291-5528-4b95-a0de-26f1b870280d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752529506, "uuid": "467401a3-75b8-41ef-b2ed-c2a8b68c5862", "value": "5834608fb0c5d515bd71126fae1de28c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86395680-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479993, "uuid": "b97e0df9-8f1d-4196-8bbf-e7dfa3ea964e", "comment": "Malware payload (Mirai)", "value": "8240ad4608145160f2fa795c8f5baf2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479993, "uuid": "7060a635-88a5-43f2-be11-fab95ef5d6df", "comment": "Malware payload (Mirai)", "value": "d2f7207f029f0f4af18b3794d44594087afef997a0522d0b08e0d4bbea71b54a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479993, "uuid": "2fa6aeb4-0a1c-4c93-93b7-f1571afa34f2", "comment": "Malware payload (Mirai)", "value": "3581f0734f0773e61516006b6e82f2a63081a146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479993, "uuid": "94e0a870-1e44-486c-a6af-cdc2569c102c", "comment": "Malware payload (Mirai)", "value": "87620a71c1fbf2536a9d986d8db5ea45a6e51f7973c90d822f67c003f9259aba8bc5e368290b3c972970811fdc21d497", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479993, "uuid": "6e5fddb8-6484-40d3-93c0-447fee614d1a", "value": "T1D313E1BCDB0501AACDA340F48EC157891FB58F93B087A845B81D49E7959A2EC3C7BDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479993, "uuid": "651214dc-5e82-4e25-b758-e63d56a04c8c", "value": "768:ngGilyrG5sGtLIsuY34zPjiG3fpJqDs1NoHbit8H+AmAhGD98IXmG+43FU2JgGlc:zrdMIs5keG3fAsnoWTAmCVQmG+43FUiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479993, "uuid": "d0dcf7a0-a324-4b17-b34e-4fcbde2a1c8c", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479993, "uuid": "6b6d6a49-ba6d-4320-8cfb-b0cab7e6f04e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479993, "uuid": "38284138-06b1-4e58-b476-3a47cd67984f", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b3cc35-6077-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752472477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472477, "uuid": "3aa98525-ffd7-41a5-afe8-4fbcfd7e8d68", "comment": "Malware payload", "value": "f0807f26da7d9753a70b5679a43839ce", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472477, "uuid": "d1247b0d-f6c4-4083-bd5f-d7e41645984c", "comment": "Malware payload", "value": "d366b6723d9dff261a1c6e86de424fa3b4b1266638435139ebcd0e7dc24325c1", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472477, "uuid": "3ca38aa4-ab05-48dc-809e-b05a8d2ec8a3", "comment": "Malware payload", "value": "cd2251bb1c4c5398150d8f504c520fb15bcd4e0e", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752472477, "uuid": "5b946843-043e-4daa-adf0-3a5d0a3512c2", "comment": "Malware payload", "value": "65cb2e7871859ca98169528287cbfd6b3080548b53611a8808d29c9ae000e956618c3717a90e465f356fe80ff7a46f0f", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472477, "uuid": "7066691a-475e-4841-89a0-b6dbe44a20c8", "value": "T145F2CE36A2945D0DF8C743DABA65B90F653CFA1346D0BCA674200215ED81698FE22BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472477, "uuid": "7e79816f-193a-4c58-8d0e-3828ed948626", "value": "768:E1iBwGJtUUsxiEoTvt/kj6wd40aC2J7Q5g1qwG1cvLk8Vn:E1iBVTvFI6wnajJ7JqjIXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752472477, "uuid": "7cf3489b-84a2-45f6-b9ac-88da9e8715cd", "value": 35372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752472477, "uuid": "16e6e02a-236c-4451-8a2b-5037cc719988", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752472477, "uuid": "6b32ab47-a613-4fec-9ce7-05e965ab6740", "value": "42b93aa3414ba3b61c82f13a4f612916.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06a9e6f-6047-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752452200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452200, "uuid": "7b4f1d57-fad7-4291-b603-3d01ea03bf8e", "comment": "Malware payload (Mirai)", "value": "13cbb968726b9f7c201dcfece11ea3ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452200, "uuid": "8f31c084-4469-4571-887b-1f6ecb06a718", "comment": "Malware payload (Mirai)", "value": "d383af5cfd3e96e9b484de5846ebcd69e0fd1ab643100747aacdaf10f1653659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452200, "uuid": "29f60849-d006-4d8e-80e2-07750fcde19c", "comment": "Malware payload (Mirai)", "value": "b4bd4d490f4e35082c07219310e469120dd91a32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452200, "uuid": "f53ed279-56d7-43ab-a114-9c5834fb72c2", "comment": "Malware payload (Mirai)", "value": "9dcde2f688e05d5c809e28220c9221b473282744b83ba09660fb9c797bd4032d24765a9e307454e359ab595969a481ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452200, "uuid": "8afc15ca-a28b-41de-a72c-cc7a6cbd6d43", "value": "T16E533B32FA3A1E17C0E1A47A21F78B15B5E51ADE25A4C64E3D730E4AFF606406503EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452200, "uuid": "46ed6e88-4d22-4e32-952b-589477d7ea45", "value": "1536:FwAyzn7CUeYtuItYpKAsTfBwbYnLUnWbfiV0E:KqYLYp7dWy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452200, "uuid": "14f8ad7f-8fcf-4537-9faf-00d48b643dc4", "value": 63496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452200, "uuid": "f0bc029c-0a7b-41e9-9dc8-22983b440b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452200, "uuid": "93fdc64f-73b8-40c7-9fce-b3f7493be9cb", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab99e077-60b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752501101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501101, "uuid": "a63136f6-3664-4a66-a5b7-a26814ee15ee", "comment": "Malware payload", "value": "e15b5a4d760523035acecd801c0960d8", "object_relation": "md5", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501101, "uuid": "0d89a3d8-a70b-441e-ae0e-43164d351f67", "comment": "Malware payload", "value": "d3c2f6e53125c0c5037d5c6763d0ac8ce3c0f8c9bf19fcbc9f0621abcb7ba0fd", "object_relation": "sha256", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501101, "uuid": "eae24e05-329c-43e8-be93-4bec43b90b5f", "comment": "Malware payload", "value": "1916da9a6f8e631ed73172f3072fd5a1f3a815a2", "object_relation": "sha1", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752501101, "uuid": "9dec3d6a-1049-476f-b480-b5a886b2e672", "comment": "Malware payload", "value": "5629bf67c7b5d2af548300b93610c4e81f0328dc73e0564efa78d89c474a46d5619e0cb73211c2f0a381cc1b0800452a", "object_relation": "sha3-384", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501101, "uuid": "5fe535db-1578-4f1f-b336-d75a4f1e1446", "value": "T15D2733C8EB364032D867A3F6ADA98772B0C382CB64D1435D59C83D355F8A6EC671790B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501101, "uuid": "0a83a862-7651-4cd7-a1fd-6fb0c60b5194", "value": "393216:UvkCbpGN/6BqWxfgXrnqic3qaReEAkrdzwXcFSsU0L9GyFV/xOiCYjB9HnSPb:NCbpGR6BqWRg7nqL3nR7rRmAE00y7xO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752501101, "uuid": "66da828a-9599-44ee-a1f0-566ce7274adc", "value": 20762259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752501101, "uuid": "c6bfdacb-ecb9-4f72-9d2b-acf98a7fb5cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752501101, "uuid": "81e88912-2aff-401d-9cf1-9dcd0ab0504c", "value": "Setup$.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750b5af3-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485118, "uuid": "6d04beff-3c7f-477e-b22d-9cfe80e04753", "comment": "Malware payload (Mirai)", "value": "95b1810066b1b3f8378bba9146f1cc7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485118, "uuid": "fc8fe938-4b3e-4686-9821-dcf27d803d9d", "comment": "Malware payload (Mirai)", "value": "d3e71b6b9a9749d268c3a38b3a181f4409283e0b0577301acd113b344680d401", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485118, "uuid": "88827a68-6a83-4700-8341-d4d68239292b", "comment": "Malware payload (Mirai)", "value": "155975987bdda4e042692052bb859c74dba982fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485118, "uuid": "db1dc512-14af-41c7-9477-73da331de8a0", "comment": "Malware payload (Mirai)", "value": "5260cd1cc7d5a1e301c8e3cf7019edd7d9460864cfb209f30755a3421fbd6ca21beb853739dcb6511daea0bb6345809c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485118, "uuid": "5f2334d3-5999-4cbc-9929-e024bd948f4e", "value": "T18DE2E1A2D9FF0510F5AD9335048D7E890522DEBA14D79637AB50383F9418F1A3EA83D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485118, "uuid": "8f4e49a5-954f-4937-a22d-f785ce7634b3", "value": "768:BNfgaKaxi0xnVrtaJo7/2FD3TFjxIra9c+famh4gsxQnbcuyD7UHQRjy:jVFdxVrpO9Ira9fS64Rqnouy8Hye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485118, "uuid": "b30cedab-3e14-448c-84e5-75d3b2c90a0a", "value": 31648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485118, "uuid": "19d1dbb9-1815-4fb8-ade4-f3a174020e66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485118, "uuid": "24c33103-2bf8-459c-8448-90552b7534d1", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8222701f-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752479986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479986, "uuid": "c857c240-2470-4c62-8e4a-fae921eaa817", "comment": "Malware payload (Mirai)", "value": "6a6b911ace00fcb076b1404e8a57c81e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479986, "uuid": "cedc4208-3c99-4a62-84a7-9946345c9432", "comment": "Malware payload (Mirai)", "value": "d423ded7d989496e17fb1446c2f266240e8d2d3a19c55d2cf3fd3736d057be0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479986, "uuid": "56cf26b8-4d74-45cc-8827-25592fa85224", "comment": "Malware payload (Mirai)", "value": "4a617e0b08b7d416ea1a348e76080bc2f90b52c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479986, "uuid": "b3af144d-6596-492d-83fa-907676b8ddf8", "comment": "Malware payload (Mirai)", "value": "afa5c4c7f6e59a7d9936789b2c297195997a417577d324bcd6f1fc0bec6ed18c2c3cd48a09ffa05a610402a0448fa99c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479986, "uuid": "1f37f34c-b271-449a-bc19-bf281e6db15a", "value": "T14303E10CE5102DF2FBEBCDB0D80483C27FAA5D9537EADD6090AA5F260863259E556DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479986, "uuid": "0c4caa1c-502f-4229-9bef-f1f7b95b53f4", "value": "768:WjDpDB7QqPSAZvlj+D2aV4XCprARnbfF3kiKH5L4uVcqgw0Iu:+DEqsDNV4yabfFUZL4u+qgw0Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479986, "uuid": "932be7eb-6b21-4c34-9985-b5cf6eca70bc", "value": 38832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479986, "uuid": "d80962fd-6831-4179-8c5d-268d9553dd73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479986, "uuid": "5408bc49-3afd-4bc2-9bcb-8ee9fa840e03", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79db1b14-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752477824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477824, "uuid": "ff07c994-6495-4a68-9ce1-4993ee9621c3", "comment": "Malware payload (AgentTesla)", "value": "f04bfa5776426d4a476ee13d3aaee4f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477824, "uuid": "c1de812d-3936-49f9-a436-9c58e3759398", "comment": "Malware payload (AgentTesla)", "value": "d44e06929bea3996cd295fe7d912689c2091483dc5bbcd46facefa156ebfb51a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477824, "uuid": "f29b0d86-bd63-42f3-8c24-f491c9a9c20f", "comment": "Malware payload (AgentTesla)", "value": "4f7ba55d64acdf7dc27b6bcf5f2b3067acd1111e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477824, "uuid": "212e0a0d-bf07-4786-b90e-56c63e4180b5", "comment": "Malware payload (AgentTesla)", "value": "08955b6c01536e367886778911b228d95dd02e413f93bee01ccbb95b0dc984ada25936cc17931252d2d811139417c8fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477824, "uuid": "3429cc38-b685-446b-b294-162a8d132936", "value": "T15E35BF1373DE8361C3B25273BA257701BEBF782506A5F56B2FD8093DE920162521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477824, "uuid": "ce2d7e32-ad8c-44ab-902d-db148b922125", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477824, "uuid": "5b634811-cca4-4187-bd05-27e1f9c372be", "value": "12288:1tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgat75RYU8KHvbZouLY16A:1tb20pkaCqT5TBWgNQ7aBAKHuu016A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477824, "uuid": "c1223270-4f81-4c83-bc08-26c7bbc28c71", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477824, "uuid": "fee6d3a3-7b7d-47ec-9497-4f7244439bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477824, "uuid": "3d9593dc-8949-4992-847f-d00ed987b742", "value": "Curriculum Vitae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f37671f-60e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517669, "uuid": "fd2da326-6c08-404f-a05e-bf88443d83fa", "comment": "Malware payload", "value": "d14ff5692d06940b871c06f84f47e494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517669, "uuid": "4bca20b0-eb8f-4815-8c25-bf8ecd094a69", "comment": "Malware payload", "value": "d46c3a4cd4c7a531e6ff858d26a1841ecb5decb84ca532d8af41009cf61676a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517669, "uuid": "e6540573-c651-413b-a229-3a98e503aa36", "comment": "Malware payload", "value": "8ea1a5e414ad9ee1f16cad1395a3cb28b065880c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517669, "uuid": "9228b704-0b73-43f9-8367-92cbd00ea60d", "comment": "Malware payload", "value": "c652eed99286fdc1011969ebcb0af52f2480858379634158793fbb11db608d02b73d921d0ed518d795c8e6dbc213d61f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517669, "uuid": "03749e7e-1ce9-4712-9d9e-f2d96a8d3550", "value": "T162F75A42A7EA04C5E9FB9A3489E65213D673BC063F3085DF324C176A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517669, "uuid": "5934c130-93ff-4ed5-9e87-dc2603f13c27", "value": "325b594b25b7c06988a176a364565897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517669, "uuid": "d87db111-9d95-4125-a161-af2a725b51eb", "value": "393216:Bi2KNo2O2xiTB+b3sd1Ow/AGR+QmgkjXjGphbIi1G09cK9F/NNQc62VLG0Vl+W1f:BYTjwblv2a/SPABxOWhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517669, "uuid": "0deaa70c-6ed1-4f48-be6a-1c1a4d7cf5e5", "value": 76231745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517669, "uuid": "172c4b7e-8ef8-4098-848a-9b83f6be1169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517669, "uuid": "5118c3c8-512b-49d9-b0d0-679d5a91766b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cadd996-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478286, "uuid": "83e4ecd8-5048-4fd7-b5a2-59e861fd8b1d", "comment": "Malware payload (Mirai)", "value": "6e6ba9ce49031fe0ade783e79eaa97ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478286, "uuid": "837d5c9e-45af-4719-a50b-fcf2bcde064a", "comment": "Malware payload (Mirai)", "value": "d4e36b920bfa68df76f849ec34d1185a0838949007fa8d7c132a21019e3e1f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478286, "uuid": "88ddaeaf-f405-4bfd-a164-c0b1e9ca75f9", "comment": "Malware payload (Mirai)", "value": "e44405bf6a90e785e76a45244ca64a2940af6eb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478286, "uuid": "1d592142-9568-412a-9cbf-d398c376e7d1", "comment": "Malware payload (Mirai)", "value": "02c485ac53a1880ac476a8ee1900975206aaf64682c4e45abed40646de94845716e6ef1b8e3403e83846ef709d1b94f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478286, "uuid": "22fd88dd-b3f3-48b3-a9af-d8e6f2d05d46", "value": "T199D31945FC415F17C6D622BBFB5E428C372A17A8D2EE32039D216F65378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478286, "uuid": "589eb77d-bef8-4636-be0d-15167e201191", "value": "3072:FJTwguTsXYm2tWe4zZCyMBbJL8fu57pl:FJtXYm2Me4zwyMBmfu5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478286, "uuid": "23d1c030-2dd8-40b7-b2db-b51958a603db", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478286, "uuid": "ca5d8ded-8f6d-408f-ac66-cdc93da4f3d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478286, "uuid": "10ffb898-e98a-495e-a322-25e17f6268cf", "value": "bolubotnetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b3ce93-6075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752471746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471746, "uuid": "6fe7bd79-aa64-4e8e-a106-027c0c85ae2d", "comment": "Malware payload (Mirai)", "value": "83463c23b675014657224d090964aa20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471746, "uuid": "8a0dde66-d30d-4824-a5cd-57249b6bc81c", "comment": "Malware payload (Mirai)", "value": "d4f4825106a90f4ce9b37147818168f12884e0b3098c8feb01cdb079e7c072ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471746, "uuid": "a6a943dd-3e7f-4fb0-a8ce-3a368261df39", "comment": "Malware payload (Mirai)", "value": "f8e9ac92278d38a170340c9c0d04fbde157a57a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471746, "uuid": "fca4d59f-eb9e-4ece-a7c4-0d0f5dcf5aea", "comment": "Malware payload (Mirai)", "value": "64cb06bd71aa73951b7b87bb9cf759a668c49751b2be9a7325cf7f5b32b855b45b656fe1acefe973a56397c70a32b784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471746, "uuid": "0a06bf52-0bc8-447b-aea6-d677d16999b2", "value": "T1E793D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471746, "uuid": "41e8a872-93b5-4fe3-9791-f92f802a7935", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqbhK:NFjXYyCEx06hK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471746, "uuid": "afbd92fb-284e-498e-8dc1-b16b3829ac8f", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471746, "uuid": "657a7c56-9865-49c5-a1f9-e5d2601d8d21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471746, "uuid": "7baff7ce-e9e1-4001-b32e-47bc8e7d05b9", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bff0a2d-6047-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752452005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452005, "uuid": "6f6d3308-8e95-4dc1-bef8-2471e7353d62", "comment": "Malware payload (Mirai)", "value": "812960a644cc877b09919ff8075c5ec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452005, "uuid": "705f10ff-a167-4e50-af8c-4c07aa31af41", "comment": "Malware payload (Mirai)", "value": "d5118f1c7743b23195576955b57894b3e5c2e60b18b82fe30afd3a522c5fbd7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452005, "uuid": "730a88e9-0d67-44be-8ee5-47efc09dc14a", "comment": "Malware payload (Mirai)", "value": "745a1ff30d668e8982d448d06c2d33b3e46069b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752452005, "uuid": "3e096718-0d93-444e-9a5d-4f134192e358", "comment": "Malware payload (Mirai)", "value": "506b26063d2f561a157579eea785548dab29b29ce9de56abf3738a7a93c68028565b3fdd663a2cd783f4127d342d0541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452005, "uuid": "25f5e06b-26f0-4110-b111-4eadb4c63744", "value": "T1DC433C95F401DE7DF80FE6B994164D09BE3063C261830F2727ABFDA3AC720A66D52D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452005, "uuid": "3b08ea68-166f-4030-96c6-c3a4743936e7", "value": "1536:TS9jsTsnLbQmvJFj0aX7bzX1gfaJgN9Sb2uQC8bELS:un/j0o/xgfaJWGbQXaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752452005, "uuid": "8c23bf98-143c-4a69-a68f-d1da673cf935", "value": 60472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752452005, "uuid": "603fcd00-20b1-4bb8-8cfc-c433913507cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752452005, "uuid": "0bbc004e-7f29-4be7-af97-a80169c08522", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e63f3e-60c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752506245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506245, "uuid": "f9660c28-4ef8-4800-87f0-237b6e9e5f82", "comment": "Malware payload (Mirai)", "value": "070c241a408d489e63594660a53dfa33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506245, "uuid": "b2f5c11e-7f89-45c1-94af-b6636dad47fa", "comment": "Malware payload (Mirai)", "value": "d5f073941566c61cd9da93052b1425c618de8b1f2a1f7f937b334ed180e86ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506245, "uuid": "c5fb968e-847e-4ee8-acdf-7a7f9fbe95a7", "comment": "Malware payload (Mirai)", "value": "47a28f54c19a5a1169109d525a99c81cbf73567a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752506245, "uuid": "b86d48b4-e80f-4f90-9e5f-221740358678", "comment": "Malware payload (Mirai)", "value": "9044c0f172bdf6c83ae69deb5097c710f9d452bffbb2eb879a043c65e4b7b1eefd242ffb67538f07f93edd630ee120ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506245, "uuid": "f2558ed8-d397-4089-b872-b05e066a5f57", "value": "T1F2A3E60AEF610EFBE86FDD3746E90B0525CC551B22A83B7A3574C828F54B14B4AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506245, "uuid": "b73c9508-4e65-45b7-875c-ce65ac3eb800", "value": "1536:jtMFqRw+s1WvEdZSr+W6VZ/LKD3jvxq/WrCICm1TvnS3JZ70IccRlLYQfkiEO3R:jtMFqRVcXdZSrEW2ICMPS5xyCxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752506245, "uuid": "7e30201d-fc9f-434c-af7c-b9fa56da5f94", "value": 105976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752506245, "uuid": "4b1971f7-dba2-4221-ae70-0c53b4c2138f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752506245, "uuid": "ef1ead77-094d-4c3c-ad21-1e3347b8fa5a", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382eb1e8-610a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752535696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535696, "uuid": "6cc0f5a4-17ba-4168-bd39-b834481777fc", "comment": "Malware payload", "value": "9fc2bd2f1a18a0d5a9a1b579d98b1552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535696, "uuid": "f0a99d41-3758-42d0-99a4-3e7597c85d47", "comment": "Malware payload", "value": "d684dc0e1bc79b506487c081c79742758a4654662b45b23cf6eccf1efc6ca99c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535696, "uuid": "7bd46f5d-e2fe-4513-8cc6-62442fb40c86", "comment": "Malware payload", "value": "ba2644a28dd0f1759891a0a94179880e99502829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752535696, "uuid": "7681e7c3-2ab9-4175-94f2-ee7aca74513f", "comment": "Malware payload", "value": "923a07ccb7f3c864d70bd6fbec0c47f91106e8e6d8fa1b7cecf48e449fd8b2058dedab5135084eb8b2324888def5157d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535696, "uuid": "b676b1a2-eec5-46c0-893b-3228366a6116", "value": "T1C023538CF869A73EC3E172FFE7A853CE623A07C877D77626D136025627C8315A921914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535696, "uuid": "4d451e76-cd99-4793-b87f-c691e50348c9", "value": "768:k/AcmMTPOG5lgmBrOXbXFZff5v5OlTgNMONv+NKw2djkcJBls9/ua:EAcmMTOygmBazHnaTMMqv6T2uUDs9/ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752535696, "uuid": "0b32e727-d6b6-4a44-aa31-80432aee08a4", "value": 48771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752535696, "uuid": "6ce801c8-0e50-4c11-9452-9d27a9581152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752535696, "uuid": "d454db87-27c7-4572-aacc-6e74185424b9", "value": "fsociety.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0ebba9-60eb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1752522305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522305, "uuid": "4422268c-cef7-42b1-ab79-466ccf1f9fa2", "comment": "Malware payload (AsyncRAT)", "value": "0c7ad523eb394894b57c6b29c240d796", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522305, "uuid": "f6679ae2-cbd3-475d-b24d-be93e92b932d", "comment": "Malware payload (AsyncRAT)", "value": "d68926dc2ade066ccf0c706a5cab39825aef40bcb00dc2a3de475bf6f4adae5f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522305, "uuid": "f49f72ff-aa48-4e6c-bcfe-631525284423", "comment": "Malware payload (AsyncRAT)", "value": "15580b3ed8ca348094017f3dc9a3ab4b1b0da1ac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752522305, "uuid": "1cf8f7e0-fae5-4554-a117-56a771a06e65", "comment": "Malware payload (AsyncRAT)", "value": "16dd87c4f4672ebbc291020707a21203d170443155483baf0df5943c976aa195ba6ad0ca45653b837c73f54bc8264c04", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522305, "uuid": "f6a0e76d-a8d4-4436-9002-4d2b95119b69", "value": "T1EC5318053BE8852AF3BE8F7468F6328505F9F56F3901C55D1CC9149A06727C29982AFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522305, "uuid": "6a931f69-2c7e-4554-8f71-b0c5ffa3903d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522305, "uuid": "2ffde9fb-eaa2-4d25-87d8-58d852b13b1d", "value": "1536:g2IkI9j9k5beUM7u0BrlOnmGBYIZE8XU6aPWVXJluxZbbVXQH6OxdqmUu2l/tS2c:g2IkI9j9k1E8XU6aPWVXJlufbbdKTUNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752522305, "uuid": "09416c76-7017-4400-afc4-f1b0f4642f1e", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752522305, "uuid": "9ff80dea-f227-4020-9e2f-c69f27e354de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752522305, "uuid": "c7531b57-67e3-49de-be91-3188b0bad08e", "value": "0c7ad523eb394894b57c6b29c240d796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acec103b-60a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752492084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492084, "uuid": "47eada45-bfbc-4581-b386-67227cfd678a", "comment": "Malware payload (Mirai)", "value": "1de2d2d5f5aceaf1081edfa0cc776a97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492084, "uuid": "bf3c0ffd-5ce7-4609-9f77-1a3b1a61ed20", "comment": "Malware payload (Mirai)", "value": "d6ba3f89473c10efe37c38479c90b9789ddd8b6daf3e240fd0a0c099736ecf93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492084, "uuid": "e1b49536-e079-45f9-8acd-a6305ccc6488", "comment": "Malware payload (Mirai)", "value": "2f536670f4735db97a6d53e94d832bcfcecc2640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752492084, "uuid": "be0a7799-2c5a-4e5c-bd9f-d41733f47799", "comment": "Malware payload (Mirai)", "value": "ec9ae6df25f3e4251cda7183f3c73c9b9fe733e64a85d82feb40b223b7391493176247388902f73c2b8a115be05f29f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492084, "uuid": "ee2e559e-93c7-4348-9c56-621faae39489", "value": "T12FE3491675D084FDC4DAC2788FAAF537DA72F11D0234B22B2BD4AE261F4DE205E6D660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492084, "uuid": "4a192c82-0e2b-456f-9165-e184d9c7ac58", "value": "3072:gD1tA+AakbuctWh3dZQIs/bxxlUypDkfW9I4f1MARMM8PMwMMMMMMMMMMMMM5MtV:CtA64WDuXfpbvf1MARMM8PMwMMMMMMMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752492084, "uuid": "a73595dc-c263-461f-963b-ea3359fe5b5b", "value": 143736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752492084, "uuid": "7a7f6c08-ef3d-425f-b0d1-46cbf842e024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752492084, "uuid": "09344e93-602d-40eb-9a34-23e1e28f8f44", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72400370-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485113, "uuid": "62742b12-2be9-4b9f-94e6-651678173a64", "comment": "Malware payload (Mirai)", "value": "e70f510c76b9f21ff878573bd5fb3af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485113, "uuid": "94e53256-acd0-4ae7-bf1f-aa9976ca9197", "comment": "Malware payload (Mirai)", "value": "d6e70c6425298787e35bb9936d02893874726ffcb07cf18dc961210ad451e0dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485113, "uuid": "aab48b4f-8996-42b0-a90a-05c2e98c9cee", "comment": "Malware payload (Mirai)", "value": "03f718a78e56a1a58fe27ab1662c7d5e4f60131b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485113, "uuid": "ab8b1731-c741-477a-a797-87457342ec98", "comment": "Malware payload (Mirai)", "value": "5c512cc1f5cff764b1556d1063123e2dcfee96418d2a6c43fb5da8664c0eb56c0783903ee3af55640e00ab9a2b5cab3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485113, "uuid": "f0b57c7c-55fd-4f78-854e-dcd680b4333e", "value": "T14E538D75D12DEEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485113, "uuid": "7243f1ef-e17e-40db-a5f1-717968a260c6", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485113, "uuid": "9a243d7d-3ed6-4568-9845-0a93511469ec", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485113, "uuid": "b1a4c557-2951-4d9b-ba26-5e98fcf0e421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485113, "uuid": "22ee7403-5d69-4add-b2cd-b24be576ea49", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3869c72d-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752495754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495754, "uuid": "70a0db03-fb05-4047-b0c5-8fc207aa97e6", "comment": "Malware payload (Mirai)", "value": "3d5c7f5315b32af4591a7a9b14ef3288", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495754, "uuid": "bfaef4e5-a7ea-422f-a234-a54f6f041c02", "comment": "Malware payload (Mirai)", "value": "d72c64a37518906eb723dc8cabdf7629013b92a601cb9913d815bb0a7f7d4836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495754, "uuid": "4e2a96e1-5862-4698-a576-57ede3c11e39", "comment": "Malware payload (Mirai)", "value": "92e6779c0d0f6afbc2d600a32c72edc6f542549c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495754, "uuid": "458f5e43-1ca0-4968-949b-89aa278cd367", "comment": "Malware payload (Mirai)", "value": "eec3c3ef7f656cd5ce0d266460da222b9fae5a84f719ab5a95019bab8df8d8febf213fe7ad0b73f27fcb47fd15d0f8dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495754, "uuid": "726719d4-f1b4-4428-a5aa-e75bd1350214", "value": "T16D83294AF8818B12D5C5127AFA1E164E372347E8E3DE7213AE206F2173CA56B0E77C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495754, "uuid": "f05a765f-e3db-466d-9d8f-f27dd1bf309a", "value": "1536:fYna69gRM4XndiVu/n++pI4AeSx96u5O+E+aHuUibzRfqirE371C1ZjQk5nYs2v:K9SLXdR++lSx94+E+aODE371C1Zj5tRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495754, "uuid": "10ad9a5a-2497-4362-a13b-9dd4d37045f8", "value": 83524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495754, "uuid": "55fef41d-0eab-4d10-881d-64cb596e67c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495754, "uuid": "f68b102d-6663-4a98-af9f-9f87e121e1e1", "value": "top1miku.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6629e35b-6050-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752455887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455887, "uuid": "bd0debee-6900-48f7-a9c5-7b22bbe4aed5", "comment": "Malware payload", "value": "4c5df3b8b400661cd99d6e8a3d27e927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455887, "uuid": "b1bab004-70bb-45f8-9533-43277b0c086a", "comment": "Malware payload", "value": "d7c8197e9cf9c3f478e55f2f7008cbc5e18c45dceaf285833dc0ee6f3d1b55ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455887, "uuid": "bf1b8637-501c-4e10-beb8-8f58c36e053f", "comment": "Malware payload", "value": "ccd6e253e4d4fb84497570f9e82dbd96f25826fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752455887, "uuid": "a029c027-a104-47b8-9d31-9db2ee819409", "comment": "Malware payload", "value": "1de8c14b5820ffa07f64be37a0b8fc69b129b8a7120ce6aac09ab5afb487f5b196a86c2cc5d1649f61392ed2baef194e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455887, "uuid": "0215e42f-3ef1-4bfd-9316-42cdafdf770e", "value": "T16BB401CE9520D295C4B02D33C57BA2F282EB6D3609596E1CDDD8FF6B2CB67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455887, "uuid": "47e03b6d-202b-492a-b14a-09517a4eb20e", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752455887, "uuid": "043044d6-3f8e-496b-aa81-27321dc39f73", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752455887, "uuid": "b851edfe-ae79-423e-bb54-887f577f51d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752455887, "uuid": "540d5a85-05dc-4428-8a18-6b149de06070", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54431b6-60c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752508043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508043, "uuid": "50234f71-2405-4750-84e1-d718357e6c5f", "comment": "Malware payload", "value": "8d6827d161f28fae5b389888e03e0f3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508043, "uuid": "800e0f30-c4f1-4b25-adca-6f62e7a34a41", "comment": "Malware payload", "value": "d7d4b55cf741a646f9b6817939fd91c1b487e934591737d259cb4ca7d010376e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508043, "uuid": "50682fad-9430-48c5-b8b1-b015f0420e8a", "comment": "Malware payload", "value": "e3629da007e14d4a4e034e306a502bc8757eeb01", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752508043, "uuid": "db23dc03-c2b5-4995-a046-b2f5173cebd9", "comment": "Malware payload", "value": "0b63ace69cf8e54d37d2f80ee27438f9593099122d1f7049ce3cc85a30a0a6a335082c90d5d2114627fff0e74263f9ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508043, "uuid": "3f521eb4-39ae-419f-a619-7e7e8e637c34", "value": "T149E0CD5ED40281FF601489B9BEED75D4760F225A134E0218557D451B5CE1C586044136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508043, "uuid": "93cc514d-5b94-42dd-b118-583d6bd2ed52", "value": "6:/VJqaN4f/lsGVYMuzl3F5kJVKE6LsVKE6NiVVNDV2uVf6v9yR5:/VJnwtNGOg5sguTh4yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752508043, "uuid": "e51e96f7-1613-445d-88b5-9572d0e49cac", "value": 297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752508043, "uuid": "29a678bc-7f2b-48c7-a365-3cf018a50b8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752508043, "uuid": "ce7c88cd-201c-4af7-80cd-4bd9d4492c35", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d1a22c-610c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752536712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536712, "uuid": "10d3ed2e-c2a0-4a9d-9ea4-3959b56099d7", "comment": "Malware payload", "value": "3d056843d001de3733e29bb52a789512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536712, "uuid": "df6d69f0-3489-440e-b93c-efb6b3fdebc7", "comment": "Malware payload", "value": "d7e1956865463e75bdf6958858522e6f5f01b93da20f0bf0a6c0e738a74aaf57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536712, "uuid": "1b3cf9ad-b9f4-4541-8ea3-1ca182294f2a", "comment": "Malware payload", "value": "7e0711ca8445bfa28bc6fa375e74bfdc5f6ba2f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752536712, "uuid": "86e0311f-bda7-4c83-a514-1bf8b314eae1", "comment": "Malware payload", "value": "8711c971ed0a0f1f8f1c4197491e2609856570933e75c2b7f5d20d713ee3a87821a34f6cb5d7d070c6be3ac64ffc7bb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536712, "uuid": "28e60425-88c9-43c1-9f2a-026e15aa4fce", "value": "T108C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536712, "uuid": "fbfc0570-af97-4f20-8fde-60ee47abc42b", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752536712, "uuid": "15953861-a99c-4e56-869a-3ed28415af79", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752536712, "uuid": "a4c7e782-ed74-4b40-99c8-93f084672235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752536712, "uuid": "181f0338-6b6f-4d7c-b840-c96104686fdc", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f2db96-6078-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752473115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473115, "uuid": "7b84ba6d-54ca-4de3-b899-2c68f1659ad6", "comment": "Malware payload (ValleyRAT)", "value": "96429ee201ff4572d747cbd9580bb8d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473115, "uuid": "00ae0104-354f-432b-87eb-0b9f77a57d72", "comment": "Malware payload (ValleyRAT)", "value": "d826839742e858ced7f9f92e6727b69ee870385186470d87ee39ccd4f442baf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473115, "uuid": "ab6e3e5f-e1b0-40e0-8d31-5ee0c4e2bb98", "comment": "Malware payload (ValleyRAT)", "value": "77a94b6da79d54ad0b26605109299f871351e55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752473115, "uuid": "35d4e147-493e-4292-b01d-c7d7c8574652", "comment": "Malware payload (ValleyRAT)", "value": "2e45301a459dc890b0a6ad8ba8297fc7cfddc854a42c4f72fcc4179c47e33baf12a78c691044a6c5bfcda13622d2a5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473115, "uuid": "f2c4c125-1bbc-4d3a-9c30-725258e89cb0", "value": "T1A8A7331272064533C56F02F0845AAD777E62BD6572D885249EE0FE0E7BFDB03A1B49E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473115, "uuid": "da1c1865-4e93-4764-b821-a4da7dafb9eb", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473115, "uuid": "804a158a-51f9-4932-aaf6-669dae356544", "value": "786432:TlQ5gvcPDfGREmVB3ZRRdn5l0lsCDoCOnv9fsdgOr7C7fl3MYAU0Enpw+Km+Nrqj:TlUb+NV5RF5l0l0COvT427d3MYACspob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752473115, "uuid": "ea73d12c-8316-4fe1-87d8-2f7a7ac44472", "value": 45892759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752473115, "uuid": "b3f1964d-ab81-475a-afe6-c23c0e165c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752473115, "uuid": "4ffdd620-7081-41f2-8e88-fcfcfffc514d", "value": "96429ee201ff4572d747cbd9580bb8d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1464ba-60f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752528512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528512, "uuid": "9b7720a9-623a-4b8d-a938-db7dd1e47fcf", "comment": "Malware payload (Mirai)", "value": "95d59a36f098c7e6600eda73c86d6d03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528512, "uuid": "7ceeea6b-3b8f-4a23-8ae8-99ff4fa7a2b4", "comment": "Malware payload (Mirai)", "value": "d83819b9df0cf16aa97725193a6844f9dba48f829ed39d5b5c8b25f2baf92b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528512, "uuid": "c52e6eb6-74e0-460b-8bd6-357d9570b268", "comment": "Malware payload (Mirai)", "value": "ad20152fbe62525a3d2df0667ffefdd07c2eb770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752528512, "uuid": "e80fcbaa-63e2-4195-a1f1-21ae0e99cf95", "comment": "Malware payload (Mirai)", "value": "1ef185bfa7f1d694989b9a640cb9ec4f86246b3255c108f86638ae6a9c85b5d6b239d1165334518d6d0caac7b5d0450a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528512, "uuid": "e807c0ab-d215-4a35-a1fe-fa85f4de5596", "value": "T19683285AF9814B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528512, "uuid": "60fc6512-940a-4e22-b567-8c8bf791e524", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtS:BVE+2dmTEZCSHYMactW4Bi9gnS4V0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752528512, "uuid": "0caa7e4b-af18-4696-a4e4-5ad03b992eb4", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752528512, "uuid": "fdc4dbd1-14da-4980-b472-7f693570f0d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752528512, "uuid": "10594a6a-3759-4204-aac4-5e1bd4536b55", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf68259-60d8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752514498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514498, "uuid": "feea0ddd-df68-471b-8a53-163b2cb45746", "comment": "Malware payload", "value": "0022058a3bf64665202d6b5a286fc503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514498, "uuid": "207dc26b-9062-413d-a23a-0494ac41cf42", "comment": "Malware payload", "value": "d849bdacb4a7706231ed9984c4cfd9fd61559647c932abc319154807559eee96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514498, "uuid": "d6dbf0c0-0b33-4b98-be7c-c3c1a827303b", "comment": "Malware payload", "value": "9a69d4a35d0b772bb4a0f3bc0bf4b336025d1fb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752514498, "uuid": "206eb49c-1aea-4a9d-9996-145ea28708da", "comment": "Malware payload", "value": "43263da75873ccf76daf8c01a0a6f5da5f57780df3ead7bcd2bd2cc9d2d8a78a17954813721e36333f1dafb6802a5467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514498, "uuid": "571fdeb3-0e1b-456a-8566-c59f09df1485", "value": "T10CB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514498, "uuid": "d84e1985-5b4a-4eb0-985c-8704178f967c", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752514498, "uuid": "b505d278-fc70-410a-8d2f-b4d3ffc2eaaa", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752514498, "uuid": "93207585-9b98-4102-8223-b29ebeb62e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752514498, "uuid": "033f0657-bf24-460e-a85a-30a7992707fe", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59aa642-6064-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752464637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752464637, "uuid": "b33966b0-43e6-4437-a2de-dccbc719be2b", "comment": "Malware payload (Formbook)", "value": "9f4f67bb55f84a59d82c170052f28209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752464637, "uuid": "66e316dd-2a6d-48a5-946b-1fb3e223d0ac", "comment": "Malware payload (Formbook)", "value": "d8df74d6c66f0944491fab35e1682daa4061e4e51c19ffef86b434759961b990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752464637, "uuid": "8dd3c3cd-75e6-4ae5-a523-36f12d014759", "comment": "Malware payload (Formbook)", "value": "282ef661f1fa2bfe94371e77b14d274a309d1b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752464637, "uuid": "6c9e1bed-b034-4e97-868c-270152d23ccd", "comment": "Malware payload (Formbook)", "value": "9880f768da42577f4266118cf8d0dffc1ad69afa2b4ef98054270a1018dffae86d2bdc9bb1390bc2828feb78e83438d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752464637, "uuid": "baa27ddc-52b1-48da-b592-e5389bd4f59d", "value": "T1B545D01373DE8360C7B25273BA56B701BEBB782506B5F96B2FD4093DA820122525E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752464637, "uuid": "afc3eae7-7a0f-4a9a-8647-038062b7eef2", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752464637, "uuid": "a32c52d0-2dd6-40b6-b375-62f337157b37", "value": "24576:Ttb20pkaCqT5TBWgNQ7aMtxlp6O+hT+vWE6A:QVg5tQ7aMtgnaP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752464637, "uuid": "eaaa5878-6e4d-44bf-92db-f38fa29bd8fa", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752464637, "uuid": "1e29e82b-bc01-45ad-8a0f-6254041d694b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752464637, "uuid": "79d3f843-a78b-4646-9241-f6882f0c0861", "value": "Techno-Commercial Budgetary Enquiry for Chemical Dosing Packages - SAU VCM PVC EXPANSION PROJECT, Indonesia -NBEL,,O&U,CDP-15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ce98c9-60df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752517472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517472, "uuid": "74427a5d-acdb-4a01-bb2e-04881b5cdfaf", "comment": "Malware payload", "value": "fee523b5e85be1e539d51328358653ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517472, "uuid": "33de27e6-6ec9-4fb5-a336-7a7853730684", "comment": "Malware payload", "value": "d92de7718db6d0a3f9b82b2f1c206666f0ec130f2fbbff1909b57c535a388a78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517472, "uuid": "f7d1ccc8-1132-4e3b-b067-5774e173fa0b", "comment": "Malware payload", "value": "cef4d8b7e2e0dff1af880af0f5c4d6c1c6deaa26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752517472, "uuid": "70976ef4-ed9f-4750-9188-f9d32a382aa8", "comment": "Malware payload", "value": "f31e8dd25444a80dc40fe351539ceea71bb7ef946b9ddcc27fc78094ea2b34c5c336fdfcd2f7082c28ef2458212b2207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517472, "uuid": "07a63885-093a-41ab-84ca-4e815c290339", "value": "T139C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517472, "uuid": "c282975c-41cd-43ac-9ac5-fb9bf512a0e8", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752517472, "uuid": "dd1bd93c-aeb1-4a91-9941-91cd3d1a243e", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752517472, "uuid": "a2fdaf0d-8fe9-4bf6-92ee-eb2721f8200a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752517472, "uuid": "097aac47-31fc-4d39-b827-99de4130dce1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16587b9-60b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752500251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500251, "uuid": "6ff9babf-b649-4c0f-8651-f88cff2c7770", "comment": "Malware payload", "value": "955dc7cf2818404f245a04d8a9775a27", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500251, "uuid": "4f5b8204-c0e1-46f9-8433-2b0526f020a0", "comment": "Malware payload", "value": "d94a751fae5806c337378fffd7cc8ca579853983a57364f77b31de5048136c32", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500251, "uuid": "ccd8ab95-c6c9-4717-a215-1d6387ab60e3", "comment": "Malware payload", "value": "a291a60bd6e80654ec77c98d2880b6b660bd72c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500251, "uuid": "ab055c2a-8201-4429-8349-0a2ef9db5a6f", "comment": "Malware payload", "value": "93df6c6d8c49952b7d1b7b08463cc0166b9a952524f829d47fc8f6d3b05da6c277a020f6a97e19f0478a27f0f5ba44b2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500251, "uuid": "b51e5d1b-fd4c-4d9c-9776-16ae39be4aaa", "value": "T1F093086ED70F0925DF55A77B434A4A4909FCB33EB38540A179AC973437ADC2E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500251, "uuid": "c8adc88f-66a3-4c00-bcc8-fd59695fad19", "value": "1536:qi8zQLROCzZwS1EG5qUzaIC1vfkG3AnHE/1FkvB+KK+MiDEHlgUS5DsNKzc4crUf:6zQVR1EG5FzaIC1Xk2YEF0BYUAlNS5DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500251, "uuid": "67212760-034e-4663-ba73-f9411fbfdcec", "value": 94444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500251, "uuid": "df681ac9-9e06-40bf-88fc-7583b63fd614", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500251, "uuid": "42b8714d-eab7-446c-9c65-576f746bd76b", "value": "verygoodcutlurewithbestpopelsmindsetgooforfme_____verygoodcutlurewithbestpopelsmindsetgooforfme_______verygoodcutlurewithbestpopelsmindsetgooforfme.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0dce8c-60c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752504405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504405, "uuid": "94d9abe1-5a90-4bbe-960d-3a44c3f275f9", "comment": "Malware payload (Mirai)", "value": "44cdb50e350d88f228d8c02723b89f99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504405, "uuid": "cc0f1554-ca1b-4b01-98ac-dbf3e7d5963c", "comment": "Malware payload (Mirai)", "value": "d990739a9c0201352f00c430ecb52ad4687e79b6e15cdeea9b3117050136840f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504405, "uuid": "824ffd1b-7476-405c-92b8-a0273dff7a8c", "comment": "Malware payload (Mirai)", "value": "cc0f70a617aa242970403d3c1758aa6ba504c967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752504405, "uuid": "32ccfc2d-a626-44c2-9d9a-f37fb3d6ea31", "comment": "Malware payload (Mirai)", "value": "31cff62e1a1c9c5fe333d0124397039ed6978c200d72cd733c0afd85885a697c3c2b2bf556c6b2d491a4ba563fd52e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504405, "uuid": "d95afe28-17d7-405d-892b-5d03c573fd00", "value": "T1DC54AD57EB068C6AC1A60AF54ECB075D5733C0004F1BDBDB7A2C26386E576DE9C5AB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504405, "uuid": "275e5ea0-fe84-445c-879d-bd4e33aef3ac", "value": "6144:NusT8FOCAPv26wh+HZlCHo+6fiVqW1uV3fqzuLupmdQC:Nu8CAn+wiwiVPijCpmdQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752504405, "uuid": "6efbb12b-dc5a-4577-b653-c6530411b51d", "value": 290532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752504405, "uuid": "62cb3567-17fc-4681-86d1-c093f0d93f98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752504405, "uuid": "ac69d83a-d4ef-46c4-8a99-39a9f3ed2ed8", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa7c451-60cc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1752509125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509125, "uuid": "c7169eb3-b2db-4655-8572-3eb35ee925e9", "comment": "Malware payload (AurotunStealer)", "value": "b0231ce7384d0903e64f8d1b2a623269", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509125, "uuid": "4f0b5293-a99e-47e4-a4e9-034d00d38729", "comment": "Malware payload (AurotunStealer)", "value": "d9a121212fdccc282f12ca51a269f41cda3704361e39d139f0e7b81dbb380c94", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509125, "uuid": "84ff90f8-4428-471a-a726-33c03d9c61e1", "comment": "Malware payload (AurotunStealer)", "value": "ddeb91e62779b78641fcb52d103fd35955c67d81", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752509125, "uuid": "277500b7-5dc4-4774-9636-9dc88af9baa0", "comment": "Malware payload (AurotunStealer)", "value": "84112e6a1b7edb11662ab35706a193bce784be14d496815050f744f746b267d9d7e709b4af4b142aea546d6a3f3476c0", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509125, "uuid": "075c318c-edb2-43ce-88a6-5dba570dfabe", "value": "T18FF53301BFC280B1E0521A379E7597009A7DB9205B90DAEF97D50A5EEF321C1C636FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509125, "uuid": "ebb7cb91-ec12-4286-b970-d1b9801b4377", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509125, "uuid": "c4e29dd8-07a8-4e44-884b-f814408a440c", "value": "49152:7B6rr4YdSFCTpcCMgiYwCVnMIEMkwNmBkC836r5k39vi8nJFtvtiryvp/oIa/F+G:FWwFCT3R5kwQRd5ktv97i0p/odF+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752509125, "uuid": "0b4ae362-931f-488d-8003-da652bf7f62e", "value": 3364192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752509125, "uuid": "daa73df8-7211-4266-93c5-55eed5092445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752509125, "uuid": "dff7a80f-deb8-47a8-b690-86f7877220de", "value": "index.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ae89b8-6070-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752469518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469518, "uuid": "7aa3e195-3ea7-44b4-ae70-7831dfc0b99e", "comment": "Malware payload (ValleyRAT)", "value": "8fd9021f20e01c4e8d3c9dd8f36bfb2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469518, "uuid": "8405720a-ec30-4a8f-b1a0-13c8cfc50655", "comment": "Malware payload (ValleyRAT)", "value": "d9a3f4e994824522d598acf36d3d28dc3abc5387f00689d5173f5a98859cb7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469518, "uuid": "e4d7a27c-ae98-46ff-b288-9addf2190d8f", "comment": "Malware payload (ValleyRAT)", "value": "7f70f7bf5830da5fd521d59a74a3faea32bb68cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469518, "uuid": "d14144bb-9cbc-4d82-a0a8-691a7b082c7a", "comment": "Malware payload (ValleyRAT)", "value": "10d1e2aa1ab9522ad8ded19d6b51fd4bd14a7579614bbcaa59d1a988b8d4aabc5c01dd56e6bfd5f6faa25c26bb12e343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469518, "uuid": "cda2a25c-59d9-4f4c-9cb0-f76280e03101", "value": "T13997AE86B1A551E9E13BC078866BD707F6B1385507345BFB02A186792F23BD06F3BB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469518, "uuid": "bee238bb-83b9-4e91-9ffe-ddd64448ce34", "value": "77ca27ef112245e33f47517f2d8b259c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469518, "uuid": "6f550908-84f0-4bcb-a469-863a6c0aa0fd", "value": "393216:gjsPOTH23IUWROzpkvByvdPijFJQX833vJSLiAUvIKYVE1C3dJS7xUYhqh3SRdv9:NPxVpkvBygQs30aq2mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752469518, "uuid": "27aa5b55-a13c-4e6a-9bfb-e9d660e86ec6", "value": 42252801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752469518, "uuid": "39ab72eb-3392-4538-b57e-b24019217300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469518, "uuid": "2852a68c-5e47-44b3-bf29-d45bd8d67ab6", "value": "8fd9021f20e01c4e8d3c9dd8f36bfb2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47076d83-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752503939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503939, "uuid": "5801292b-b9df-4194-8fb5-4ea439d837a0", "comment": "Malware payload", "value": "9c4e0f0df9a4e2acca87e7778bda9138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503939, "uuid": "e0d2517a-ecbc-4b12-a2a3-c40b6182114b", "comment": "Malware payload", "value": "da250a82ac63ca902e28e08c7c5de2b1c5a597fbae6cd2659bfe2b8f0fc34559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503939, "uuid": "d10ab37f-cdb1-4037-8015-662e523e7008", "comment": "Malware payload", "value": "c6118de6594b704f8a4d0e4dedda9d487f2e0f6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503939, "uuid": "478e4613-fcaf-409b-af8b-14bb32f4c2ff", "comment": "Malware payload", "value": "f87a61dbc6501602cfd8089943dfacd91c300bbfd774f51b7d427c3b8c936b29c366e27abbc288ad23f67b384a125b62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503939, "uuid": "9eb3941e-2dd6-4e37-825b-e693deacb044", "value": "T1DB036C0AEB82D0B1F8970875823B67537B32E9255077DF46C36BA934EC23614A71779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503939, "uuid": "9021f727-7a50-4f1d-a513-64d52d55227c", "value": "768:q8m6U3eTFUaNhk+Y8KJaN2HftP+xGp9RuJZySWKgkNwIf:qTHcUaNm+y7Fhp9MJUagF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503939, "uuid": "261bb725-6522-4d6e-9adf-479b51f87c43", "value": 37804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503939, "uuid": "b3df4cf8-6add-43d8-b311-4edf21e8538f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503939, "uuid": "f3dd4acf-f46f-45a9-9132-eca3345b5c1a", "value": "proxy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7118b61-60aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752494785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494785, "uuid": "e40e5426-4d0a-4fe3-94fe-2c92ae58afde", "comment": "Malware payload", "value": "d0a0c0c43784cb4c27038a4a3e23f2ba", "object_relation": "md5", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494785, "uuid": "9f50ec3d-8e57-4d6f-89b3-a7cc624ed60c", "comment": "Malware payload", "value": "db2c3f5a4745e129b2e4fb90766c4893c7d93423c16a3360797845b77561176f", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494785, "uuid": "9ee55471-8c2a-4d8b-aacf-528870a48713", "comment": "Malware payload", "value": "525c51436633938e49ab44ba9f2bad9ceaf54c13", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752494785, "uuid": "49dfe52c-c154-4733-be83-05cb2e9adc36", "comment": "Malware payload", "value": "747df0df11613e53b63d92da2cc6d54f4bb7acc16bb2d3683fbeb15e38658f2553950da194361d71a083ac9e23910466", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-31", "colour": "#343284", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494785, "uuid": "d67860d2-21bc-4ab3-8bfe-097edb4b2037", "value": "T1F6329F9BFA1DDD1AF80FDD352910DFDE502088CC86ED844929C66787E565C05CB46BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494785, "uuid": "05d4f283-9572-47ef-934e-14a8d5273519", "value": "192:7pawDRaWMYXGm263/+vsm1V9QObYWwevvJbmeU2uDYunhqBHr9t6rSVU1Ls5c5l8:7pawdaWXvWsm1EO8WPBmeUVk7Hrr6rSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752494785, "uuid": "0785ca4a-8a83-44c4-a7f8-71e4e10c6ca9", "value": 11108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752494785, "uuid": "be8cf1a3-228a-4906-873e-45347bb7bb57", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752494785, "uuid": "0520fb51-e683-4b83-bfc4-446ff1f9416b", "value": "eNTFylbizKpJAXXsYgkd7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183d3c9b-6046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Emmenhtal)", "timestamp": 1752451461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451461, "uuid": "303195bf-78d9-4aff-83d0-8c142f776ccc", "comment": "Malware payload (Emmenhtal)", "value": "5879d47228c5b19e7da79a70d9088d30", "object_relation": "md5", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451461, "uuid": "4622f9b7-3bb1-4ea7-8a59-1c98c000c90d", "comment": "Malware payload (Emmenhtal)", "value": "db7ecafde4965b2ae573d430c8511d12403f3abe0722612f936593f0c58e76fb", "object_relation": "sha256", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451461, "uuid": "7a4c8560-dfd2-4c64-b57a-c9ee42f94ce6", "comment": "Malware payload (Emmenhtal)", "value": "7ff93342797ad716dcd28361e7062b6ff7d42dab", "object_relation": "sha1", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451461, "uuid": "a9552293-2436-474f-b10d-83e59531ee8a", "comment": "Malware payload (Emmenhtal)", "value": "464ec70a6f0c7ba7f380964ccc64641182f6889c7cd103f4c1db11a0f66b83e0961260448e58ba0fb202832dd6084b47", "object_relation": "sha3-384", "Tag": [ { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451461, "uuid": "8d8fa8ab-1a60-45c9-99cb-ff3ae4ab85d8", "value": "T13F07D813B3495271E5AD2274118A13686E69EBB03F7F02D7191E13AE49A47C50FF3CBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451461, "uuid": "db59961a-d6f3-436a-ac21-a5fc4c9a9f5c", "value": "612ed09aad1b681b8cbeb72e4bdb3673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451461, "uuid": "a5001184-3930-46ee-a353-73a5c2c37b86", "value": "196608:kDEBSWl7vFoepcOQADEBSWl7vFoepcOQxDEBSWl7vFoepcOQyDEBSWl7vFoepcO6:zArhvArhoArhZArhSArh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451461, "uuid": "ef9c4bdb-cd67-4049-b030-e07845594954", "value": 17891554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451461, "uuid": "7e7c85f2-36be-440f-91d4-194f5a822f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451461, "uuid": "5365c113-a7c6-48c5-89f3-075701ec2d52", "value": "SecuriteInfo.com.JS.Packed.138.5098.213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eca58e5-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485107, "uuid": "f6382e04-69b9-447c-af0b-4b43700d60b9", "comment": "Malware payload (Mirai)", "value": "49faf8dd39c1ca72aea1251265b2be03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485107, "uuid": "3ccf5a9a-af7b-4f83-88d3-ae2523b144fa", "comment": "Malware payload (Mirai)", "value": "db824584d78947e4b64c41b24ea51a814fa169e0a9d19429dc2309d88adce7dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485107, "uuid": "38175e58-8865-4b30-99e2-b069ca618e38", "comment": "Malware payload (Mirai)", "value": "d696b48644ca9ace5ff9a2374e7d3c11ca6c4409", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485107, "uuid": "cf43ed18-b948-4468-ae93-8141d1ef1a53", "comment": "Malware payload (Mirai)", "value": "cd3bc67a5994dbc71d0dfd3eb4b37ebd931f9df416b67b971afd52903b4190ca22f5dd95434bfde50c0d87a32f7308f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485107, "uuid": "16e9ab72-1b09-4c54-986f-c30edb5cd607", "value": "T14BF2E193266FF626E3716439CE770B56B7B586FDE1F03126115002DCABC610632B936B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485107, "uuid": "0576027a-912c-4742-a4e3-373426b48a43", "value": "768:yPEaXCRxbxVzn34Nkqmekq9G35IrHDg+AJiQu55Ss3Uoz2:ysQq8CHBJiX5Pz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485107, "uuid": "1ee55bfd-3c25-4632-97dc-4c9aa0a96334", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485107, "uuid": "537d783a-9e7d-4070-ba84-158ee0132167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485107, "uuid": "93bd72a0-5611-47c2-8882-cc24da400ed7", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f88c0d-608e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NetSupport)", "timestamp": 1752482670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482670, "uuid": "d7de278e-99cb-43b3-8c30-bcae289cfba8", "comment": "Malware payload (NetSupport)", "value": "2548013678a7a6afb09b72e31dbdd688", "object_relation": "md5", "Tag": [ { "name": "193-143-1-216", "colour": "#CFE73A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482670, "uuid": "317fdf81-d6db-4e94-a710-36738398d10c", "comment": "Malware payload (NetSupport)", "value": "dba4f8b303d4640cfc5cb839c5672ee97023cd49a9291f9731fbd0570f429507", "object_relation": "sha256", "Tag": [ { "name": "193-143-1-216", "colour": "#CFE73A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482670, "uuid": "0b61bd40-c222-4e3a-81b4-cbe616b2e124", "comment": "Malware payload (NetSupport)", "value": "0951ae15572fb51e23092366dd50569e9d0422d1", "object_relation": "sha1", "Tag": [ { "name": "193-143-1-216", "colour": "#CFE73A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752482670, "uuid": "72954d3f-d561-42b2-8a7d-1970082e0321", "comment": "Malware payload (NetSupport)", "value": "921a799bb1d9f16583d305afec2f392215ae7c8fe2e535c6ac8a55e1a883a50e75634e5b6e2db3adfbed135d044c722d", "object_relation": "sha3-384", "Tag": [ { "name": "193-143-1-216", "colour": "#CFE73A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482670, "uuid": "aeeb02a8-9ca2-4b02-9088-6595b8810e74", "value": "T1FB72D0A6776C4CCAF8C015B3C671D8E6679C6BB02025175E79A83202067FAC395EE21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482670, "uuid": "307b9b98-7a82-499f-bc00-98e5998de729", "value": "384:Woz/En3rAm1D0a0Ge4S5jM2ecamhmY36u7nKde7voqqqp5QcN:WoDEnbAye4Cecam3Kdohqqp51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752482670, "uuid": "fb57a2aa-8c26-4ce2-98e2-af356fe0d703", "value": 16914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752482670, "uuid": "7f262b6f-cd0e-43ab-a4ae-2f13c97b8f08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752482670, "uuid": "4da1fc08-da7f-40a4-868a-e90c45cf29b2", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c3e5a1-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752479781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479781, "uuid": "cd785b71-a5c1-40b1-ac95-791cb330fb95", "comment": "Malware payload", "value": "a8d64c94e8d8cb996ca9834d2877c1a8", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479781, "uuid": "4d0816e4-97b3-49e3-a990-c55692ba3c13", "comment": "Malware payload", "value": "dbacd92dfadbbd3f379cbe31cf0715bab488c5690a08a031e2d582c1d80258c0", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479781, "uuid": "29cfbd76-2c26-42eb-b28e-8373fb9cabe1", "comment": "Malware payload", "value": "de06abee3f229cfed0bbb26421fb5b034a41279e", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479781, "uuid": "95479927-f80e-4d40-ba01-d6bf2b1380b0", "comment": "Malware payload", "value": "1b2228db88064210caec2175d955ca24ce08cfe88ce22ab71308815bc1011649503901f51a03c415869e9603ecfa8a0d", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479781, "uuid": "b74fb2fa-97a0-4135-a604-938ec588125e", "value": "T1CEF09761D8C5D82881388F56B6F1E8AAEB67A84353CC48C8FAD534171B21AE11A871CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479781, "uuid": "4dddfa83-f468-40ea-9262-b5c860ce8161", "value": "12:TMHdfpti5nqUWt8GC/Kyt/eIOMf+xlKIKNx:2dfptunqUWtvtTMql6Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752479781, "uuid": "a5f6883c-7b73-4f80-b052-fc330b97e4ef", "value": 491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752479781, "uuid": "3ffd241c-1ec9-4a9f-99e7-d1ab4b541d88", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752479781, "uuid": "2d4d9093-32ba-4d78-bf22-92a3d32352d3", "value": "Dokument_RENR882213.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b3ee76-60dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516655, "uuid": "6477cec3-0a4c-4c04-b017-35eef53bc353", "comment": "Malware payload (Mirai)", "value": "089683e6403dca8d02e67b1a7ecd147f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516655, "uuid": "abaedc74-5cad-47dd-817c-32176ba71cda", "comment": "Malware payload (Mirai)", "value": "dc040f44058e02093d36fa815085e200ad387d74b4c8bbd65327ef4d75487f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516655, "uuid": "40425543-f4e6-47ad-8b78-03c96487c5e3", "comment": "Malware payload (Mirai)", "value": "1d556d074037960e3c42290f102448c5b77f64fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516655, "uuid": "271d12cf-0e85-4a29-a4f4-47b18b45b3b6", "comment": "Malware payload (Mirai)", "value": "d67c4cf331efb3f3f0b694ca2f875d641dd77dc96204bc57bceed724d5697286e476c89412500b4095b172e06b232391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516655, "uuid": "8c1040b0-5df6-4874-ac23-2817ac9e1dd3", "value": "T1A0A3C64D7E315FBDFBA8923453B38E21AA5833D623E1C685D1ACE6411E7024F241FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516655, "uuid": "6ec12505-8bf7-4a58-9a60-a9883f01dd23", "value": "1536:asUy/f7KGSb5JME9zWRjLvvluUtGVLSd2mdU2eq5m+a1UQ4R:aI/f6JMEuL1uUtGVLK2mSCmLB4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516655, "uuid": "1ff9b4ed-69af-4278-8af7-acda12e0c1a2", "value": 102876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516655, "uuid": "09aefb0e-cff3-4fb5-9845-d0564d611315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516655, "uuid": "fe0e5d46-9119-4535-b628-349a616e6f6c", "value": "top1miku.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8efbb2-6084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752478282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478282, "uuid": "7cc4ea4d-624e-4aa4-af0d-21a8dd6e0c52", "comment": "Malware payload (Mirai)", "value": "04006e27f4c0f29116f08c6a4f037910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478282, "uuid": "a934cab9-6f9f-4715-81dc-07bf65f1a77f", "comment": "Malware payload (Mirai)", "value": "dc5049db11f3c7031871f3c8b1a622e272bf2e4d09f2c99ddc31d0e14da629b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478282, "uuid": "5c4bab1b-420d-434e-abd0-62f77c934be6", "comment": "Malware payload (Mirai)", "value": "422961b6a6b5d38e6c515188dbd1f7cd015b3448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752478282, "uuid": "444dc118-4570-4f70-9dc3-57a42527ccb5", "comment": "Malware payload (Mirai)", "value": "7c9518082e1d1d8ca652afb801cc5dcda0ae075107932cb2972d67c5a71599a38fb1962bbdb367b12909da6d8ee8f50b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478282, "uuid": "34415532-dbff-4c17-998f-3b07e0640419", "value": "T1ACE3390BB5C084FDC4DAC1B44BAEF23AD972F46C1238B26B27C4AA265E4DE305F5D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478282, "uuid": "40894f56-feed-4908-b0f8-ed5de41bc363", "value": "3072:fJcU1mYFZwN16ksf9uJa5+IDyiExF3Ht+WNOSbqgHv9uHLWBAO/:RcU1HFiN16k2rVqd3kkEYAO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752478282, "uuid": "da6e4263-20df-4052-83f7-9239e4fd5aaa", "value": 149016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752478282, "uuid": "c4152e01-ea00-4268-9ce0-fe22e1f0ec7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752478282, "uuid": "41b57ab0-9d15-40f9-9a54-d47a0c0e6ad6", "value": "bolubotnetx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42da68e6-60e9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752521541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521541, "uuid": "a3e2a3fb-9b73-4c7e-bbe9-a0ed2e6d1ab5", "comment": "Malware payload", "value": "9e3439b1795857d180fdc8b656fbaa9b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521541, "uuid": "668f2d0b-e359-44d1-a325-5947c31dfb77", "comment": "Malware payload", "value": "dc8fce303d98c81c15b3955a29c4f0a6c696c42e78230615724b8d9715c44a93", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521541, "uuid": "a31e3d6d-9ea5-448a-a32f-9e8ba72fe878", "comment": "Malware payload", "value": "38b984cb7b5c94eb0a6e3a59563222b52e360794", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752521541, "uuid": "1b89cb54-e997-469d-b41f-cd2a0aa92f1d", "comment": "Malware payload", "value": "1a1d4d2cbaa7141baabe34dc2650c390797551fdeae10990e7af49637636234b4d13097ae0bf97b8095c09d90891ebe1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521541, "uuid": "50e8b4ef-a3ee-4daa-afee-4c038f083c51", "value": "T10C8533EFE52FD7AA792498930BC12227D08E9C4E90CE0B6585945D43B07C4BDE349E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521541, "uuid": "bc298272-9d55-490e-90cb-7496ba5685ab", "value": "49152:5T1QqnuyhcW0asacxKeMPp+/lLO1/KUXH4mOpZaP6TlC:AqKWxsacxL/l6DgfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752521541, "uuid": "b8caa9a7-faa6-4902-9264-fc8825bad87d", "value": 1828460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752521541, "uuid": "e7d4511e-40ff-46dc-a2e3-eceed6ba7824", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752521541, "uuid": "b4e43b5b-3cd4-431a-9d25-e7d09f5576d9", "value": "NYMPH THETIS PARTICULARS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75776fb6-6083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1752477817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477817, "uuid": "214621e3-55b4-4198-8daa-379a9250dc6a", "comment": "Malware payload (Formbook)", "value": "d0d0ca6db869e42b291ded68617273bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477817, "uuid": "306e0f27-255f-456a-8e49-2e3ca6f10453", "comment": "Malware payload (Formbook)", "value": "dd56ed5cf4a23ae82f28423890e13b64e12b130088fe4fb1e71ecf491cfacf4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477817, "uuid": "5a80aff1-1957-4844-8457-d7d702f8ebf7", "comment": "Malware payload (Formbook)", "value": "7cb72c0c96cfa99a2fa4d9542f3c4dc55e018a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752477817, "uuid": "8514ce03-dd6d-4a78-9b73-f82d4d32ccb5", "comment": "Malware payload (Formbook)", "value": "26ed955fbe13684550ccdf5ce420226c24334bb7290f35bafd9d1163a8e64a5023b42eaa7f55f5753dd708ec9f2c17bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477817, "uuid": "e274b5ac-6548-42a7-a2d8-6938f39765ad", "value": "T19845CF1373DD8361C7B25273BA26B701AE7F782506A5F96B2FD40D3DB820122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477817, "uuid": "00935cf0-4cc5-44d6-a194-91affc6a775d", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477817, "uuid": "6641f1c5-fb92-44af-acbb-3f3ed7f0e903", "value": "24576:ctb20pkaCqT5TBWgNQ7adraSEqhb07ecY4KBnwJ3k16A:FVg5tQ7admkcY9JwJ3s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752477817, "uuid": "d04ae057-53e5-4125-8bb7-f1e5a0fa0901", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752477817, "uuid": "e8cc9946-b757-430a-a832-5929b788e369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752477817, "uuid": "d531e0b4-9a57-4b15-b75a-79f3b03026c2", "value": "AL DHAFRA AL JABER - SUPPLY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1a4014-607b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752474228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474228, "uuid": "eb897802-3d26-4420-b526-409244cad94a", "comment": "Malware payload", "value": "061b248c687f30e7b0aa9c84c7e815a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474228, "uuid": "366fbffc-b7ca-439c-83ed-7af815165f93", "comment": "Malware payload", "value": "dd64da2fc8831e7920d8ce9b13923722a864a6369eaf8d9005e726f378e84e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474228, "uuid": "9565c150-301e-49af-9964-06ba2f26a492", "comment": "Malware payload", "value": "ba32ace9d3d2b10b842ada5ddf9bae0e9127e983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474228, "uuid": "c2fa8a03-9659-48b1-8781-f3c763f3dded", "comment": "Malware payload", "value": "dbb4b9e516abfeaca3c73f667ef62d468b2492117014c8d2ab009ea63bd7a9e3faae37352004c07a54453407e7410fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474228, "uuid": "15ac58e8-2104-4b00-9267-492d56c5c18f", "value": "T1BAC4F1A377204F91C35195B209F389335AF6199706F29982537DEE107F20A68386BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474228, "uuid": "e605addd-50f0-4ed8-a46b-fc61f6aa93c9", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zi:W7v+mrY2xzf03yvZ/YIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474228, "uuid": "03c5d85d-4169-4c09-82ff-b99e0bc6ef11", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474228, "uuid": "b1911eef-323e-477b-b4e2-9ec218527705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474228, "uuid": "8bd6fab9-774d-4577-af7e-8e3ae3686d45", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7423d07-6046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752451809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451809, "uuid": "ca97a059-af17-490a-9fb7-acd8e0189b20", "comment": "Malware payload (Mirai)", "value": "89d9005c831224a54b8825e05596425a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451809, "uuid": "82a7ab59-6a3a-4cee-9f7b-30081255efd2", "comment": "Malware payload (Mirai)", "value": "dd9c92c7f914cf8ba362db8ba5affb4745b4e2299105147e06c987259fda6eab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451809, "uuid": "6cd7aca0-9e4a-44f2-b866-32a4afd6bdc7", "comment": "Malware payload (Mirai)", "value": "7f19a7bbaa0ba210dcf70a613b46517013e163ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752451809, "uuid": "4c24abf0-f5b0-4b62-a322-7ee27732bfb5", "comment": "Malware payload (Mirai)", "value": "600da47a07151a1cfab3c259b10726732249d92fff216d905332bf1d81f01789b6874f6c5f16bc1bec83de5f0eb5834d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451809, "uuid": "2ed09804-1e8a-431b-8e2e-a69cba98854c", "value": "T116230271850E9EB524303C72EA99A793B6F119B2C6673023D6280B3C2F757531E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451809, "uuid": "8e09ceac-7931-4234-9d6e-036f3b853c86", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3bbP99q3UELbUXfi6nVMQHI4vcGpvK:DECFd+A6YHAxvYLRQZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752451809, "uuid": "adadd2ef-4514-4793-8f2b-1b071f4bd92f", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752451809, "uuid": "362ae106-2833-49db-a84c-92318fd85d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752451809, "uuid": "19ce448b-e9a0-463a-8b71-9cb24d1d8258", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8be759-60c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752503944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503944, "uuid": "d2d7e2af-978a-456f-ae95-c7e4630ad83d", "comment": "Malware payload (Mirai)", "value": "ebf15608858a02385df55348faf46bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503944, "uuid": "c845d3cc-c192-4773-adf3-1a910c051396", "comment": "Malware payload (Mirai)", "value": "df42c279840b3305bb7d98d284b8f911d5a1768ad57779c3202bc8f5c27a5b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503944, "uuid": "2fdbeb08-bb19-4e72-9f23-3572830bb595", "comment": "Malware payload (Mirai)", "value": "01cb3768cfcc20a9738c79c7694d0d53c0f433eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503944, "uuid": "5bf02d7d-371f-4e9f-a501-0bc072296de0", "comment": "Malware payload (Mirai)", "value": "0d064948dc654dff85684a29c2e97170deafc1236b74b044705c7d89a95a84228f5bb2a0afe601d735153ab0dd1bdda3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503944, "uuid": "cb61a920-eff5-4d98-898d-a4f2bc92e0af", "value": "T17F332B36FA620C3BC4C5A57662E30735F2F6879A14BC4B163EA10D8CBF75A40315B7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503944, "uuid": "97e49d1b-b6f4-4705-be40-33045e4ccda9", "value": "768:YRmXMM8O+nb53AMoioZDFse/+LyR2th48SWOIwtPbIx:d85b5YFsW+5th4E+tPb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503944, "uuid": "79db36b1-9841-42bb-9dda-18212ff3ac6c", "value": 52560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503944, "uuid": "f776db37-86e9-4530-a155-5acadc1cdf9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503944, "uuid": "c0890d83-11e3-430d-9014-c742e5f34506", "value": "proxy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e10e9a-60a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DBatLoader)", "timestamp": 1752490303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490303, "uuid": "0071fe09-b0ae-46d5-90e3-4eb849420ed7", "comment": "Malware payload (DBatLoader)", "value": "15ff6d37ed5a605ed98c14090fbbd082", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490303, "uuid": "7fdb5b6d-94d8-4ec4-9feb-2c74390dd2f1", "comment": "Malware payload (DBatLoader)", "value": "df593192151cdbf5cfc7e1c1ded9db398db78a9c8f87218d160a6f33d623d346", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490303, "uuid": "03c45a08-8b49-4507-ba31-15e5e53693da", "comment": "Malware payload (DBatLoader)", "value": "82fb352507b52deba60eb7f3909a823b18de59d5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752490303, "uuid": "b00243c9-8bd1-418f-9540-1820b8283535", "comment": "Malware payload (DBatLoader)", "value": "359f613aa3fb8b07345b4cd80774d2b723c1d105c7f73e08f973800372fef39ca628c13e5f6fa2a3c79f7eff57c534fa", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490303, "uuid": "f743b5ff-c661-4793-9171-29a8e0d7aa17", "value": "T1A7B585E72DED1686270933AF9B4FFA544717CC190BD27DC851C309CCA91A74B29A0E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490303, "uuid": "69a1a049-91c0-40ee-9e8f-a3409914106f", "value": "24576:+uRrveaau/LMVs98ozelyz4IKcxBJGhRCYudbNTU+AWV4OSKwo6aDFcKq:+6rvenu/FHsDkbNTOWVZSKwo6apNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752490303, "uuid": "dca9799a-ab4d-4305-819d-5e4793686c62", "value": 2329881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752490303, "uuid": "8c5f4cf2-3e7e-4b12-a12e-c61f58588676", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752490303, "uuid": "610c0e2c-bedd-4fef-b557-2722bf77a28a", "value": "Non Disclosure Agreement_Doc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db6a08f-6075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752471711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471711, "uuid": "10cc787a-5f40-46da-ad88-9f2b6b07a861", "comment": "Malware payload (Mirai)", "value": "bad86f1260ce32aed737a7370723052d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471711, "uuid": "73fef573-aae1-4619-8add-a44597bc873d", "comment": "Malware payload (Mirai)", "value": "df69c739d22cfa2818c3179ebbad4171cf6327a6a97618af465e1da38378f872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471711, "uuid": "59161ca0-3402-4169-87be-0a602d2cd680", "comment": "Malware payload (Mirai)", "value": "e9a89b5b48ecf382e740af49abdc8b548b097418", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752471711, "uuid": "370aa70f-6cc3-4153-ac07-903f6fd8f34c", "comment": "Malware payload (Mirai)", "value": "c5a01658b49c12cbb4bd1dff57ff3a99ec15717b22cecadc679bd5504aaa3d2f915de794c527ea59c26ee0819e6025c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471711, "uuid": "8540c230-5564-462d-a615-c92beec90ffc", "value": "T141E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471711, "uuid": "bc986d3c-8ea9-4d4d-8a5e-6a6f7ff984a6", "value": "3072:Cv/WwsLgaq353qHiCOvhOpPqkDQHbeskmhxQwoVSUNu:KPLaq351hOpPqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752471711, "uuid": "826f7b54-a32c-4dcf-bb33-e0a1635ec974", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752471711, "uuid": "80593041-dd1e-42f6-aac6-e40a70065128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752471711, "uuid": "6756459e-41d5-454a-93ae-6d30caff5432", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d1bc0b-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752505143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505143, "uuid": "22675daa-cc48-43f4-9818-5cce9e7e3271", "comment": "Malware payload (Mirai)", "value": "b5fce6fcaee0890d02f87a60f27998aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505143, "uuid": "9bc75c54-9705-4516-8cfe-d72a6f76919b", "comment": "Malware payload (Mirai)", "value": "e0970c8a5ad410af9270a56f6592c63ceb56a482151684d62c645e69fabcc865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505143, "uuid": "f58a5d36-a82c-4cf3-bc88-a78ade6241c8", "comment": "Malware payload (Mirai)", "value": "c86f834d31d9fc0e2ea489849dd7b30d65c1f903", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505143, "uuid": "ce5aa0cf-83fa-4cbc-9816-aeaf7e4c0507", "comment": "Malware payload (Mirai)", "value": "3d43d67c5ab5c569693ab5692c490f928a1778f08ec099b5cb698533b73477ed989fecee035f2145b4bdd6238bdbc5ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505143, "uuid": "d680618c-a9b8-45a1-b9f3-a60b8928fb68", "value": "T138B3F716BB614EFBD8AFDD3705A90B0639DC551B22E83B353674C828F50B64B4AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505143, "uuid": "a9b926a5-07de-4537-9b03-048486125db2", "value": "1536:NRGfwZJbRi+7U0iWN0rbAvuDlY52q+3sONBzQcLCPGZvWvDWWrCytsNXnnAH:NYfwZJtLi7u52L3sONBzpOG9HF3nAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505143, "uuid": "e70b4e2c-af97-489c-b75b-162eb484a477", "value": 117964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505143, "uuid": "ba68757c-9205-4c36-8071-1c8aa4d838e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505143, "uuid": "aae0c35c-58be-4e06-9911-a3b8f996ae24", "value": "rmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5d1694-6088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752480053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480053, "uuid": "30b7cbf3-ad9e-49f7-9e7f-4ef75a94d83c", "comment": "Malware payload (Mirai)", "value": "33d1297599ea71f1900c2a5984c7738a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480053, "uuid": "1c1fed86-b7e6-433d-a675-367e40145c63", "comment": "Malware payload (Mirai)", "value": "e0b597e95d2c5bb5fa645b23459e0154bb121e08acc8891e0b76e7e66fd0fb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480053, "uuid": "b66c669f-98ca-4120-af1c-4e72a83f39dd", "comment": "Malware payload (Mirai)", "value": "3716e7a7401794a4727b80adb01dd2b7d54a75d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752480053, "uuid": "5afad61e-ee7b-4d93-ace9-db6672864164", "comment": "Malware payload (Mirai)", "value": "3378be73a120ce8f8e6c6f71156c4bbb16b2789fd6f4b4c4d31236c628ab9e9c33a4e06a060a6316d8693e6944e5060d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480053, "uuid": "444c06ce-a5a3-4ca8-971b-39db5a5812ae", "value": "T16AA3C94E6E218FBDF758873047B38F24A69823D63AE1C6C5D2ACD6141E7024E645FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480053, "uuid": "fce2c77a-0581-457c-afef-653295ebaac0", "value": "1536:/76D9XdjHy9rCspdXnVy6feff9poWml5+lo8beJN8GVYQ8rME:G1djuplVIfFpoWo+TdQTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752480053, "uuid": "aa2781c7-15a8-49c3-99de-f929afce0e93", "value": 105092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752480053, "uuid": "76853624-27df-4eb9-8a14-8731e543f896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752480053, "uuid": "e52742ac-bed7-489f-ae8f-dd082748804e", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80476ea1-607b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752474399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474399, "uuid": "69c3b3c6-6ac3-4eb7-b149-7ccbf22e0ba3", "comment": "Malware payload (ValleyRAT)", "value": "dedd560bf428c6fef6ec8c41f3d84d68", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474399, "uuid": "67bc86d4-95f2-4831-a282-5ef497a3841a", "comment": "Malware payload (ValleyRAT)", "value": "e0be3f58bb542dc3af3314ab9d41b55720d191af806293b7bde20cdcbd3b469f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474399, "uuid": "22cc240a-d8af-4817-9f6f-839f40af53b6", "comment": "Malware payload (ValleyRAT)", "value": "6ccf144512844f5ad5b98b114fb2c97c4f15fbc6", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752474399, "uuid": "a87d7875-c2a9-4284-bc4c-70ec8a982154", "comment": "Malware payload (ValleyRAT)", "value": "a0d903340d79fe7e893ffb5e490f553825f9437ba1d26540eb3fbf5bc4ee3f912147c4d0a9aa9310fb1b7e21f5dd65db", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474399, "uuid": "4160af5d-0474-4e7f-bca3-0ab17db9aa45", "value": "T1596449463A154EB6E463A27DC9C39A09D3F1BC065725E3CF0295826A0F53BC6E93F391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474399, "uuid": "91445d2b-e524-46eb-a82e-0e3a5f474ade", "value": "f51a4c7878baa01fcaab92469c19746e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474399, "uuid": "4ad72e44-ed8c-4389-a78e-848570086f87", "value": "6144:j+X+bpkzdnpjea3Tyt34Y77aQkTy+WEnSduwGQ:qG8dpvw1fJMnSd/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752474399, "uuid": "74d88008-01f0-47a4-9df3-e2acc840175a", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752474399, "uuid": "89210699-0b49-48c2-bd35-82dcf51185a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752474399, "uuid": "de5f777c-9eea-42a6-92c7-911a57aef201", "value": "cpprest_2_10.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cf2048-6070-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752469733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469733, "uuid": "743c3aab-2a45-44b7-9218-2e8cfb4ee0b6", "comment": "Malware payload (Mirai)", "value": "99075ff13aecd960d2f937c248078785", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469733, "uuid": "a57f0af1-4f5a-4f73-b66c-19a0b1c86075", "comment": "Malware payload (Mirai)", "value": "e0bfd1e5bee1e15787b0a4ea0a07af125256e9c4e5ef7ea16428b2eb872574a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469733, "uuid": "5f229cb5-f959-46c1-891f-1f98630b8ffe", "comment": "Malware payload (Mirai)", "value": "a75419abaccfbb7728b74b61d1087a27e7ffb7ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752469733, "uuid": "fb2b128b-0833-4c21-b3da-f786fbfc5acc", "comment": "Malware payload (Mirai)", "value": "607109d5d668367547b9c5cfbdadae7fe41f07f7415b8dcd5d98bd4fa6faf5a904ae9032063992043f75aa4a86635d88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469733, "uuid": "8c08be2a-1d0b-42fe-a762-83a0751f5d00", "value": "T1DFC2E153A0E98D15C863423B6E1F15A761286438134DEE2E373FEFEC62464B4A175DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469733, "uuid": "ebeeb793-e90c-4a71-a5ee-3017818e53c2", "value": "384:MRGW9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlgO:45+Kcrb9VDJe5FLTYTlPFnz/mspL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752469733, "uuid": "3b89f161-9ef8-4108-a44f-e26442b46437", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752469733, "uuid": "5e3cad72-d030-47d0-bf0e-4f9f3f0e09f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752469733, "uuid": "1644da06-4717-4ac2-a116-ab679976fbd9", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d10d8ff-6094-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752485158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485158, "uuid": "cbfdd71e-e855-4cb2-981f-1729fb815b06", "comment": "Malware payload (Mirai)", "value": "ec320c1fafd9b1eea1163300ca9be6bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485158, "uuid": "72dd44b6-f9d1-47a1-9be7-3326a14cec52", "comment": "Malware payload (Mirai)", "value": "e125eaf0909b7ef5449f89eaadaf952a4bf96569635af60766c3c07f90ce08dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485158, "uuid": "e9ed81ef-feb5-4635-9614-8d773ee84c53", "comment": "Malware payload (Mirai)", "value": "b32f362c15693f9912ce270daa54e389dd596b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752485158, "uuid": "51fb5f0c-b487-4cba-9eee-4a8e7f0006f7", "comment": "Malware payload (Mirai)", "value": "07480aca5c95f5391825ffef92bf97bbd8a2d39245173dd81dbee7a69c40c1f58be52a154a999d0b03b6e5493b780a10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485158, "uuid": "8bb6ab66-144c-4b24-9f2e-939049e96929", "value": "T1E553F891B8426A39C2D1577BEDAF548E3314A7D8D1DA3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485158, "uuid": "6ae97ffa-2831-4b7f-8bfe-3171ccb79530", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkS5eVSvhWy5UzS:+n3IxdpNkS5sKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752485158, "uuid": "054e9578-85de-4a31-8ed6-e50c23e39b4c", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752485158, "uuid": "1df8b09f-e506-4336-aef1-0ce4b53635d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752485158, "uuid": "6b776e39-60c7-4938-8d75-975d71de6ed1", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e0e25e-60b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1752500454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500454, "uuid": "28361d48-c8aa-4bcd-b614-ace649d426c8", "comment": "Malware payload (Worm.Ramnit)", "value": "118962ea993c489f14c068235b1a8397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500454, "uuid": "9f25f343-5e99-4499-be8f-3b681d9495be", "comment": "Malware payload (Worm.Ramnit)", "value": "e142a1e51ce0e8d28fd852683b65688dcc97a6b705e8adc799d5af0bdefefecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500454, "uuid": "a04fb38f-a2c5-4610-98d0-2e545862cb39", "comment": "Malware payload (Worm.Ramnit)", "value": "0f6e1c3388f65c6f483b15e6a35b8acdf0a93de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752500454, "uuid": "0fd398be-6362-455a-ace8-090c2f55b56d", "comment": "Malware payload (Worm.Ramnit)", "value": "844fcb537ec6c5d39da69015a54548bd117266a45ecb3c6416605914be984631ec98cf6a0f3a4a085ce2a3832b84feac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500454, "uuid": "5b526689-fb7d-4617-99b6-3b24ddcb3820", "value": "T173247C12B58184F2C2B35F75AA847322F3FC86241637D76BAF44692A3F62587C717293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500454, "uuid": "1cd7d89e-e42a-4976-846e-7ea2a9d8a142", "value": "eb21f550e104c8827a04ad90c1f193b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500454, "uuid": "19ca734e-6c48-4a59-ac45-d28cffcc7b63", "value": "3072:GtSqS6SbEjAr+Y1/5G6yC2Yb6CyH6wap4EWHUW1:GtRmbEjAr+K/5mC2dH6wpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752500454, "uuid": "c03bbd9b-d6ed-4b00-91ef-2f4fd5b16cbc", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752500454, "uuid": "716fb334-75b9-4b76-8375-50c2da091826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752500454, "uuid": "8c107a48-4143-4f34-8d90-63d3ae840601", "value": "e142a1e51ce0e8d28fd852683b65688dcc97a6b705e8adc799d5af0bdefefecf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabf891e-60bf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752503676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503676, "uuid": "a57b89e0-749f-42be-8887-b4644306a1a7", "comment": "Malware payload (Gafgyt)", "value": "dcfccf817e1f72bad47edbe2585bcc78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503676, "uuid": "948f3b90-5f2c-47c2-b3c6-b4898878514b", "comment": "Malware payload (Gafgyt)", "value": "e14b6301246e2f9d6e5d52e490cd9a0f86b69b46b1b038d7fc857b5353402af1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503676, "uuid": "77c5c910-fd72-45eb-b904-c086b14c63a8", "comment": "Malware payload (Gafgyt)", "value": "af60e2325347253d49b68edc5e5f3a2540252996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752503676, "uuid": "873d65b1-e288-416e-a2fa-007345b245a8", "comment": "Malware payload (Gafgyt)", "value": "7813d16655d456c0970d70e72d20503b475cac461f6fbfe4cc8d5f427e8888e74ff0ab9d217f502fd6871744b0b6b357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503676, "uuid": "1643e2da-006d-492e-b505-d5ac7fb1d7e0", "value": "T159B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503676, "uuid": "20eaaeb0-8dc4-4cc9-81e2-26b4f47c153d", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OoN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreRNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752503676, "uuid": "3b70faed-315e-45ee-b5c6-222acb8b32ec", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752503676, "uuid": "87b1d378-6711-4297-9853-b76b63c405ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752503676, "uuid": "6dee552a-f2f2-4267-9fa9-eb5218f30e2e", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcb4731-610e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752537508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537508, "uuid": "92fb2c6b-4215-42bd-90dc-fb45f59a97a9", "comment": "Malware payload (Mirai)", "value": "79d7ca9243ffd47312c731d7855e2727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537508, "uuid": "145e277c-f46a-469f-b940-15f3e6e0845b", "comment": "Malware payload (Mirai)", "value": "e1a680ed23ac913ac9bd187b10e450d1e5b21a05cd2b05e8fe31b093188a8df6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537508, "uuid": "f144626a-82c8-4506-8a17-65c615053233", "comment": "Malware payload (Mirai)", "value": "3bbc43f0d65aa155bfb5b33df7d2cffd7e257ee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752537508, "uuid": "8ace4468-2182-4212-a5c9-c55e227ee2bf", "comment": "Malware payload (Mirai)", "value": "34c9832962606d8b7b2e1fdbd25da113fc173a8047716a577f404c1922945290d3e46497ac7d5a6e73eecc696fd58d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537508, "uuid": "86e9eba9-ae24-4851-952e-4d1321912ed1", "value": "T156738D62CA2C4D18D5184DF071A4AF388B5381D689632EBBB571CB69A853CDDB235FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537508, "uuid": "af355582-9577-4d7b-8e20-6f8769c2abff", "value": "1536:MsJBZhu5j9JZaP9ob6S5e8YccAGmlqKVZthFz9V9CLqyrW9jWN:zXW5joob6S5jcatbF9V92kKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752537508, "uuid": "dab4af71-7977-47fc-8eaf-b7f06071d65f", "value": 80628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752537508, "uuid": "132a318a-b6c6-4d1a-a7a1-e9523d49eaae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752537508, "uuid": "51a55d2f-a7e0-49e2-972b-a2c36238c8aa", "value": "system", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e804f484-60d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752513658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513658, "uuid": "eddc3ae7-fd86-49f3-ad51-8bb9fe3baced", "comment": "Malware payload (Mirai)", "value": "8ed2d64f9bbb614e3df863e833990abe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513658, "uuid": "0768b758-f0ef-4cde-afac-d549c03834cc", "comment": "Malware payload (Mirai)", "value": "e1bdd3135271dfb0b098da7c6b40bceff1cbca940ec902ad96f59b9b736a5435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513658, "uuid": "b67d790c-157a-4966-bba5-3c4ed19b9b0e", "comment": "Malware payload (Mirai)", "value": "e06ce4e60a55514013736873e1fc32af62f2b72c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752513658, "uuid": "06307c1b-7397-4bc6-af6d-8ff06cd69dad", "comment": "Malware payload (Mirai)", "value": "61988e783a62fd78a84f077f33d97d34a6a4ae53091276ab444083f7eeb0c98da3b063c64777dc41b0f098de4c0282ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513658, "uuid": "bf978d2b-263e-4094-829f-ade3bb550783", "value": "T1368318D7F400DDBDF80ADBB744530906B170E3620AC31F76625BB967AD7A1A81832F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513658, "uuid": "6e84a882-fbb2-4204-ba6e-5e973fbcacf1", "value": "1536:vQOFk/FBsH3F41tL/gq+nu8S3z+Ho800YFsJ56NuIieurXMPWS+psNcAscj:oa4LrUuX3z+HGiwuResnpsNc+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752513658, "uuid": "8f880836-46ea-4ea9-8725-98b712c0daea", "value": 88288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752513658, "uuid": "c60d9999-2ad4-4211-b88d-15f19a85506f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752513658, "uuid": "15c059c4-4291-4232-a8eb-0b40bed5e485", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3341cb-60dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752516055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516055, "uuid": "06ea2f77-ecb0-4bc6-92d9-3d6f74664575", "comment": "Malware payload (Mirai)", "value": "9976d6c1ecd3f3d747122a43904496de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516055, "uuid": "79351ef6-da06-45a0-b2c9-e79871923b98", "comment": "Malware payload (Mirai)", "value": "e1d901e0a092176ad9af812e78ede96c8ed2db0682c6ac8df85c1ae2bea826ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516055, "uuid": "c52ea0a3-4b21-4014-8a86-b2c68e0d84b4", "comment": "Malware payload (Mirai)", "value": "49083102c784f388667fd56a9d4a8c9b73eeb0cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752516055, "uuid": "088e6216-128e-42a9-9ed3-c33c934a7537", "comment": "Malware payload (Mirai)", "value": "59c81d99a9a66d94fcb0859b0d771b4dfaab39ffa0185b911f24cb2ced7dd2b5444cbbcfb7271f841bb592917b5281b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516055, "uuid": "ce43997b-c80f-49bd-8b97-ce042dee3dcd", "value": "T141833B89FD914A13C5C11277F71E464E3B2A53E8E2DA3203DE25AF6233C786B0D2B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516055, "uuid": "013c4db3-be17-4632-8c74-4674194d5a62", "value": "1536:MivFRWVxx0TBIzOsSyVk6xIwg/hFGVMISjey+Ov++a1UQCuB:MivFRWGGSytNg/hM+Icz+LBCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752516055, "uuid": "6cdfa42a-7388-4b83-8785-a5c894fe5e7c", "value": 84872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752516055, "uuid": "43cd7df0-6863-4e29-94ca-f75d2c365d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752516055, "uuid": "2fc7a665-3189-42e6-a96a-fd0ceb7c9e2a", "value": "top1miku.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1375663d-60ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752495692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495692, "uuid": "32ea0b58-fb8d-4885-965c-01c26001c8d8", "comment": "Malware payload (Mirai)", "value": "fa7624984e10dcab23081ce705b84ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495692, "uuid": "0b197c32-42c6-49b9-a465-951eeb9bf3fb", "comment": "Malware payload (Mirai)", "value": "e23d64bc9239fe2cc68ad33d0f4ef7b84de6189ddffbb6515c6ad9c2be1e0880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495692, "uuid": "2d2a24fa-87e6-4028-8c79-ef2a4d1bab4f", "comment": "Malware payload (Mirai)", "value": "9a2547fc5a06f737f0518a1b19b4b4aa923d1a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752495692, "uuid": "c41226ee-783f-4de3-b972-60392b0af8b2", "comment": "Malware payload (Mirai)", "value": "f9088dd15064007dfac214444e867bb70f3bba39f07dc2ce62ee9a9e036ac3b2584cd4a56a0051d02ce99b5c688a5a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495692, "uuid": "cece1117-cbb3-4e97-ae2b-d83915c7da7d", "value": "T11C736C31F93A1927C4D1917622F74B16B1F647CA24A8862F3E710F9DBF215803A47EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495692, "uuid": "6eaabf21-3beb-425e-87fc-361f7b65fcbb", "value": "1536:wXpjfhktNNFf2fvD8BUZNJtf/Yk52xUt50qE5:Up7NH5/YU260qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752495692, "uuid": "f92f81c8-c7ab-4942-9c15-a3e6c83b4904", "value": 76072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752495692, "uuid": "ce851859-2591-4875-b263-5fdd3a8c3e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752495692, "uuid": "179f55e0-9789-43fc-8baf-53045bd16f5e", "value": "top1miku.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f53d389-60c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752505134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505134, "uuid": "43b6ee52-9d3b-47ff-83e9-c24422edf475", "comment": "Malware payload", "value": "7697f8e63b470044b580edf1c2020e34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505134, "uuid": "6ffefdd5-2855-48ee-ac46-8dba7b51e6b2", "comment": "Malware payload", "value": "e26444c37e7a639192a99967a779b3c65c22efce5a4b115bb8041a38a6e90894", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505134, "uuid": "6ddf5a68-b526-43fd-bc99-6cf74768fbee", "comment": "Malware payload", "value": "837a151fe5b53dff354985a3572dfb662b9c99d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752505134, "uuid": "66c15365-634a-4edc-8e40-9c197b19b92b", "comment": "Malware payload", "value": "4ef032d54177b7d8e93f925d9f8532a865899d72c21ec8e035f67c3a568ae32c8794f6147d5e70f17a2e5887ec30ee03", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505134, "uuid": "25663027-d27a-443c-96fc-bd8d2242c175", "value": "T1DEF0A9CBA81492534512DEC4F8768D596411D1C22145CAA9AEEFA83E896CA1CF434B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505134, "uuid": "587ae344-4f44-480c-ab0e-eea593b69993", "value": "12:wus6ulXuJfKU7zwKDCEoXYNIl5WkyGjB0LK7aXUlW:wusF5uJfp3VerYNI7Wk9YK2XUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752505134, "uuid": "3581b815-9f52-4b18-9c0a-bdf6f0de511a", "value": 616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752505134, "uuid": "64967af2-0065-480b-aa68-770fd6faba2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752505134, "uuid": "60ecda0b-1328-4820-803f-8e8a74c827a5", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e34c913-6087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1752479469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752479469, "uuid": "acb3830d-35c0-46bc-b9d9-1ed8815aea20", "comment": "Malware payload (VIPKeylogger)", "value": "78f63b286ab6142d750f20cf6cf67f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, {