{ "Event": { "published": true, "date": "2026-07-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-16", "timestamp": 1784246582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8277c551-278d-403a-b070-31e2d29dcc2c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba44fc20-80e8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784187247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187247, "uuid": "14d04492-5f42-45be-8962-bfe67ec1f99f", "comment": "Malware payload", "value": "1e757f9ed1cc16d643c36c35f4a87168", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187247, "uuid": "7ba3854b-e3fc-4998-9942-0eca4a0849d0", "comment": "Malware payload", "value": "0002ee6e0f4f940037033aac89a61099752af07b19ac92f2643d86ce5275ba62", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187247, "uuid": "f97d89c2-3fc0-4e90-b051-e89a85f2704d", "comment": "Malware payload", "value": "c2db2747b6b12eee0551949c98d68f17c7c98ea2", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187247, "uuid": "c146f679-eda9-4335-baa9-96231fe16a3b", "comment": "Malware payload", "value": "3956c8109e350693f01a89ac8c7439206ac0f5b54d21c70e23f466d77233888dfba159ae4c33130bfb52164be512d8fe", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187247, "uuid": "ef52a90d-ae1d-4f70-a6c8-819e817d3760", "value": "T15826338FCADB606AFC67042092D43ED197AB40E3F9C3116B5DC34F6AE0D4A89957790E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187247, "uuid": "c76e6cf9-5ee4-476b-ac0c-4d9a7daeb9f0", "value": "98304:hO3vV//JBBADGyStMjisaqqySGDXrg18sb7bEU8oDEzYK0aBfy4pv:hO3vvB2KTJqqySK72lb7bEtRzLjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187247, "uuid": "819930de-63ff-4898-98cb-bed6c3682416", "value": 4449477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187247, "uuid": "01c0d724-23fb-491a-a0c9-2dd17c09b445", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187247, "uuid": "338200f0-a50a-48f5-8069-7422b9bbd2e4", "value": "ghanioilandgas.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a01208-815a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784235956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235956, "uuid": "01d10396-9ad3-437c-ab4a-a1dc3d3cc611", "comment": "Malware payload", "value": "94bab8a990c0eb2fcf2bfe2f972b2ca9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235956, "uuid": "1a4be356-e4d9-4be6-ba17-b66cad7ca58b", "comment": "Malware payload", "value": "001674374acf3e78fb6588a48f7d0fe3c9bd63b7cf4b298e620beca5f285c791", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235956, "uuid": "8b82c66e-0be3-4b19-8dbe-76d519283da6", "comment": "Malware payload", "value": "1d4ad1805dc5e3b58d688211244e079238d3415e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235956, "uuid": "87865143-8fdc-421a-a3a2-fad541a8d7f8", "comment": "Malware payload", "value": "c2cb4af27ceeea0619efdebc77c1d59f5f5dbf75751841486588f1c91c808eb73fd1a1e690576ff4cd855c04868c5162", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235956, "uuid": "f54b32f1-8e68-414c-861a-683c62008d17", "value": "T1A9C28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235956, "uuid": "c4d3c6d5-5398-4b9c-ae18-8c494bd1f9e8", "value": "768:t8vCB+25j6es8R3k9FYpMSUpi+20qUpi+20YQX:t8l25JSd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784235956, "uuid": "ab88829d-47fd-486f-bc39-a52d5f138452", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784235956, "uuid": "324c55a5-13bb-4536-a208-41aa79004cfc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235956, "uuid": "4f948ce2-4c3d-411a-ba52-6d61370f1550", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4897ddc-814f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784231529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231529, "uuid": "74538947-cd28-4750-a7b8-3940a7b04213", "comment": "Malware payload", "value": "43f7e58287a16de0c2d53e7e82fdbbc2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231529, "uuid": "09841a90-27e9-495e-b98e-c78204098945", "comment": "Malware payload", "value": "00ae170a67a3f42d1250bfbb116d004600a3e26187b4f5a10f2e64e8e14640dd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231529, "uuid": "9bbd6381-eb80-43d4-98ca-a377274ef6fb", "comment": "Malware payload", "value": "d7d3c8ee69f28f9c8f9ab7bfc0dbc9b15371dcee", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231529, "uuid": "5fc75ecc-cdae-4440-83e9-5344dddcd2d9", "comment": "Malware payload", "value": "d03bfb9828791b5cd2c384d07c211bb9748f3cc3582be1fa74be9451d6eb23d364ba8cc8d8f7e4904f1d85554a51b479", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231529, "uuid": "8fe87246-1069-4021-8395-a8e7bb5de544", "value": "T143E6330C9AE012FFF6B3803EADE64655D2A178700BB2CADF5788C3566D570E1593C663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231529, "uuid": "5bdb3d9f-dbc4-4eaf-bf92-e7c136ec0b75", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231529, "uuid": "33f1ae86-accd-48ab-9eed-479b6808f15b", "value": "393216:NgtvNFTf5YK3KvB7LXMCHWUjXAcuI3/PGTAI:N47f5L3cXMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784231529, "uuid": "243c416b-d723-4fb8-9adf-33cfe5d26763", "value": 14285332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784231529, "uuid": "75bc0d1d-ffc4-4a9d-8953-e685cacf694c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231529, "uuid": "33428c42-a4f7-427a-a4f1-db051943fe00", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4259868-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234588, "uuid": "899ead80-083e-4978-968d-029ddbce5640", "comment": "Malware payload (Mirai)", "value": "cf233413d193f408b9a254301e5cc706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234588, "uuid": "3bafde95-0250-4a9a-b80b-a820ff947baa", "comment": "Malware payload (Mirai)", "value": "014fa0812d1eafc22732693850ac47494b065600e5f46100b1e8a5e218d065ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234588, "uuid": "2086a604-4ad2-49b7-a033-325ae439069d", "comment": "Malware payload (Mirai)", "value": "957bee2e403f9efa35c2294d86576a96b94caec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234588, "uuid": "a03fc580-92f7-4149-8869-f4ec74ea69a6", "comment": "Malware payload (Mirai)", "value": "00ed204aae58478f429ca7990789eaa4940d6a73d1671b80e31e0c18e14c84ccb4167d2b6972f6645516eb9ba50e5efe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234588, "uuid": "3acabdc4-71e9-4de6-a5c9-b71641e1a48f", "value": "T10923F129BD970A05D6BF87305EDDE2061660C02FA99184B26E54953FECB7C643B3C7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234588, "uuid": "136a279c-40ba-475d-af26-5d713ef327b7", "value": "768:owKTOSNoph0N8r3SBvmQjoWdodXE82qGmahhYaYTc9zMV+Sndmte7pnbcuyD7UHa:owKTOGopeN8r3StmQjo+od0gGmahhYal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234588, "uuid": "292f9cfa-8b5b-4dca-b46c-d97723c936eb", "value": 47000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234588, "uuid": "696827db-47ce-469a-b97b-f3fe7a4851ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234588, "uuid": "d8cb36ea-cc50-4043-bb25-1e3351fd8d3a", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56beee2d-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1784185362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185362, "uuid": "f26c29b6-0948-44ad-905c-f28f5cb14a9e", "comment": "Malware payload (DonutLoader)", "value": "dcc1c00c6ca8286bf670a293be76f309", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185362, "uuid": "a75306f8-22c4-41c1-9704-9e5eab34aa66", "comment": "Malware payload (DonutLoader)", "value": "01b377977cf1f8c9ef64b338840fb30fc8f3d7d8f2c38e8c2a4f4f8282d61973", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185362, "uuid": "dfd4e9ef-35ec-4f8d-935b-aee8cdb39a43", "comment": "Malware payload (DonutLoader)", "value": "4a22dfd5c86bd50e7267d3337d39be141366cdaf", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185362, "uuid": "3cd7b629-23d3-4562-a68e-59d10de84369", "comment": "Malware payload (DonutLoader)", "value": "d39c53c803bd5273b564a778f2f65b8174012ffa98dfeb8326e58f68ce641d522c7198426cc7e1db8d5cf1ddc2965b4e", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185362, "uuid": "617d1154-9c16-4530-a51d-ca3420f78e37", "value": "T148F509815324A072772DD36CD136AE28548E600328D9DF1C7A6ED638B95DE4BE34CAF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185362, "uuid": "c1fa4856-afb0-4270-9a2b-fabb66c31d77", "value": "98304:Ma2VP3HkbQ3Wg48Xw/ETct6AXxwEY+Uvfs0xCMqWw73wGlXmdQD6AH1:pM3jhA/56AhyTswQmd2H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185362, "uuid": "a31ed598-3029-4dfe-894b-e4aed6a773b1", "value": 3616950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185362, "uuid": "2f70d5c0-2233-43c9-ba9d-33667e364a24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185362, "uuid": "edc74c61-dccb-4025-bfe5-e1a50268c3ca", "value": "Purchase order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beaf34b-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234628, "uuid": "bd5d34c3-989b-4ba6-9546-101ed677e44b", "comment": "Malware payload (Mirai)", "value": "d35f7a065e9a8d136a93d26af60d85cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234628, "uuid": "5551837f-0ac7-436b-8a2a-2cbcf68f24d9", "comment": "Malware payload (Mirai)", "value": "021e1c202a1d8defd3752ab749e50dac53645e40fa09d50aea9fa8004f48ba27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234628, "uuid": "72a29981-cff1-49a9-80be-bffd7b9e2f84", "comment": "Malware payload (Mirai)", "value": "55cc852cae5896b8120f625833bc9cae35475c65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234628, "uuid": "b5b34304-7cff-460a-bcb2-d15bb51e322b", "comment": "Malware payload (Mirai)", "value": "efe697a4ecf2d2b783a057c71db16693342a1ef56d7c07936f8122b2df9d592b33ead5aa3dfb697a122cb99c08530895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234628, "uuid": "3f9f0e59-5aab-47cd-b8ad-d0c6c4289953", "value": "T111B31907BDC18DFDC089C038477F753ED822F0ED0239B2AB67D4AE262D5DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234628, "uuid": "7cdd8d00-c3a4-4084-a3f0-0f86a5ae435f", "value": "3072:IHoE9uzAHZeQ9eAT9kkzqN6EGCvR0MeITI8IunXYTome:IIE4zAHZeQ9XT9kKmWMeKIIXYTome", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234628, "uuid": "646bfbf2-ad49-4171-a18f-f6433a8608c5", "value": 117744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234628, "uuid": "b48e35d5-bc01-42b1-96c2-dee243a90f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234628, "uuid": "7e0c04fe-678a-4023-9863-d5bb92dc7b98", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eed9559-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784239921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239921, "uuid": "71d41341-a380-487c-933d-87d29003d2e0", "comment": "Malware payload", "value": "9e88cb2ee1f7c5d3711717790a219f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239921, "uuid": "2446df44-de31-4ffe-a9c4-d8d43206aafe", "comment": "Malware payload", "value": "025d6e0c9b314bc0db7c6baf357afb738084940f6ec1f9f8ac4e09fb278173f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239921, "uuid": "32606569-d220-486f-b041-2aca6d3944da", "comment": "Malware payload", "value": "aac6516c935296ca32be19b6c3765f17f03e76ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239921, "uuid": "5e9fd06f-e5d4-467e-b6d7-b9d7ce004fbb", "comment": "Malware payload", "value": "423ee2f7da0404b99cef6dba4a2cbbbf89b7795c6891f96463f40d5df41781facade4726877629078c5331dc0faa072b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239921, "uuid": "c1c9ff25-362d-4a90-b1d8-95ec29622ab8", "value": "T1E9C3F609BF710EF7E8AFCD3755B84702249C5B0622A93BB6B974D418BB4654F06D38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239921, "uuid": "fc414351-f89d-435f-895e-8d495f354c95", "value": "1536:+m2JrpexSJFOnS7DaLqFd5FlbpmFIACNlUn+WgvbdKjsZz9rRomYseVD:+m2JrpXOS7Da25bpmmAFibdoskt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239921, "uuid": "36c29c99-e61f-4cef-8a10-8a18164bab52", "value": 126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239921, "uuid": "b72867ef-5366-471e-a14c-4a44ac88c754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239921, "uuid": "938796b1-747d-4e22-a98b-96042735b7e9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562a9c4-8133-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784219290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219290, "uuid": "b61cb16e-bd15-4ad1-bb03-bee854919c87", "comment": "Malware payload (ValleyRAT)", "value": "c20a54cc45596e10f5eaf83a388128fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219290, "uuid": "04e9ed2e-4d01-4b57-af56-a867e479a0a2", "comment": "Malware payload (ValleyRAT)", "value": "04bc0dbf904d347bfa0b064bb436650fad0583b550dbd9450c8d00f4cb5a3b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219290, "uuid": "c63485f1-d63d-4faa-89df-8bdf9914355c", "comment": "Malware payload (ValleyRAT)", "value": "7fb8478bfa214c20a0d4ed26b293501d39c475bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219290, "uuid": "4ba5c08f-76ed-4c9b-9e49-af823c3098a0", "comment": "Malware payload (ValleyRAT)", "value": "1b7239ce33f7f5419c2d7a2234ebef59350574537b39e575b821af8ade26820a7d05a57865afe6df635cfd078e65c00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219290, "uuid": "0741cedc-b2e1-4d25-9267-2f30714e5ecf", "value": "T15546E7F720D692ACC40AC93B8353EF6A895F71360B36D4E3B198D2525D16DC43A7AE1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219290, "uuid": "6a8b5ab9-65ef-4a33-8afc-359d46d5e0f1", "value": "b6b5d3b43e46f9dd896a962322a5108b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219290, "uuid": "33c51c83-ea52-453c-89ae-1f5ddb4e1b6b", "value": "49152:VheA6Fk7Z0q9med65MbllMmeDDH65YWOl+Sef6vci39Om:a5kR065YWOl+Sef6EgOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784219290, "uuid": "ec4e41c5-1664-4d64-9c47-07c055ab89ba", "value": 5751912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784219290, "uuid": "12e19698-ea5b-43f7-a925-471bae4492a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219290, "uuid": "579ec5bf-9190-4f04-8471-61bcf94fb49f", "value": "2026.07.16\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86402a2-8116-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784206973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206973, "uuid": "3678654f-c857-4f80-8d71-acc61e523166", "comment": "Malware payload (PhantomStealer)", "value": "dd335229ce9cfabb228576f4eb90bbba", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206973, "uuid": "9056c779-129a-490b-8ccf-1ef7169bb84d", "comment": "Malware payload (PhantomStealer)", "value": "0593b9a2c09ed235e48ceb2b86b64feb9de1eaa58893af1dce532da959f27c69", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206973, "uuid": "1175498b-e22e-4074-9b73-e53de4e6e0f4", "comment": "Malware payload (PhantomStealer)", "value": "f9b20507daca9ab8c4f4006fcbae77251ab97deb", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206973, "uuid": "a284917c-85a2-4d7e-889e-45db380ba8b6", "comment": "Malware payload (PhantomStealer)", "value": "454762e0518b05eef825ccbc5bb5a13eda38d5f7719f80c649788e9648cc576c451595ded945318eda3d99eb5a749586", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206973, "uuid": "2c74641e-d306-4077-b38f-a95020735b1f", "value": "T100F47C24B3F409A4F1FF9B75D4B18522CA71B84B9A34CB8F159885AE0E337919D34B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206973, "uuid": "f3ee3916-2fb3-468f-baef-42432137d449", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206973, "uuid": "2a6fdff3-71e8-4a55-976b-7f3f83a47296", "value": "12288:r9C924e4koL3MpKy3OzQdyBxjbCFroh3l+C6E0+:r9CQ4FMKy3OzQdyXbCFQl+CN0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784206973, "uuid": "7d0d44f3-38b0-43bb-9a08-919c47beb338", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784206973, "uuid": "7b15cf1a-856d-48ab-be98-43a311bad00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206973, "uuid": "5c213ef4-a67d-4e89-b635-ca3845947000", "value": "Booking-302-100-475-pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e0727a-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784239928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239928, "uuid": "af67fe98-de8c-4936-a6df-aed6e6e382e8", "comment": "Malware payload", "value": "16c82f428f011d50db867970e29144ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239928, "uuid": "aee986fa-9d7a-4c04-a07d-dbd8fe228414", "comment": "Malware payload", "value": "05f95e3a46bf7fc22e1b062ce87c770c1252fd38ae10e0aca1067fd7372d1c86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239928, "uuid": "184aef11-6d06-4c92-9b47-8ac506794342", "comment": "Malware payload", "value": "736f36b91d8ee4d5db6f89aa2a0d863232e19928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239928, "uuid": "dc371152-3c60-46ce-aa87-95f07a6cf115", "comment": "Malware payload", "value": "667f5664168da62480e607d1477c70b93f15195cfcbd80627adf48b26dbe8935ff450dc15f0627fa5dbb7b88b5df0d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239928, "uuid": "644de727-1699-43f2-b7b7-e04935ea13c6", "value": "T186933B46B892CA12C6C562BAFB1F828C371617F8D2DB3203DD159F747BC695A0E7B580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239928, "uuid": "0bfd3914-e229-46b5-998a-c9cd02d7d5b9", "value": "1536:rC/gpTAn8v2I7ni0kRrJnClAo8Kxyn602ut7lEDHRYMjV4sdzuSt9etjbDVBvR1:rC/gpTAn8T7ni0kKlAoRxy60N7lED3jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239928, "uuid": "b19d9dcd-2997-433b-9c5e-8bb61162244b", "value": 95688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239928, "uuid": "4059600a-185e-4b21-b7ab-d72b05098463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239928, "uuid": "6a28e98e-41e6-48ff-b645-cdd741e65efb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad79b2d-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784185422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185422, "uuid": "9c698e89-d665-4797-8bb3-8d5cdab5fdf6", "comment": "Malware payload (MassLogger)", "value": "744211e0d3b90d029b2d527c172f4f82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185422, "uuid": "a2d9db09-7e35-4220-a011-c462a8ca60ba", "comment": "Malware payload (MassLogger)", "value": "060bc4ec3e20cb0ca40ca2d751280c0ce7755396ad41ac91e0819d21983bfa76", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185422, "uuid": "6db73192-510b-4b8b-9d2d-8a2fc9a672b7", "comment": "Malware payload (MassLogger)", "value": "739f2d15fae15a7315477fea1357b8a5e1e052f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185422, "uuid": "256225e2-1c88-49b6-9ff9-0e283ccf87b8", "comment": "Malware payload (MassLogger)", "value": "598c35922091215ce422016175d9deca08fe06f81babad662f7eb2d701f8d8744f4e61cf17277ec0a8b85daba4ddbef2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185422, "uuid": "17918914-411c-413b-921b-f603ac5d674e", "value": "T10185F1105FC42F6ECBAD0A19D0BE176EF3E15AC914A66CCAEF63BD456FAA7005027074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185422, "uuid": "fccf0ecb-177f-4d00-a67b-a21fa5ddab66", "value": "24576:fdlds5XhrXmYnrhQvjDYHM3eoveMCoAghh/VS1idEt+bj1xOe2LULOFK8:fjut2YhmbFZRdBOFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185422, "uuid": "79ef3dc0-5163-4b7c-ad14-535922981fdd", "value": 1722098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185422, "uuid": "a1b1b221-5fb6-49de-9371-50a4b449b3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185422, "uuid": "35ce992c-dbae-42ff-bb53-47440da41079", "value": "New bulk order 2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6f3b6d-80b0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784163118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163118, "uuid": "ef396843-bab4-4538-a579-079914cbfb98", "comment": "Malware payload (Efimer)", "value": "ca31a00cfbd0a65bc11c27e5b91468f0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163118, "uuid": "27608138-dcc6-41f7-a5d8-7f1e63a184fa", "comment": "Malware payload (Efimer)", "value": "0699369e414a65f7ba516fe5ed9c7ef3aec8abdae4409331f209c6a27168c157", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163118, "uuid": "3fb8863e-2214-4162-95da-948fc903a10b", "comment": "Malware payload (Efimer)", "value": "8b02926cbb0da2d2539a97e54df7f2c2f3916ff7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163118, "uuid": "c25454a8-fea1-4450-a893-3388d3c7b58f", "comment": "Malware payload (Efimer)", "value": "14b45d050a99aa6581c2f816804e47218bd4c3c97112e59a22c635f67964053351e5348df7d5384eae3a2d5aa5cc3f9a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163118, "uuid": "0dc37a4e-a565-4625-94d9-67e08690ec36", "value": "T1C4E63358B8D001EEF6B2403CEDE16AB1F46A78750B71CADB4BA853A17F270C44D3D666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163118, "uuid": "9d95d9d2-d830-4a15-8e9a-e6b7b543b142", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163118, "uuid": "de82338c-bc02-4ddc-a780-03b954a76175", "value": "393216:H/8P/BVJt5emAMN5quJIvo3NXMCHWUjX9cuI3/PGTAI:H/8P/B54DMN53mvUXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163118, "uuid": "d7b6eb08-cf15-42be-9656-8ddcc9a5b9db", "value": 14318511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163118, "uuid": "79b58a74-0e98-4a88-b0c5-f218b2c31c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163118, "uuid": "43350692-85bd-41b0-b68a-db7f69e68c52", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763d78de-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784234377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234377, "uuid": "741cdabc-bcea-4086-8afd-92d7dfbe34b0", "comment": "Malware payload", "value": "6465f540b86a178070184127fbc0d0c4", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234377, "uuid": "e04ee96b-c6ee-4735-b5cc-cd8d399c76c5", "comment": "Malware payload", "value": "06f6a0dc417bf0c8d1fa54754f53d37d190a3b9bf66658e00a630ae0bb56dfab", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234377, "uuid": "62795a58-bbfe-4610-9844-dfae842512cf", "comment": "Malware payload", "value": "1c3ef021bbe6063e04124301210ede0a6288a79c", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234377, "uuid": "78eb2980-d3a3-4141-aa1f-00bd5cc8f4b5", "comment": "Malware payload", "value": "d36ca7fdabc58be6396bf09d39b4a475c9c4ac1b0b16d762519d3f24d56601ced7b2c219043eac8955b45c64cbd6ef61", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234377, "uuid": "759c587d-7bc9-4dfe-9f56-931fbeb0b2c7", "value": "T10646E92638E23CE6D5BCF93E1B68FB3788DDA5035654712E70AB34D447E28590C5A22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234377, "uuid": "8a479a6a-50ba-4940-a776-be7a85fc0362", "value": "769e9b0e6990b46249698252875f3113", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234377, "uuid": "4c956617-5d69-4d87-a229-37a6bf47a331", "value": "24576:XKvlodvM27y8qyU/9exQPDQg0lTWUvIrs+QP:kyaMc9exQBIaUvpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234377, "uuid": "0a1fd9f1-04d2-4edd-b236-854f8c8d8af4", "value": 5754336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234377, "uuid": "68493a7c-91af-452c-a3e3-9ad540c8c1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234377, "uuid": "7ba68801-6361-41c6-a301-5b5d3f8b09a8", "value": "gz.keu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3211cca0-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784163825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163825, "uuid": "8688c1b5-2744-449d-b5f4-2ee84cdeec2d", "comment": "Malware payload (CoinMiner)", "value": "366491c86d462de5b192997e3166ba77", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163825, "uuid": "3a14ec75-328a-4db9-acbf-fbedc4da6fc9", "comment": "Malware payload (CoinMiner)", "value": "07b9702bc859227a658903d1b4cf85d9daed6e0c24e670332c83020cc0a37166", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163825, "uuid": "b0b7fa26-69b9-4c18-8c4d-bbd5f75f3cc0", "comment": "Malware payload (CoinMiner)", "value": "bc67382d6f3ee1a7790e1cd31c9ff10f9ed89207", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163825, "uuid": "9532e066-4fb2-46ba-ba21-8f365b75a708", "comment": "Malware payload (CoinMiner)", "value": "3dbb5a377b306d863757f35186fac2fd8300a9c7bb48409d4598befcfa2c0ac3bf2f69afe4c0592ca05e9e0167e435ce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163825, "uuid": "a82e1460-3434-404c-86b2-111ebaaa3057", "value": "T197F633C7F913DEE2C1E886F454E2D7D41760B026CA435B72669AB35BBCFA1A00BC15C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163825, "uuid": "8a8a9adb-8f05-4d21-a6c5-70407b2517cc", "value": "393216:fgsBGl+Jieqqazl04zyVNXc2Jid/dK3QtMpzl04zyVNXcp:fgJp3vzYNMj/dKgYvzYNMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163825, "uuid": "8f915459-0054-4757-a697-fc144b04fa8c", "value": 15639572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163825, "uuid": "26918a69-6781-42f8-9a97-1a420fd5a2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163825, "uuid": "8d59e84d-9091-4aef-af33-9b1111f9768a", "value": "IQITtfbr.packed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59fc7da-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179588, "uuid": "7b2fef32-30cd-4386-b0f7-27d81a13fac8", "comment": "Malware payload (Mirai)", "value": "f7c4ebdf65b989157463fb1c21bad74b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179588, "uuid": "084a64b3-0e83-45e1-9c88-aa1e0d88a827", "comment": "Malware payload (Mirai)", "value": "07d5192c228b25295d2e0b462cabfd0443d40ec85e85773f95ce153935e0487b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179588, "uuid": "a8ce6eda-36d3-439a-a72b-3dc3bb5c781d", "comment": "Malware payload (Mirai)", "value": "8c51239a4b17e193be9b5c86b260950738f92fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179588, "uuid": "0850f6bf-40c1-4123-8744-de7f793857b8", "comment": "Malware payload (Mirai)", "value": "03d78b2423a3f6a3079fcdd084ec981798615b5155bc3a028795f7b57785889860f2832675fc3415005c6ec579f06eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179588, "uuid": "f98852fa-c992-42ff-822f-1a3ba65965a1", "value": "T10E33F2125545DBADD5AB0C3FE22ED1E2D4828AB0A2F53336350EC70AB2044E1E5F9B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179588, "uuid": "46abe169-63ca-4448-9377-4d9bae1357ec", "value": "768:ffyY4coUkAnPg4fWptxvRZvCHg8TvuJVlDi71mZ/g5gXsQHWuXcqsJpu3U03wfJ:VD+pTCFDuJVBwaQgX0HJpHfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179588, "uuid": "82e8b873-bfe7-42e0-88f2-091c83c1a59d", "value": 52260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179588, "uuid": "9a26590f-9275-4791-9288-68678e751607", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179588, "uuid": "ddb3140d-96d0-42cf-a304-7a0cb78a3e03", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f865ab46-8119-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208396, "uuid": "9083bcb2-6978-439b-acb4-046aad7c341b", "comment": "Malware payload (VeilStealer)", "value": "e7c6f259d313295420de29de50641913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208396, "uuid": "b04f79f6-1daf-445c-992c-0217dde3328d", "comment": "Malware payload (VeilStealer)", "value": "0876c0228fea2b0f06b7ed4644b440ce40032adb7a40867e76d5274524a3058b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208396, "uuid": "229257f1-9c41-445c-ad51-a1b7531be7ac", "comment": "Malware payload (VeilStealer)", "value": "287223f9f1874c1c769ca779e0280447fdc1a5a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208396, "uuid": "6e904e0d-3b49-4660-95ca-2bde0ff32b80", "comment": "Malware payload (VeilStealer)", "value": "90e818bd4261c127b2ae20ffc16c2968e80531be683523fd7af42e4b17acab06f38c4230a3591fd2fb6b6189a6472e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208396, "uuid": "db77e88e-e0b0-4e49-aca2-fee35f6d72c7", "value": "T1E8D63947EC6505E9C1AE9175CA229613BB703C894B3023D36B60F6356F37BD0AEBA744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208396, "uuid": "bcaa8b5c-9ae2-4b4c-bc89-90ad51218bf6", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208396, "uuid": "ea3495ae-1c19-4a2d-bdda-d3df7fffbe76", "value": "98304:6YOvX1jNyBBbfE1VYUHgjpucAsTOGfdSV6gR5CrE0:fOtNyBBrEUZbTOGfqR5C40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208396, "uuid": "af8cdc81-3e44-40b7-91de-2c4b53917bee", "value": 13151744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208396, "uuid": "ba6e27ca-0a80-4838-afef-4656385851d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208396, "uuid": "0b729ea4-1df7-40f4-9d71-c878e7f887f5", "value": "0876c0228fea2b0f06b7ed4644b440ce40032adb7a40867e76d5274524a3058b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1399bb59-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784185249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185249, "uuid": "ef87f3f8-621f-48b1-b37e-ecf87bfacb4a", "comment": "Malware payload (VIPKeylogger)", "value": "378390a3a2650a3fcc1b6bc7853c4c79", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185249, "uuid": "e2017e0d-0ae9-454d-99e2-9cee1d6a8ed4", "comment": "Malware payload (VIPKeylogger)", "value": "093e8266cedac80990e1ac17460d13b141ea72a241391715bf0ab609a1760b5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185249, "uuid": "04ae6154-bb1b-4834-ac4e-e0159e21351e", "comment": "Malware payload (VIPKeylogger)", "value": "3d629b248799bc9573f6c82c7d2eb859c4382e6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185249, "uuid": "c695ba3e-4d92-4b03-af11-162dbec332ff", "comment": "Malware payload (VIPKeylogger)", "value": "1ebc8e0819f2b1b8db73872c7068b1ede1a5208454cdf46f45be2aabfa018aee502b46843d01a85d5d6e95ef110c829d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185249, "uuid": "4873a1a9-1ad0-41d8-a521-6caac1033eff", "value": "T16BB51271962E4B6E060EA598F1675DB2C9D49C9B4EB226772BFCC0E79F81C0411C6FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185249, "uuid": "be3d5cf0-3f12-4160-a2ce-ff2372d00cd9", "value": "192:yFeyh+O4N38Bdk4Xn4LVu0KcJmE1S9z37VG8lNY:k63KGcnWuxoQ30J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185249, "uuid": "c7aab602-cb2e-4448-946d-dd2f04e1f4e3", "value": 2470774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185249, "uuid": "8c9f3173-16cf-4c42-855a-ef21679190fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185249, "uuid": "9a212c34-5b74-4eda-b1b6-f7670e486572", "value": "Comprobante.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752cecc7-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185413, "uuid": "7802d53f-ef27-47a5-9aac-498890017cae", "comment": "Malware payload (Formbook)", "value": "3bc9477967c713ef5383b376d7a4a410", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185413, "uuid": "ddbbaf9f-488b-4ce4-ae28-a4d4419585d2", "comment": "Malware payload (Formbook)", "value": "09e8687f36db22a89208e02f887e8bb3d03b96d68bcdec4ef65791db50971c27", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185413, "uuid": "664e3b9b-45bf-4d04-a085-11f20f1fe39e", "comment": "Malware payload (Formbook)", "value": "2b7ca2d1f910671fc39093b69df157cf17871c2e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185413, "uuid": "df421214-ba31-41bf-9c37-7982455de38e", "comment": "Malware payload (Formbook)", "value": "276eb74a36324258b32ea93cf651b73d3dacfa805aa8295686ed0937026101e2795d58feb2f168dacaf0384f864cb36e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185413, "uuid": "ec10699f-e407-4a13-bada-550239f37eaf", "value": "T188343A20DD21067A0F476B99FCA50A61C9BDC619822640F5FADA470D600B9FCE3BE77D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185413, "uuid": "54c61898-e67e-43c9-9af6-a88bde9aa9c6", "value": "6144:NWt5ZyURFNadM9x0OnWV1+HK0Xmeo8q9Vy/MqQv4GJ:MDAUcdMcOW+q0Xmeo8IBtvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185413, "uuid": "595d06b5-56ab-4731-8a27-f8a467009948", "value": 239284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185413, "uuid": "6a05de0a-f47d-46b3-9009-0c24ba96cd7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185413, "uuid": "1c1df6db-0a77-4e0a-8dde-904c54847e70", "value": "UNIROMA1 8578\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117c4497-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185245, "uuid": "74584271-5a1c-45ef-8de5-cb919fe2efe7", "comment": "Malware payload (AgentTesla)", "value": "f3a7d7b0bcfcc8df07da637f0a97acbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185245, "uuid": "e193209b-d0d3-459a-8cf7-46aa850b969e", "comment": "Malware payload (AgentTesla)", "value": "09eb77431ea84dc577ba6c6406a7b3eaf456c52f7cf3e9fdb55ff87d728ff365", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185245, "uuid": "14857951-dae8-4eaf-af35-9989befa0c25", "comment": "Malware payload (AgentTesla)", "value": "3be18cd46a3d95993c88bf760eb444c4d4d44903", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185245, "uuid": "09581c67-7f8c-44f2-b37e-65ee4aca2171", "comment": "Malware payload (AgentTesla)", "value": "24eea013409a0ac2810bab577f25a83a1327a88f477341c089791368a9fab4c30ce23db6656f641e2899b34f14931f95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185245, "uuid": "72eeac1a-1e84-40b5-a8e7-1676eef27ca6", "value": "T138B5119DC9BF7B713E61F1580E73EC549278CA5C281F386DBE2582C696C6182CD62E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185245, "uuid": "a77093f8-afe2-4c06-8afc-adbd08c865e3", "value": "192:dYOmnSC7tRgUGYqYEXIeVZQhPMBYbxZ0TdUE9DHnYeuJ00J4EOZC7tMC6toJGl7m:dYOc39PTm0k3LusyuOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185245, "uuid": "861bc45e-2aac-4975-b241-3387a2f4fb16", "value": 2268554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185245, "uuid": "e025ceef-6079-4277-9829-5c659e5211e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185245, "uuid": "0dda66de-a505-4278-9ea2-c33f358ed808", "value": "Comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f777b4d5-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234594, "uuid": "cb6f319f-23dc-4fe1-a5a0-3fc2b4a42ce8", "comment": "Malware payload (Mirai)", "value": "1cdcdbf0f74a5683d0efb5e1d9831d60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234594, "uuid": "9bdac4f9-bf69-478d-9bd7-24a3a137ebbf", "comment": "Malware payload (Mirai)", "value": "09ffa6b1065b714d1be838b1b2d5ca88bfeff9dd9d812b9c8f7836b143731917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234594, "uuid": "37fa665e-1b0b-4227-8aca-fab20b9c4515", "comment": "Malware payload (Mirai)", "value": "c34ce393ef9d938b021a498a7b582abbdab91cd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234594, "uuid": "9e4b7b8e-1fc3-44b8-8f40-907e7b302cae", "comment": "Malware payload (Mirai)", "value": "4fd4c2ab35feb4364c0498a632b5e12aab8425e99099dc5cbe6e29a5435deeba278b0c7558526ff351cd68ddf1e590e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234594, "uuid": "86f5b7ac-bac3-4ae4-b76b-23530c540282", "value": "T1B433F13CEBAC648ACE5E5C7815860EB04EF16255B7D5460D62220ACDFDA3CDBB5CE074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234594, "uuid": "eaebc25f-40e4-41f9-8710-d3d4de579fda", "value": "1536:qS1FtF19h6wj6QywIOQwnVmQLWB8b/oqrJXGPpe7qYxA:RL9h6wNISs2b3VXMpAxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234594, "uuid": "f23cc54b-a831-48e5-9f63-5df94628616b", "value": 52796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234594, "uuid": "97a84c22-904e-4c5e-95a6-811bacb73021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234594, "uuid": "c487ad66-a03b-4044-96f4-e80ac1fba7d7", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc4acec-810c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202657, "uuid": "cc16005c-9aae-4ec8-92ed-de2e6ead3e6c", "comment": "Malware payload (Mirai)", "value": "c04c0352b34ea575506173644d4789b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202657, "uuid": "27d11b12-1814-496b-a2e9-835625c97b7c", "comment": "Malware payload (Mirai)", "value": "0a69107ec5298824fae81204a480d81de84ca6edf6cfec9614c728cb8b2e864c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202657, "uuid": "71b159fc-c5aa-4b8e-8db9-0d6d7760430c", "comment": "Malware payload (Mirai)", "value": "7bf5e6270c9664056c36f0a5a2d6b460a028a339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202657, "uuid": "bc7455bf-5233-4e6e-b47d-6fb88dab7dc4", "comment": "Malware payload (Mirai)", "value": "80e74165bd3de20af6c1d3317710ddbd587256721d21a301e1969f56fd36d48deff25afb29ab047b6f38ccee7b71f256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202657, "uuid": "ab3fe8c5-9aae-4c5a-b709-637571afc4fa", "value": "T1C4145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202657, "uuid": "cf50c6d2-07ae-42f4-8455-ba5db25f583e", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXEUaN:HZ15BTYCrYq1QDY6V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202657, "uuid": "b479bdd0-e194-4db6-b874-105a6af5d7a1", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202657, "uuid": "dfc8677e-e77a-4add-b626-c80890a91b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202657, "uuid": "f8cd711e-e86f-4390-a3b6-f9310c826255", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a9e837-8115-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784206674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206674, "uuid": "ae1467ec-ead1-4222-9f9e-4cc3cd28bba4", "comment": "Malware payload", "value": "fa70f5873fe11b5c120185f22d54ba49", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206674, "uuid": "29cef2fe-baf2-4805-840f-7a53d841de5d", "comment": "Malware payload", "value": "0ade1894c1e6acc4ef3e006f78a0b64ad55e2d6dd741684802aeb1e755997247", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206674, "uuid": "6300f59a-808f-420a-9a1f-c658aadfae66", "comment": "Malware payload", "value": "1099a1830aeba6044912af433c56ae20e1aa92e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206674, "uuid": "81a56772-a02d-4a1f-9878-c0733d760a43", "comment": "Malware payload", "value": "6586277c17de71f147762034f3ec5513fdc22474390a385934f75ac1c97e42e0172bdce6565759259d6c4ca8507c9fd6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206674, "uuid": "2988362c-8920-4e7e-bfdc-34f7ea5e20f1", "value": "T18A018CCA4240A9544069EA5E769751A4F421C3CE094A0F687F9C5E3DFF98804B026F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206674, "uuid": "cac59fff-ee85-4c48-b250-26c4ec970882", "value": "24:kXCKysE2hi0ziQvZohaR8j8D7fE3Fq1lyy7:e9Qp+MsRg8DjE1QEy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784206674, "uuid": "35f9163a-54a8-4f9a-98d7-f778fe51057c", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784206674, "uuid": "1dab7133-905c-473d-80e9-cae9d9f29dae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206674, "uuid": "7a425249-93bc-411e-99b1-f22d65b79de3", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1efe1c6-80a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784160147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160147, "uuid": "f7a9367f-f6f6-473e-81c3-0e9dc799d56b", "comment": "Malware payload", "value": "a8f9ddfe88e5b7ace384cb96a141de23", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160147, "uuid": "543463a8-222a-485c-8d12-16c5595c503a", "comment": "Malware payload", "value": "0af1e1824def0944d69e44c3ca76bc52163ee20dda7e978ead06134f550fbdc5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160147, "uuid": "846d87ba-21d7-4058-af2e-95191ae2fa04", "comment": "Malware payload", "value": "a98350c39ae23755ecef3eddc3ce2d2f86e3654c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160147, "uuid": "374a853c-7f00-467c-b43c-04b7c3ec68cd", "comment": "Malware payload", "value": "0765d26ed3363c416d0cbb5bcfdef47074783c7b104fbae01dfe2afa2576df692f499db11a998982eb82540ea24e398b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160147, "uuid": "92e4a905-af6a-4818-a79a-59e750329f4f", "value": "T14541E2BBB8A28E30335DC4B9B486694CB7579A6F442A6F74F047743C36BC324B1742A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160147, "uuid": "8d81e25d-06b2-4cb2-ad8d-24f743d61da0", "value": "48:vkwvpihneZZn1oBydX5G21j/EmfthmmzEvJGU6+gtIIqNTMTCki:vkwYheZZK8EujnFhmmzIl6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160147, "uuid": "9084fcac-d653-4e24-aa52-3c7ab483ec18", "value": 2326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160147, "uuid": "c6bce01f-5df4-4e58-96b4-3faa59d6d52b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160147, "uuid": "f0b14e8d-d8da-4b4b-87db-997dde8a41a8", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1566a3-80dc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784182123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182123, "uuid": "ec7e8d10-0d4c-4ef9-961c-561164768ed8", "comment": "Malware payload", "value": "cdb7223a5510240da7b7b7ae59151e34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182123, "uuid": "fa86cfb8-ca67-41e8-9fcf-0206e5c833df", "comment": "Malware payload", "value": "0bc0464511fe503fd57c350176109cd80baaae49f38e4be18b9872403e9e0a71", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182123, "uuid": "91b5b7f7-d66f-4518-a447-31db1eaf4d1f", "comment": "Malware payload", "value": "68015c4226e0fbe4bf4084e27d9b72c8fe508369", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182123, "uuid": "5adfc5b2-2898-48be-b5cc-51a6ac4ae7b8", "comment": "Malware payload", "value": "7b64f894d050aa4f51e9788213e9f243372ccd7c9652513acbeae554b6dd03d6949bdc2cb76250563081ba9df17c3b28", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182123, "uuid": "331e2b59-bd05-47b7-bc05-8f11a1dfafc8", "value": "T14A016FD5C6107940405DAA5D76D761E0B821C3CE5E9A0F787FAC5D2DFF88A04F066F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182123, "uuid": "1be22ef5-655f-4894-b3af-acbebe5c3ce2", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaMC0tOs+CUD1g83CBj6sL7Cdd88CIauD:kXCKysE2hi0ziQvZohaMFKPqk+J701H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182123, "uuid": "1b36fbc9-5012-436f-b88e-e607d7148dba", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182123, "uuid": "e0491166-ef27-4e8a-ba6a-b69a6dafbfd0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182123, "uuid": "f09f1e67-b412-4d15-999e-dd8c099b1be6", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb5ed3e-8136-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784220730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220730, "uuid": "5bb58d81-7028-42f8-ad70-65b5eafc130e", "comment": "Malware payload", "value": "760953b5831556a0ae543ac792cd07c0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220730, "uuid": "478fc41a-7237-4be8-bb6c-9122a768a566", "comment": "Malware payload", "value": "0cbf379711b18b11238f7c1d182a698993ca88d85f1637ab7b9fc5153070d154", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220730, "uuid": "d8188e68-8c7f-4f97-82dc-015b6be0ac14", "comment": "Malware payload", "value": "43538c47eea3579402dfd5b22a9c11ce80024c78", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220730, "uuid": "4743ae08-5716-4e0c-8e2b-a28ee1b10030", "comment": "Malware payload", "value": "d93107e3d3f33d7d036ce161e8d7c349cdf6442eff4721783858fbd37b8cc822c9d2cddb80916aaed73cf2966e9c3bd2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220730, "uuid": "36a1447d-936e-4c15-bd12-3f647b2609cc", "value": "T170E6330C75D002FDEE63913DEDE284A8E472B4660731C9DB27F846B59D0B2A5863D62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220730, "uuid": "0226c717-bab3-4a85-96ee-d7f882aceaab", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220730, "uuid": "888516de-8410-47e7-aeca-3ffe8ef687d7", "value": "393216:/gp1KhE/Le7pkk7yXMCHWUjXWcuI3/PGTAI:/gneEk69XMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220730, "uuid": "6ac7d3ae-8fad-4bd5-b365-80fd5225f738", "value": 14294986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220730, "uuid": "bbf3cfba-f18c-4c2b-aa63-529149e0b86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220730, "uuid": "b7c08be0-404c-4970-a547-d465a0773e49", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2065101-80d4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784178643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178643, "uuid": "5fef275c-ed26-4fdc-b26e-992b8d094016", "comment": "Malware payload (Mirai)", "value": "ba210348dadb9f3132a12248e253f975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178643, "uuid": "62889003-868c-40bd-a51b-4e79a33468c8", "comment": "Malware payload (Mirai)", "value": "0d13a1b460a23967786eed1e1ea44056bffd5762a997f5e64d50b2ac4a9609c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178643, "uuid": "7ab0e7c2-5abe-4824-a747-074a6f13c4f3", "comment": "Malware payload (Mirai)", "value": "47f4d0c0eed9b8381f9e67b84503df6217128479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178643, "uuid": "5e1fbe17-fd92-47d1-91d5-9249f55fc847", "comment": "Malware payload (Mirai)", "value": "c812cc627be636c9a79b94573b616e1bb8458bab78a8b3a8b9e688c2a2a177febb75ae3134bdf2509b741aee7f50e823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178643, "uuid": "b779e37c-cfe6-4fbc-a725-2e1f65e26af3", "value": "T1316301CB7EB02B26D0D8A1B1303415DAC83ADCCBE243869C87E1E756473957A64C8B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178643, "uuid": "a671066a-da12-40bd-a95f-271b5ce1921e", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMGe9BNH:1axZLmYKX+t08jmeJhYTKNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178643, "uuid": "7e2b2c28-a739-416e-ade6-843e43590a7b", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178643, "uuid": "781fdc70-9774-4b32-a9fa-33952c4804c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178643, "uuid": "508de6ec-07ef-4b34-8b76-017803293555", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cab4b25-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784184888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184888, "uuid": "4ff65ee3-db0c-4666-b9e1-7044d58ea0d8", "comment": "Malware payload (AsyncRAT)", "value": "185ddd1e558ce1dd791bbb1314f490e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184888, "uuid": "1dd158a6-f9ae-47f3-83bc-155424215aac", "comment": "Malware payload (AsyncRAT)", "value": "0d39da93c95bc61bf717491072f80ea5e49692ae0537bdfb3829e5875c64bc97", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184888, "uuid": "4a9892ad-87c3-4c4b-bde7-ab59f15393ea", "comment": "Malware payload (AsyncRAT)", "value": "8a2686d3d74963bc528a8e8ce8b26892dd4c8bb1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184888, "uuid": "1e821480-b570-4393-829c-6889126d9e23", "comment": "Malware payload (AsyncRAT)", "value": "24c778aa97305b314b0d8b587b97f5a7e9a7c2626dc01c4b9d90e0a4bd86f9b2ba2caad92f3bc4dc362204d7e39fd837", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184888, "uuid": "2c2f3dec-1662-4eb7-a15a-91949ad62cf3", "value": "T1390412A7987ADDE5EEDC1C39F38DA17694437A988106324FB2E493383361C53758228F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184888, "uuid": "6b84cf9f-e9dd-4098-9591-55ba5fb86655", "value": "3072:MmKCQxgMtst3xO1wsvubsJl6okEAp1amW6ZLEIhTDI:a6Mtsbuv4sJl25pcAT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184888, "uuid": "a22ba31c-6e51-4bfe-8ece-8e8b0cc50dfe", "value": 178656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184888, "uuid": "29437b22-f48a-44db-b868-e77c5786bbaa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184888, "uuid": "e68d2e27-6553-4d91-8da5-2683ed91118a", "value": "ORDER CONFIRMATION JU142026-771PL.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e575f81a-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1784185172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185172, "uuid": "5be48e2b-d03f-4098-8ccf-4d151283e1d8", "comment": "Malware payload (LxBaseRAT)", "value": "cb2569347c7023610192a4335966ced8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185172, "uuid": "5c656c1b-40f9-4cbe-a18e-9587a3f449c8", "comment": "Malware payload (LxBaseRAT)", "value": "0d95dc52a5626b9d0443723d4ae97db8ca0d25026dc732f8ad7d4025e0d389df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185172, "uuid": "157c298c-6d2b-4ace-bbd0-abc1d4b32492", "comment": "Malware payload (LxBaseRAT)", "value": "0f48ae4d2a93d99eafdb88190a1b6e73c5d73341", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185172, "uuid": "aa316f2f-24ad-4723-8ce5-f7f8aad51ab5", "comment": "Malware payload (LxBaseRAT)", "value": "ac00504a55942c1682889e0b0357d761c0782bc1f14fb81b7acfef115fedc4b0ffa24de4d1889180ffaa203c73e34d21", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185172, "uuid": "a1769723-d465-4582-b2ed-be814cc77699", "value": "T13D85CF48AF95652F51103824455F2E68F80CAECDBFFD6C8573AFC83E5518A0B2A26F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185172, "uuid": "4f8884c1-6576-4ed0-b7c1-5165e2b5db66", "value": "24576:rgwl6z7Hs0jfX7tBnfqjsu4II6RmcNmAEO8vBCqVN2rdLFRPwXINR+SB+gKrS7xt:0+0D7tMjSTA9ocfAot7pMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185172, "uuid": "ffdb87a6-4650-4000-b4de-5d968b4a0b86", "value": 1864126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185172, "uuid": "669bcc2a-159e-43d4-aa86-aff9bf319ec8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185172, "uuid": "74ab8224-2e8e-4bcd-b2c2-13e7e8203736", "value": "Quote_Items_16072026_inmotion_SPA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2599c042-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784163804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163804, "uuid": "bfe4f089-c7f5-435c-b1dc-93d791b50c8b", "comment": "Malware payload (Mirai)", "value": "afafa2a5ff13f82b3070ee09a39c4936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163804, "uuid": "888221c1-c2bc-46b8-be98-2777ae75df15", "comment": "Malware payload (Mirai)", "value": "0e0e3b4128eea1f7c9cac8abd8097b6cd9fbb2ecc91979cc985674f6c90d9139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163804, "uuid": "20def5fd-d004-4222-9fd9-b284df618e80", "comment": "Malware payload (Mirai)", "value": "d9073aaad2a41e7ea70ed63fa304585a2ee57d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163804, "uuid": "3cb7bd1d-5c1d-46ea-ab7f-d68eec579a66", "comment": "Malware payload (Mirai)", "value": "1161ae936308d1cae860aadaf4cad318fee7bd620f28901c2b6da6324fe9d77621f1e27fd80f4e78390194c816762d1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163804, "uuid": "6c471688-363d-44d9-96f8-aa57ebce26da", "value": "T1CF3301B17905B0BDD4448036FC6E8552FB0319B691B8396F09A1CF99DD42AEB72F7280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163804, "uuid": "c6d3a12a-4902-485c-8a8e-d04d84724808", "value": "1536:bvVXlTrlg4AnNzW0EKU+m2eAKhMCask4gNf2:7PZEnFZEKSMKZas+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163804, "uuid": "111ae876-0bc6-458a-a884-9364b1e559e1", "value": 53416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163804, "uuid": "75188bc4-2120-4e58-887b-cc56cd452457", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163804, "uuid": "54489c76-0498-420d-9a20-67f49f341cb8", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd66fc5c-811f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784210901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210901, "uuid": "a5f78020-cb12-449c-9c14-f62b4166cbab", "comment": "Malware payload (Gh0stRAT)", "value": "3166ae39b46472d2ee53a880eb8248e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210901, "uuid": "8837692c-af42-4cc1-94ee-c21140107559", "comment": "Malware payload (Gh0stRAT)", "value": "0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210901, "uuid": "4d05e166-683e-45b6-aba7-a1ca52a48e06", "comment": "Malware payload (Gh0stRAT)", "value": "974e94efa9515e53d57b16f538c37bb9a81a39ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210901, "uuid": "844c29b5-0ff7-405c-a7ce-0ff66d8d1332", "comment": "Malware payload (Gh0stRAT)", "value": "0272098cebf3ebb07b6006a8379f50bfb966e101d31c447e7001b2090ba2a887ecbd178e68a700d3e59cbae5ff3a9784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210901, "uuid": "e4f3b626-ca27-4603-b6ba-23db962cefc4", "value": "T16E373313BACBA13FF17749365AB7D612883B7B246A164C6787E4489CCF1A0901D3F74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210901, "uuid": "030f86b3-7566-45f2-8464-92023cc1c919", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210901, "uuid": "0e2a6d78-274b-4cff-b666-165179a26033", "value": "393216:rX8pIfILbZUqkRNdUTzwdfsULE658hu3L/errkdyOhjxfxq3sla8iqjH:A2f1qJTz2sUL/8hub/AxOhVf8cKKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784210901, "uuid": "cedc96ff-33ce-42f2-8e0b-21e54fddd119", "value": 23333600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784210901, "uuid": "98010922-d818-4fa2-9f1b-845918b21f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210901, "uuid": "7a731e56-d780-4ddf-9384-22cfdbd03d09", "value": "Announcement of Change of President of the Kingdom of Cambodia, July 17, 2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6d6398-8139-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784221830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221830, "uuid": "243ea18b-11d3-4e49-8dc0-33854e81a85e", "comment": "Malware payload", "value": "5a170d89b2707d35222387129be3ec13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221830, "uuid": "4fb5d117-81d0-4e01-b83d-a1ded4902a0f", "comment": "Malware payload", "value": "0fc86211a5e23f1ae72edd5612dc550f93138ce5c607c7a68517ca26cb7556a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221830, "uuid": "fd953fbd-6fc9-45e2-8ec9-934f87dffd88", "comment": "Malware payload", "value": "1333c7fa826e41351a82d3836fea808270383672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221830, "uuid": "2636300f-618a-4386-a518-04ab98abeda1", "comment": "Malware payload", "value": "84387606da7c2d5fc7ab312a645d6be9f109653a90364c8b026168bec5779e841b2786ef1af67191177f7c89af12ed60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221830, "uuid": "6e096b70-33a0-41a7-98d0-57c0b71350a3", "value": "T1ADD62338E288D2A8D52FC474C7B2A133D2B534564751A9CB0799D614EFB38D4BBFA312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221830, "uuid": "8a75d22c-5f0f-4b06-a2b5-b5720f0d8eee", "value": "c66389b0063ab50a73d65d53ea020d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221830, "uuid": "bd86a1da-319a-48d3-8c73-19ec327611ce", "value": "196608:zh95YzgDf06drO0L+U4/1K6TYd6v/TnAY6ZRE:b5YMDDrOa+B86f3TAY6ZRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784221830, "uuid": "aa0e4eca-666b-49b7-bc8c-79ed144ccc9a", "value": 13694464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784221830, "uuid": "2ebe1f4d-bff6-4036-9499-a2354060d3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221830, "uuid": "c13f2dd1-c947-4d3e-80f3-a22f9bc3a228", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c581f64c-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784185547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185547, "uuid": "94bc09e8-c309-469c-99bd-fca11504bb0c", "comment": "Malware payload", "value": "c6e83e996cfc2e881c9c8c2c40209a0b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185547, "uuid": "ff40292b-adcd-451a-8fdd-a86e7f91a40a", "comment": "Malware payload", "value": "100b763a5a440b643948073af709647c348b6543efd7d174918047629846474e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185547, "uuid": "9679ab08-0e3d-4ed9-be47-ebec5a8821d2", "comment": "Malware payload", "value": "6ad7b22552a385ae96a89e0bc40b6f84bde63d03", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185547, "uuid": "c325a4f5-e828-40b1-90ac-ba8f3cd25810", "comment": "Malware payload", "value": "cf19f012d7b5c0cd6fe7229eb8c3e7f58987f580d9354382205a25c5b4e2bbcf14164b201ba2ae73c21936abd2556622", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185547, "uuid": "1ed98c61-6bcb-4b07-a76d-f07eb74353c3", "value": "T17E73BB3431ED0118F1F3EE307EE0B7D5EE6AB273A876125E4891020A0912A54FE19B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185547, "uuid": "92c50a67-de0e-4e50-adc3-52f25e39bad5", "value": "24:8d/+xlPn6ltlnqRyaWInZU8lvAlrg8kwSp+UOi+Eu+njVHqUDM2:8l+xl6TYganUlNpy7KEu+njt1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185547, "uuid": "63585bc6-0baf-49c6-b08b-f80c0b743ce9", "value": 74480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185547, "uuid": "799145a3-042d-4acd-823c-8e2b0c6f7ec2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185547, "uuid": "13fa5eac-b37a-4bf0-978c-ac91ec606a6a", "value": "form_c.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2920e0c-80dd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784182509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182509, "uuid": "3d48e7ed-ed8b-4976-8be8-913676808840", "comment": "Malware payload (WannaCry)", "value": "151916d5bd232054315745627a1c0c0b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182509, "uuid": "445f9520-15f7-4e28-8144-e4d5cea92f0f", "comment": "Malware payload (WannaCry)", "value": "10f32a79c8be820391aace2af836bef45d64041c2d98bd6f4726ec19276a98a8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182509, "uuid": "2b7311ed-75e1-48b0-8e41-b72bd98d61dc", "comment": "Malware payload (WannaCry)", "value": "e158a747f070bfd547031033539100ad9b7ffd7d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182509, "uuid": "b4ca29e1-c770-415f-991d-c29c11b4a311", "comment": "Malware payload (WannaCry)", "value": "adc1d4b176cf8d450e38bcaa5c74864e5731bf9dc728cedde339259b37a8042440c6bb2ca5fcb1e86d26daf743a02eda", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182509, "uuid": "a4577b5f-6913-4f83-bf9c-850b9b536a60", "value": "T1AB36F601D2E51AA0DAF25FF7267ADB10933A6E45895BA66E1221500F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182509, "uuid": "879ed3ca-e1a6-4c00-af95-caeee729089d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182509, "uuid": "f2eda068-b429-4a1a-92cf-c44d3d9a910e", "value": "49152:jn/nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAd:DPDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182509, "uuid": "de1605db-1667-4d8e-b986-b7f97b3c0e60", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182509, "uuid": "9c1e8d9d-17b6-46da-8084-d1474cba060d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182509, "uuid": "a151579e-4a13-47dc-bef3-376afb797adc", "value": "10f32a79c8be820391aace2af836bef45d64041c2d98bd6f4726ec19276a98a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3e3a78-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179304, "uuid": "c8322ab0-2373-4870-b8c2-a4dc1b1dac09", "comment": "Malware payload (Mirai)", "value": "bab3643c05fb347076a4ce1b9c91311a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179304, "uuid": "eb63c765-ac36-4bae-a05b-99b4e83b480b", "comment": "Malware payload (Mirai)", "value": "12e72b60777f962f957d74b24415f80d4d76fabf724ad399e909668890be7a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179304, "uuid": "1db68b5e-188b-49d3-a43b-bde380037e68", "comment": "Malware payload (Mirai)", "value": "1cb72613ff62fd22f575d333fe931513f1257e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179304, "uuid": "7f15ddf7-1651-44f0-a920-3ef178f1265f", "comment": "Malware payload (Mirai)", "value": "43ee079798a36b0200aa3dceb0af41cc3042f3173cd9fb076bfbeada1ebb841b71b68caf5ec16014285618dc05284a65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179304, "uuid": "ed5bbf80-6db8-4c35-9840-18b910e4df5d", "value": "T116D35C0A78D274FCC687D170926E9F61E63A745C02183DBBA3C2AE711937DD05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179304, "uuid": "f7fd2619-9a03-4343-bb37-084643389eec", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQs:yIRfe3xvvSrlvZZ7Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179304, "uuid": "b6211332-d57d-4a19-8567-db1d7420d9d3", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179304, "uuid": "1e8df508-b862-4db3-b3b2-0074465256ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179304, "uuid": "b1b4aff4-0ad4-4266-b186-6f70846babad", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9c572a-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185477, "uuid": "e86718d6-cc6c-4a75-a099-d018b1d24134", "comment": "Malware payload (Formbook)", "value": "0a6a5d5cc3ac75deab11f296db1ebbe9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185477, "uuid": "596c5738-0cde-4115-9893-2b86d95a73f8", "comment": "Malware payload (Formbook)", "value": "1317e1b8a9b4907968c3ccd5924ec46494e8d3c03e16add3c510602f36d969e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185477, "uuid": "351635a7-cb9a-4bb1-bd60-e6e313230f1c", "comment": "Malware payload (Formbook)", "value": "159b3851e9d30b0173f73430f861496c3e4f3ded", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185477, "uuid": "4b9f1705-ce40-4311-b6be-c3197010b9d3", "comment": "Malware payload (Formbook)", "value": "c59bf9d0eae195f388cdabb91f88e011b9f2cb7485c20dd20a807bd1ee104af5aa193e3276021dd3d1bed1d29a33b8a5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185477, "uuid": "e2d625f8-3971-48ed-8d32-7df673a0b479", "value": "T1D1A51266035DEC44533A36046E4A8D2AEDD14CDB9DE711EFB85B0FDA9E85C60C262C3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185477, "uuid": "b74de1b5-e708-4e54-a62b-5cae7d4e9793", "value": "384:PJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPJPj:1ZUGwqAFX70wtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185477, "uuid": "e0369a94-9680-48f7-a7b7-1bc031668b8e", "value": 2110202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185477, "uuid": "abde2ffe-ec34-49ea-81d7-abb995d2a95b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185477, "uuid": "0ab6e9a9-4770-45a7-b401-6ad23f7df7f2", "value": "Factura 21-603 Euro Plasticos.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b6bc7e-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212849, "uuid": "26b9db04-f4ab-43c9-85ea-b62da989e222", "comment": "Malware payload (Mirai)", "value": "42af36213be1daf0dd161e82f53f36ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212849, "uuid": "4531e99f-f082-4004-ad67-eca2f9d901cd", "comment": "Malware payload (Mirai)", "value": "14cd940f09ca64491cd984eb359adb9422548dcd5ecd24e79da53c6f2de3aba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212849, "uuid": "9e9c574d-3517-4d46-bdde-133ac6029635", "comment": "Malware payload (Mirai)", "value": "f7a228c4cddfc597f6934fe97309b86a697e9d4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212849, "uuid": "9f8851b4-2678-4f56-a575-70ebc0405520", "comment": "Malware payload (Mirai)", "value": "081f691ccfb4e0a66ff1076406f68e926bd466b70fc3afd3addfe1fe413a718ef6cb9c528e1e26849f6b76319f67fb9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212849, "uuid": "29bd9e5a-541d-4a50-9367-3cf8b07d30b8", "value": "T14293B81E6E218FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212849, "uuid": "81f634a0-fce8-4a67-8a3c-476375920280", "value": "1536:KloXJI3TfgvW1aoqXXgLAHw3AGh6zeglH08kYf:KkJIDovcaxwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212849, "uuid": "65d5b720-342f-4a21-b9e6-242f8b2df220", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212849, "uuid": "3d1243f4-269a-45ef-8fe0-4534b0d3d98a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212849, "uuid": "1d7f58fd-c794-421e-8d51-e590520cbbe4", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa3dc5f-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185180, "uuid": "15fdb243-1fe4-4578-86e8-1cce1181be74", "comment": "Malware payload (Formbook)", "value": "c219f920f03f99eb0586ba9cd195ea9d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185180, "uuid": "a56fce31-685a-49d5-9fdb-7fe642b4e5a7", "comment": "Malware payload (Formbook)", "value": "14eb16ef6158930afe9b9ec55c0dffce97aacb340843525af4ff9e96fbeee6a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185180, "uuid": "5d226b2f-1ae8-4d65-b971-fe66832e688a", "comment": "Malware payload (Formbook)", "value": "b38b663a2d5d414e4ac0c4a4a145c357c5dd6ba7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185180, "uuid": "5f52f13e-c790-4046-a1f2-c40c0decdfe6", "comment": "Malware payload (Formbook)", "value": "6a1c484f8add4b5b9485a22a5a34d9e2f582a0f8cf4eca66668979b815d4146b422ab171382c92d6c55d3cbb474a8054", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185180, "uuid": "1bfdbb6d-d411-4a61-b8e9-e0858c2904ba", "value": "T1DB345C20DD20067A0F475B9EFCA50AA1CABDC609862750F5F6DE070D60069ECE7BE67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185180, "uuid": "3483a9fc-2602-4a84-8acc-9f9feb428de5", "value": "6144:NWVIZ0ysu4DePycYCD+px41zOz01Z3q81KVys8qvK4Qn:MyOyBycx+Izy01Z3q8YOEK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185180, "uuid": "9b6a0736-4d36-4431-9923-e7efe3b20dab", "value": 238315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185180, "uuid": "a646cf64-2a98-4ff6-b639-435294664584", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185180, "uuid": "c3c557e3-9697-4f49-b393-cbd70b3205d5", "value": "Bank of Taiwan Login Confirmation.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70139f92-813f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784224488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224488, "uuid": "91eab583-3834-4ab6-9129-6c4be9d59c3f", "comment": "Malware payload", "value": "aab5729ae2d2b33a6e3f76a0baa93bfd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224488, "uuid": "16353050-d3ae-4852-b56c-c4b0eaff1529", "comment": "Malware payload", "value": "1758a65276b21fe99d167972e274e002dea24ecc9319aff6dafe4385771002e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224488, "uuid": "081f6287-20f6-4a5c-83d6-6b48dc4a940b", "comment": "Malware payload", "value": "d85a3524b21fef0c6349e1b7fcf5243332fc222f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224488, "uuid": "5febefe2-831d-40ab-b6c9-42deaddcc493", "comment": "Malware payload", "value": "65439b74c06da28a8f734b9bbe8ef1f77465ed6776d267c536986e380349b8f4a0b0093a343b9527909869ecda8d78e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224488, "uuid": "f8a955e2-fe15-42d0-b916-8e885fecbb42", "value": "T165C28C966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224488, "uuid": "2841d86d-a67f-42f0-b337-fa8a127d4b00", "value": "768:J8vCB+25j6es8RY9FYpMSUpi+20qUpi+20YQX:J8l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224488, "uuid": "c8925fdd-e60d-4cfe-844f-ac45819a3cfc", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224488, "uuid": "57ae2e07-4595-4030-9f37-d99a11d90d99", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224488, "uuid": "e050e3ab-02b5-47a0-84f2-80c0d3a29c58", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8318e192-8160-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784238694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238694, "uuid": "b1301b91-47b5-489b-b9ce-6c9ce8ce4b3f", "comment": "Malware payload (njrat)", "value": "3615c83e052752143227134a49e10a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238694, "uuid": "173aeb71-31ac-4b8a-aaa5-a1be0b8650f4", "comment": "Malware payload (njrat)", "value": "176384807e08ef03d707d11a1dde23cb61c5a78d187fd8b9870a6f773f880ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238694, "uuid": "cad8a8fc-fa85-4e29-8625-544f9a68e087", "comment": "Malware payload (njrat)", "value": "e8ad442bf0fe167e8ed9ea44f77395cc2b4dd30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238694, "uuid": "901710d1-7e6b-4b6c-b6ff-ac1f5bb36464", "comment": "Malware payload (njrat)", "value": "ee1aad8ae440013887ff86f777ecd14c28eead01947b379dada6bdceddc7af0c60081797e3bfec7ecacf53b8675cf120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238694, "uuid": "1f311c2d-12b3-446a-a87f-badbc8c6b3eb", "value": "T1C8252320BAC0C5B7C47B11360AE99FB189293035576BD9C3FB4E6BB56A421D493392CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238694, "uuid": "8befa7c0-349e-475f-9901-c986334857e0", "value": "720f62ecaae027b5c3ec6686644322e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238694, "uuid": "8c85c7ff-8bed-4745-b05b-671df76350cc", "value": "24576:ESQkTf49MgrHIuacWW6tvXWivhMDWCf2h54Qd1MBYkK:EkTgmgUuRrSwt054Qdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784238694, "uuid": "504b7de0-3bba-4c23-8673-1b7899c4c007", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784238694, "uuid": "1749c60b-94f0-4de1-a06c-17b0a10d9032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238694, "uuid": "2d8e7066-d94d-47d5-ba61-08fe78d7a9a0", "value": "176384807e08ef03d707d11a1dde23cb61c5a78d187fd8b9870a6f773f880ee0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f671a79-8120-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784211065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211065, "uuid": "2cbf6ba0-dec2-47dc-b746-21825140ae00", "comment": "Malware payload", "value": "64ee6372273b5cc3145bded7d2921218", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211065, "uuid": "dc3dc1b0-f79c-4d3a-a59e-f8778bf92dfd", "comment": "Malware payload", "value": "17abb74e64932b938d01b6e26ae0abeae5c135040af35085aa4fa7fbc15b608d", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211065, "uuid": "a8064e8d-3cf5-4579-9c15-6741077828a1", "comment": "Malware payload", "value": "f9379ea482e5d9460056221897ae9062fd8ee7ac", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211065, "uuid": "0681d16d-ade7-42f1-9ef8-3df7cad99b48", "comment": "Malware payload", "value": "6ea2728e9b1d899d3015b07155475297ed657cdcb83dbda17709997a481981f8575b89327d9a4b8083ddcea3aa6f0591", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211065, "uuid": "dc6bc4d1-e381-4a02-ab20-06c56afc97ce", "value": "T13FA12B30355726BC798B4DE9194887ADCBF2237E212BC880341E59CB7FDB1498A780A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211065, "uuid": "fb8fad82-1b81-48b3-9345-6107d819415d", "value": "96:JdjWfevwYwdrt9z34m7beejQ/aKEkLy5hyCwEth0tYh:iiG94mXH3KEkWutEj0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784211065, "uuid": "2cc26eb8-f68e-465d-920b-77970c5081ae", "value": 4671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784211065, "uuid": "230e764e-caef-4dc5-844f-2876c4841370", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211065, "uuid": "0c961700-efe2-4d87-99d2-e848325dd473", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e605a870-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246161, "uuid": "63e03643-96e9-4ea2-8854-eb41b6cd3413", "comment": "Malware payload (Mirai)", "value": "4c4a669cac6a76e4576d9bc49d3385aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246161, "uuid": "8adcf049-9964-4ca0-bc06-0cbad099513f", "comment": "Malware payload (Mirai)", "value": "186268920bb9c037bc928b21d405d552f7b0127c551ff795661ee342ac1f9029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246161, "uuid": "b2267533-aca4-4216-9a0e-653f57cf1135", "comment": "Malware payload (Mirai)", "value": "69c73288944835b09f3bf0a27a003edf95351dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246161, "uuid": "6ecc6fc1-2e20-45b8-88fe-a1459fba5003", "comment": "Malware payload (Mirai)", "value": "bbdc431b11e28de414d562f45c4c704c593b2d950ed7b7332c211bbae5cd12b9fb53f55e4482325a0203e9486d2ec855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246161, "uuid": "03f762b2-6a27-431d-8b3e-96e6122bdace", "value": "T1F0B3290377080F07D05319F42ABB4BF143AABDA128F4B689651ABF859771EF66042FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246161, "uuid": "33b07eba-6d6c-495f-85de-ceabfc197e9e", "value": "1536:mLZU+Xofn/yNTWmukkQYxnMNEd/FWQ+g+N7O0uNqZ8bX3SO5KCorJQKq6+wIehJ:mrTtYYEJF4X7ODX3SgKrJrlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246161, "uuid": "7ddac76e-b6e8-4f4b-aa73-f71a5a9e5ff9", "value": 112344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246161, "uuid": "b71fcd06-eb8c-4956-8c8c-54750f4ed02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246161, "uuid": "d8747e9e-cbbe-4d22-b277-0b4ee6e43ec2", "value": "nerv.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b29bf57-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784185235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185235, "uuid": "a271fa84-1cdd-45aa-a53e-70dbae0c4cf7", "comment": "Malware payload (GuLoader)", "value": "0f88ffd5655d204a55d42c44e8d4e5df", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185235, "uuid": "689fdabd-da5b-40dc-b4b0-f6ed2aec25c1", "comment": "Malware payload (GuLoader)", "value": "18b716771b4141f47dd8884382e50e5d9a08561db09b8bd5eeb68cfcc7cfe09d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185235, "uuid": "98d51e52-1b24-41d3-b2d1-a03bfa7dd7d5", "comment": "Malware payload (GuLoader)", "value": "e2bcfc9d32927a35bcb2dcf6a1a31dd85f1fb9ee", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185235, "uuid": "f1bc058a-605e-4414-83a5-48a781b6d821", "comment": "Malware payload (GuLoader)", "value": "a07422b1cc0d2b47f1de80eaaa77c5fc8754fb29f023e668b2e89ad3413ae22e75b62b89ac002360cf16bca4316ea36e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185235, "uuid": "4841bae4-abe0-4c80-ac0b-32f7d4137ca5", "value": "T1B3345C20DDA4027A4F475B9CFCAA0A61CABDC719852740F0F6DE470D61069ECE3BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185235, "uuid": "11a726ce-5216-424c-bfae-72fc44a9e063", "value": "6144:NWzoZc6FgErgjgpFucP61LJG0MWfa8HtVIjcqc947M:Mki69gjYuZLE0MWfa8DxH99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185235, "uuid": "3dcb3fe6-2d5e-4817-9571-6b42c5ee093c", "value": 239319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185235, "uuid": "6c550e3d-a88b-4d7b-9522-302b215d2f28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185235, "uuid": "6ad70287-1c3d-42fa-af71-7169a24164a4", "value": "aigx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d3ab04-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1784186085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186085, "uuid": "8fc8c7f6-fd59-4b7b-bd40-af67c0ad7c44", "comment": "Malware payload (LxBaseRAT)", "value": "564177d920a5b1bb9d79cc32b843160e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186085, "uuid": "3ee2fc08-e3a9-405e-a04b-49240db07490", "comment": "Malware payload (LxBaseRAT)", "value": "18e848ff796023fdd1bda29e43efe6b2485dfe7c910a537463eef99c35a7cc27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186085, "uuid": "d5989260-89fd-4ac0-8072-abef5fd2819e", "comment": "Malware payload (LxBaseRAT)", "value": "7e24b0e7821128b580096fc30b419713961b0b6d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186085, "uuid": "b00c20ae-05bd-404c-9e61-ff6ea8aabf19", "comment": "Malware payload (LxBaseRAT)", "value": "f2641d0ed5a4f9672835793be0e4f1911a701fb7e4f617f75f06da75f602cd2fcbcd9bbfdf9cd165dd585c885cdd1863", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186085, "uuid": "25fb4467-c186-4543-b8fb-0f970355ab7f", "value": "T113856B13A7C7538BB2393CBDF1D06E0678DEAC130539E8DA8FD68982595A984D07D34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186085, "uuid": "6787e429-cfe6-4f27-96e8-f29ebbb57892", "value": "49152:LjFoNCLlOcDkOC+JNT6LlSluRdbCebeI1:LjFoNCLlOcDkOC+JNT6LlSluRdbCebee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186085, "uuid": "70b4964b-b124-4354-b365-03ee3c5247e9", "value": 1862228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186085, "uuid": "7fc4f6c1-61f2-465a-9b29-769c73686002", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186085, "uuid": "978bd613-d9cb-4bd8-86bd-f348ac2f5339", "value": "Purchase Order- BE2607-3463 -July-16-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a381aaa9-80de-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784182913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182913, "uuid": "f4f361f9-b93d-4aff-8c4e-7d2653d99363", "comment": "Malware payload (Vidar)", "value": "6842e54018e1b774efee0dfb2cc0623b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182913, "uuid": "e95caed7-93d9-42a2-b074-8678f5be6420", "comment": "Malware payload (Vidar)", "value": "18f168698bd960d8294f44f6e621cf7e47fba00c47b9db449a08f8c9eb7a3f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182913, "uuid": "2f89b860-ba7d-4ba4-9693-2910bc1ef940", "comment": "Malware payload (Vidar)", "value": "71bfe1aa764f9644e6ceb34acf6b3bc9baea4d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182913, "uuid": "86f5e779-aca6-4da3-86df-4075f8d84e7d", "comment": "Malware payload (Vidar)", "value": "e4c7dc7c0ef5304361b570e97f80c3988b1b0a455de568fd75e1d085c3b03ced93e743af1cd266c872b896783b9edca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182913, "uuid": "a89c98bc-2877-451a-8c05-bf1568281018", "value": "T1A1F58C077DE049F6C09AE73588A64646BB70BC0D4B3527DB2E50B6B83E327E16E75B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182913, "uuid": "2e1f52bb-49e3-4481-b6e5-58bd876df296", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182913, "uuid": "3bcc2d95-39f9-47d6-acac-d844b2e7b002", "value": "49152:/VLpTrR1GazsjBk4atUf370mkco3PWISz7RWgVMv4:/VdSASoXhchQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182913, "uuid": "e92feafa-610e-4ef8-b53b-c99256380e3e", "value": 3574104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182913, "uuid": "b8c4f02a-3bb6-4dd6-b122-2d274da71ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182913, "uuid": "7176b06e-174b-4458-8dc0-ae62f9f7024f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29861848-8172-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784246274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246274, "uuid": "8b44fd04-36de-4319-bc1a-fa115bef8268", "comment": "Malware payload", "value": "f39c47286b0296690c11fa9d7ad637f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246274, "uuid": "fb076c93-8bea-4a4a-9bcd-330d9646f4eb", "comment": "Malware payload", "value": "199f3b730634be3c5259ec80111f7ac2b20e61e122dc56bf7516b75b965aab57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246274, "uuid": "0c05de8c-6db9-4daf-b58e-f76aaf20bd07", "comment": "Malware payload", "value": "2bac65444a1acc97a40195c7b3f738eca56683ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246274, "uuid": "b2b7645a-d110-480e-89e7-6075bb81edb9", "comment": "Malware payload", "value": "0642aee23d539c4247595033a39e8e7913954f52419aaa5034d8366aec4239024077dde87a5a6e353f9fb39523994da1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246274, "uuid": "e498d945-3d2c-40e4-a8f1-b780162276e5", "value": "T1FA73185AFD40AF11E5D625BAFF4E414933534B6CE3EE7212AE209B2527CA91B0F3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246274, "uuid": "b4c17ed8-0662-44eb-bf97-893712aab8b8", "value": "1536:TNBnk613bXwz8uy7Yaj65Gd6oMwtsTql3nibRkRBCUeZWYHQw0Rit:TXbAzI7Yaj65Gd6o1aRkRBCUeIfFit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246274, "uuid": "eaa1e0d4-2f13-477e-a717-72fe72ae9ba1", "value": 79184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246274, "uuid": "dcf71835-4605-4742-bffe-69c5c8f30158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246274, "uuid": "37c291d9-43da-4f2b-b4c1-e794a26263fd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558ca565-815d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784237329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237329, "uuid": "4d0782ff-0a44-4c2a-a7e8-523ee305c80d", "comment": "Malware payload", "value": "294ba50b59e172b67e8a26e8fba5ff1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237329, "uuid": "38d6c5f6-19b9-4f15-9bce-9394fb5bb34f", "comment": "Malware payload", "value": "1a17f110db298bbc9f7954efac496bb1ee31a1177ddad152c745521e6077532c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237329, "uuid": "b3658514-9904-4c12-8ebf-0fc8d5c1785a", "comment": "Malware payload", "value": "580a93f8fd34ffdb2ab5810e69b140782dba0527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237329, "uuid": "e45d26aa-189b-4dd4-a6bd-1f86cbf050a5", "comment": "Malware payload", "value": "2a74aa70af5d9c310c5e009a41d99c930c0e582cec9ba40a658d786ef6f270fc5874ab743988230d35bb4a8e48b9a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237329, "uuid": "640a0aea-0223-4b4f-bb0e-ced7a2c02774", "value": "T1FF531A65BE529F46C5D1267BFF1E8348732713B8E3EA7213EA152F61378B52A4D2A001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237329, "uuid": "2f0b571d-e761-49f6-b6f3-d90c52a71af2", "value": "1536:lBKeuTkqz5Gq3c5MKeb7IbC1+qCRSgsAVSojZ75EF8ngJLx:lBLu46DkMh0C1+zRSgsAV3FVEF8ngJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237329, "uuid": "dcdb1571-fb12-40fa-960d-5709b418fd48", "value": 63680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237329, "uuid": "935893f6-9916-4007-8a4e-46da9931f8c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237329, "uuid": "f3168019-4cbb-47e8-b76d-86679288a42f", "value": "rmfG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d94035-80d2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784177841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177841, "uuid": "790b9de9-0559-40ec-93f7-69450beb37f8", "comment": "Malware payload (Mirai)", "value": "a1e4e790ef29a8f6b5241c603e20e008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177841, "uuid": "131404be-3489-4b37-ac7d-cb358711cf27", "comment": "Malware payload (Mirai)", "value": "1a48e4203a5016149cdec6135db83bce74bcba24834af41e591dd920599e3db2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177841, "uuid": "35eea24c-59de-41f4-bdb1-c3c28805ffc1", "comment": "Malware payload (Mirai)", "value": "4f96dfcd0958b0e46c75c5a7b5231816c0247b86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177841, "uuid": "aa39f9c1-62e9-4187-b076-4f5f2448e007", "comment": "Malware payload (Mirai)", "value": "34dcb81b97ffdd2440f95d3eced66782ff09b64fd987827b8ba11b57e28c8c464a822261559ad5878f4d660a9061feca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177841, "uuid": "c869b042-c3fe-4de6-a04a-8f17047d7c68", "value": "T1E1C3E185BB6369D1C1A242FDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177841, "uuid": "503c5f92-6bfb-4d94-8a54-e749bb4265ea", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnN:0OCDjXG9qTWywxlxTnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784177841, "uuid": "2321b924-3995-4aee-8951-5dbe0d1b9d2b", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784177841, "uuid": "b091e1bf-3f95-4f41-9048-fe5f85c759fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177841, "uuid": "b90dea07-df56-4aa0-8009-ce84043c6425", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc6f9a6-810c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202523, "uuid": "c73bc547-3584-4fba-ba2c-47b7e327cc09", "comment": "Malware payload (Mirai)", "value": "41938515ca12b8f866569b1032506f1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202523, "uuid": "0117129a-60aa-447e-8874-866d9eb661c3", "comment": "Malware payload (Mirai)", "value": "1b06abfd69b8e88ebff85f8ee8f58a63f7c3eac098b7e86d39db1281419ed69d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202523, "uuid": "f7a0bad5-7eaa-4cfc-bda2-3cebf7014121", "comment": "Malware payload (Mirai)", "value": "01a86e1da0b6fc296928c2478c1533eddfc451c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202523, "uuid": "296b034f-6cef-42f9-8517-edde960c0e28", "comment": "Malware payload (Mirai)", "value": "6d27af102dc89d0c84c475007a98c3f41f5fd174f7e8a6d1dc841cc69c6ec6cbcfa10bcba937c37def1f233de07dbb49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202523, "uuid": "eb464741-cfcb-4db0-8db5-5d21c477b689", "value": "T143148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202523, "uuid": "63481f3f-b6d7-4969-a83c-33689b03a75b", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxR:bOVfbEdxm4iubH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202523, "uuid": "fff166a3-6d65-445e-b558-847114fd6f60", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202523, "uuid": "1d82980b-6703-42ca-a059-0f49322adb62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202523, "uuid": "bf295b76-de07-476c-89df-e1c0828dca7c", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4849751-814e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784231019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231019, "uuid": "92b1d556-4055-43bb-9cbe-4008765f2e3a", "comment": "Malware payload (Mirai)", "value": "8c317724b1593f469c6d198e95df401a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231019, "uuid": "b3f3043e-6524-406d-a414-81cc80e3c0e9", "comment": "Malware payload (Mirai)", "value": "1d5d88382a4c53f7c36bdf59c45d542a494667118d95fcf72d2aa053512a8920", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231019, "uuid": "3be77d1a-5f65-42ee-91cd-ce0b97f9cd02", "comment": "Malware payload (Mirai)", "value": "0686fe34f70788a9e7f6cfcf6765bf082a76e7b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784231019, "uuid": "72fbc6b1-f9da-4afd-89bb-7c28735027a7", "comment": "Malware payload (Mirai)", "value": "14a002d9cad5b57c3332f9e2fe1eee358a6940880972858a3d5e202591e27964a9a19228d3e269c80dc5ea189360f7b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231019, "uuid": "94aec30e-1ccb-4d6e-96fd-dd38b4dbfbc6", "value": "T19EC329A9F880DE52C6D1267AF75E514C33231378D3DE710ACE209E3467EBD5A0E7A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231019, "uuid": "727e075a-1810-4f6e-8945-16ce80ba4550", "value": "3072:aY45kbyt+I9M6lKBx9RokeVElcYEEUrH7pCx2a0hfrmFT72Uk8W+df1DlF:aYj5sEs+lcYEEUrH7pI2Z9rmFztxd95F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784231019, "uuid": "181031bc-2fb0-4957-9fc2-31a0b1ff86db", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784231019, "uuid": "5da2900a-e5df-4d67-be7d-818ddb881e13", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784231019, "uuid": "7bdf12fb-ec0f-4177-8406-257ac07411c8", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb700c6-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784246150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246150, "uuid": "2147dcd7-48e1-48ae-b0de-b81befceb1e0", "comment": "Malware payload", "value": "e364d4bb5c9de478f146f117389f49be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246150, "uuid": "2d7abdd2-e242-45df-b178-de081892f04e", "comment": "Malware payload", "value": "1d918cd3a53d12a7342b8a5c952faf6f3dd31b43984376dc50376eef9250e8f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246150, "uuid": "d306279e-14c6-40a4-a370-6df2c514a80a", "comment": "Malware payload", "value": "fff923faaeed1e9a897128acee23d5ce03e4332b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246150, "uuid": "434a0b50-bb43-4ab8-b6df-19501074b01f", "comment": "Malware payload", "value": "928d9475b606ee23f66cc49ae210e47b6d97dcba2bea9b8654a123dda6f4b30949ee581d860222c09403e95da68faed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246150, "uuid": "d61373b9-d529-4b00-913a-fe6fbf6461ea", "value": "T1D163E80AEF510EEBD86FDE3705A9070235CC994722B43B3A3574D92CF65A54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246150, "uuid": "321ad110-f062-46b0-8331-598c4f938e5e", "value": "1536:6Az3UKmIIhbkmXIyKdTnpYr/AeIVHMSmOkR4B:6Az3gTXIhooO74B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246150, "uuid": "00195aea-9241-4fa4-aa7b-87d0e69d17d8", "value": 72224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246150, "uuid": "b5b12584-764a-4879-ba1a-1cf8d2169356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246150, "uuid": "ea9ed5c3-b93e-4638-9928-1d5087041071", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a3e9ec-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784224791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224791, "uuid": "796a94f8-3054-400d-8953-e4e48170af56", "comment": "Malware payload (Mirai)", "value": "e291fd279ee54ede8953c366ea2127ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224791, "uuid": "bb8c4206-c509-4516-81c6-5f837f304b0b", "comment": "Malware payload (Mirai)", "value": "1d93fcf92ea05242855bc5385f53c8df09ae12fb70c6af40bac8a82d793432d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224791, "uuid": "c3f38c12-0847-457d-a19f-84c903e1cc0c", "comment": "Malware payload (Mirai)", "value": "2b0e00fb17734e99f201a935d3ba8dfc046518af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224791, "uuid": "eb77d731-da23-4865-abd1-327df981d071", "comment": "Malware payload (Mirai)", "value": "ec76919a740d1dacfcd6f9e1a5f02abf9333cc265fa1473afb7539e8e4f92d956ba9e5b2ee47f3320e5d4f0c2ea26f57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224791, "uuid": "818d0fd3-01bc-47b1-92ae-ebc4f1293c3e", "value": "T15B04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224791, "uuid": "7e6ee62a-8a20-4398-8057-9273de9dde49", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w+UXS:7eJpJUVD1A8n0YNgEJi5a7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224791, "uuid": "3ba34ab5-a4be-4bae-bcd2-4f03f505251c", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224791, "uuid": "12b643b5-e76f-442e-9e3f-30c6e10dc976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224791, "uuid": "5ef948c3-a14f-4d9c-8ce9-aa8ec47338c2", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb08806d-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234573, "uuid": "413c47b4-2548-43b3-b298-3ee1e2e18b0e", "comment": "Malware payload (Mirai)", "value": "03485c5c9b4b6b2758212739697ec795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234573, "uuid": "90604b33-7843-4607-9a2b-2a10501719de", "comment": "Malware payload (Mirai)", "value": "1da573c135da79d0c01ef172b88e3168fe7dba2230d80230d0f84a703c775bbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234573, "uuid": "42cb6ed8-36fb-46b9-beb1-61a54361f18a", "comment": "Malware payload (Mirai)", "value": "5e2cbfc0a7d350dd8ef272b7d02db2cc314eacc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234573, "uuid": "a1b1bd80-8e85-4021-8e1d-43894cc578e8", "comment": "Malware payload (Mirai)", "value": "f823a8948013e6a366dfe4863c838a0d07c7522c02534b753cce4200752d166c9b895d1718eb5cda9d337f6ed00c69f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234573, "uuid": "6640b5a3-bff6-403d-a890-018d3501da26", "value": "T1B173127E8363BCBDDCB49E31F843A1C83F2545B8AC64C0352F1A429069698DB4EE3587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234573, "uuid": "d85d9822-58ff-4a44-9214-bdbb0ff5fd21", "value": "1536:r50IOgyeTQrCZ7gulu1Ss4i2E+45vFYcK2bG9hFUZjLJrAf4YfLTU6tmr:rmPeTQw8SsYE+4vFewG9bUlLJ84GKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234573, "uuid": "fcdb89d8-0d60-4bf6-8229-924eacb0209e", "value": 74860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234573, "uuid": "1c3f4eb3-6c4c-4e88-ba87-98d39388b339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234573, "uuid": "9c5af0e1-cb20-413c-b2d4-663bb52de84c", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa84aec-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234599, "uuid": "8783e479-405d-4231-a5c1-1be73dce64da", "comment": "Malware payload (Mirai)", "value": "ef0dd56d147b56743d6846fb9f99da8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234599, "uuid": "6e2be6be-4a53-4f55-be7d-28efd263abcf", "comment": "Malware payload (Mirai)", "value": "1e45c6d4f8dee322386220bc10100f227a0c327a3938b9eae877c74ec37f1e71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234599, "uuid": "df5515bb-4b18-4840-8586-7cc86afb53b8", "comment": "Malware payload (Mirai)", "value": "08fb375dee08928433e29ee2110206e04c5bc586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234599, "uuid": "13d672a0-3aaa-4974-898d-d19a32d03262", "comment": "Malware payload (Mirai)", "value": "8bf60b6721f3accc29f509bf75bee32ca519054ce8bce451c4b5c2725ee7697cf08c7cee0b0ca10dc86fcba0c6c531b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234599, "uuid": "9522e60c-1d2d-4ad2-9339-6535caf1c135", "value": "T1F8B3AE36D81968F4C06E8574E5A4FE791BA3F48052A31EF716E6C6B25047EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234599, "uuid": "f5a2b154-2e44-4b16-b472-86a888f25c6f", "value": "1536:l/3uy48gDbvjIrChB2cBTR3JwK6CnZ74TiTFC/qk55ptHc:lvuy7OvEUBb13JX6c2iTFvWntHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234599, "uuid": "a734c1dc-d381-495f-9bb6-b3e12683f3da", "value": 109780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234599, "uuid": "8244ef16-1b6a-48cc-93d1-8e72f3df61e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234599, "uuid": "074c6dde-fb44-4f8a-901c-7255f97b67bb", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f1e5b4-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784185496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185496, "uuid": "f6bd2fb6-c74f-4402-9a9c-2b488f9a45e2", "comment": "Malware payload (GuLoader)", "value": "1ea6e01c9630479597cc0b581e3ba382", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185496, "uuid": "54754f40-a401-4c25-952e-1dd1edf95766", "comment": "Malware payload (GuLoader)", "value": "1e969173c001e524b7ef3a22c0fcb1cc834104c18b64beea1d0a8de14be52087", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185496, "uuid": "cb981052-a31a-4f57-9b67-fd0a740c50f9", "comment": "Malware payload (GuLoader)", "value": "3e05751e04a1073bd60386dcb05d3f5bd50a9b9d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185496, "uuid": "bc55b76a-7e48-44ea-affc-489d492e1131", "comment": "Malware payload (GuLoader)", "value": "6d6e8831808797269e560c0b8e9633bc842696001703082d9f6dcb03c13d3059805b359fe84e892f91c89466a0beb1f8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185496, "uuid": "671252e9-2623-4780-91ce-4549fa0794bf", "value": "T1B8C2F7577FD1043789CB29A692BC9F6B8A98C76200323C70BDBC775AC806E1CF26D159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185496, "uuid": "9cb2236a-6d09-4ba2-b05b-c595de8ef555", "value": "768:dJIZKWQhqiOlunMSnv2LFH54QzdxalzKjxMxiaxb0jFlWxm:glTiOdLFHOgTalzKjOxiBlWxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185496, "uuid": "2ce54ee6-8f3b-4fd1-9f6d-ff0d7e160056", "value": 26397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185496, "uuid": "827bd6e9-2f73-45cd-b4c5-22015c1cea77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185496, "uuid": "dfe431d9-828f-4418-ad91-57196e939430", "value": "GrupoPolar-20261507.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741ddad3-80da-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784181116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181116, "uuid": "4413041d-eb38-4fff-a40a-cb05d56b0890", "comment": "Malware payload (RemusStealer)", "value": "8e96fb19189ac1cecaa19fc9360f1785", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181116, "uuid": "bf168edf-7383-46e3-8411-e58a77534c74", "comment": "Malware payload (RemusStealer)", "value": "1eb7553729f86a61a1411eebc13ae6033cd3f042780ff41d6c8967fd135bec77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181116, "uuid": "67c4d265-7014-4e65-94af-1511a3a779b3", "comment": "Malware payload (RemusStealer)", "value": "c3fe45c8f42f491f60bfef0f0dcaa5a09b58bdb2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181116, "uuid": "d9a28549-0d52-4d51-a390-93e13280df81", "comment": "Malware payload (RemusStealer)", "value": "835e73d84b0b0de360c4ea7df20b535990fe6f96fc30da6dd05ea52d1bbb252b238f7bd3ad6e80b90b1b08b091dabcbf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181116, "uuid": "d7bd2595-bed7-46f7-8d1d-f0443f94c9f8", "value": "T12FC5336CCF5AFF39E6D103701A55D2743BB58C8D8530C2A38AECFED3752A7A41859990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181116, "uuid": "137e7e19-7496-427e-82c6-9255fed51297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181116, "uuid": "317dc6c3-1e4c-4561-a19f-8dac759086b5", "value": "49152:RPF19n4FmYl5XVcuBUThUMZYE0l+Me9niVEhvXDH6lF9WE6GR9uv6fUJuBHgJ:RPFhYl5XycUTq1yRL6X956GRC6fUJYH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784181116, "uuid": "9859b135-90fc-4d16-b574-50954b886451", "value": 2650112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784181116, "uuid": "dae7a4ca-43dc-419b-bc63-1784019bafbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181116, "uuid": "2910b87a-77a3-4272-996a-2d618c5c8384", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d0ad7d-80e7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186518, "uuid": "895e9ace-df76-4018-98fd-e7f7ac5af20a", "comment": "Malware payload", "value": "bbdec5a17b7d2ce728143e61a512678c", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186518, "uuid": "e696a211-07d5-45e7-b8f4-18eaf645a0e9", "comment": "Malware payload", "value": "1f9104cdd509825c75ac27bcc0878da6ebe73a3a40cbf0cd0536100c50ece567", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186518, "uuid": "fcf84211-7c8f-435a-91a0-8d07bcf4f0b8", "comment": "Malware payload", "value": "c2e6671be78ce18d717cfe71c2d0916e7eed57b5", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186518, "uuid": "8a384cff-83b8-4300-a630-1d46035ecf69", "comment": "Malware payload", "value": "182f90ccc5b4810da6a86469e6ff9bea5449125957d87dc057c2f899bac0bc3bbea8e3be03cb5f287c6f9e1bd73c0b77", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186518, "uuid": "84d74391-ceab-459d-8ec6-9b047b9fb66c", "value": "T1CC05E13AE9951D38ED2F5AFC208F4DAD4A4FD2630E87001A3BFD45E59B1C3A0154BD9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186518, "uuid": "5994e179-245d-488f-8a61-2c97222f14d6", "value": "220eacec969cc2e4a149c16a44e0e0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186518, "uuid": "0afb3533-66d6-4d55-9b72-3063944c1747", "value": "12288:NXr2mKvNSn0KMVRRgqPZOukep2FP8FZgFEHYNnwpP5wM:N7fKLKODOuDQ/nO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186518, "uuid": "315cde57-c827-448a-889e-58d57e850b02", "value": 827639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186518, "uuid": "dee376b7-8dc8-4a3b-891b-82333fdb8cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186518, "uuid": "f6734000-da05-441d-9c08-718dfcb9c8ad", "value": "netutils (8).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59026a31-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784239912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239912, "uuid": "5fa011a5-1e61-4e5c-a510-9b9bafec548b", "comment": "Malware payload (Gafgyt)", "value": "558edb0f89ac1f0c96a57688897c36f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239912, "uuid": "1cf28bf0-e1af-48ac-ace1-62eac1cb0db9", "comment": "Malware payload (Gafgyt)", "value": "1fad40f8b341ce60076d2111c2ac47b8478362498ed51fc5b9c5ceeef0f6d758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239912, "uuid": "b9acb3ba-e3f7-4d23-b425-136b5236e1ff", "comment": "Malware payload (Gafgyt)", "value": "b996ca18ee7f47b8fa989ee0b931faf3b8c740ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239912, "uuid": "90fc4d11-610c-45bf-ba2f-0bd17fca62b3", "comment": "Malware payload (Gafgyt)", "value": "f0df62b0d0e1f04639faa1c53d61703a20aae14d7a4b86eb05dcce68592940725024741c33ec72bedf9fc75f83861de2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239912, "uuid": "11ddb21e-d3a8-4127-aa3e-067fd4053efc", "value": "T1E9C3E65E2E319F3EF76D82340BB74E35D395239B26D0CA41D1ACE9092E2434E681FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239912, "uuid": "c9dc6dce-4933-4e69-b4bc-5d57a35505a6", "value": "1536:oxCziMV47HzHOLoc7jqrMR1VM+9pibuxrEQpeIE0T/mna9T/hqSbwYnPEben/56Q:ox/zuLouAHQpeIE0T/mnehqSbXP9vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239912, "uuid": "20f66545-7a2a-4257-a1be-71233b265405", "value": 126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239912, "uuid": "c77dc5df-8dc5-4f32-9c97-0c7468ea5463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239912, "uuid": "edf6c50e-d826-4775-ac94-ae1b3e209a5b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb513eb-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179303, "uuid": "406bbc0a-7d2a-41a1-a826-4eadc1bed0df", "comment": "Malware payload (Mirai)", "value": "012297223f71188f1dd4b210fd347aa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179303, "uuid": "e38b06d9-eaa2-405c-a9f8-3207e77de152", "comment": "Malware payload (Mirai)", "value": "1fc3c46350831e5df57ec64cecf510e8a007c915f00d1bfae9647f16779ad54e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179303, "uuid": "875d12fa-4713-46ce-84c5-f009f9f627f5", "comment": "Malware payload (Mirai)", "value": "f90d07f39863c9e6d0716f79f6464372bf664d13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179303, "uuid": "eb8f752e-ce24-47a0-a00f-62deefc8909f", "comment": "Malware payload (Mirai)", "value": "00b0b0ea8daeaf825fbb17c35853322448b5509cd3e4f56d673c67af67d68c2f3d3098e726e49ed11882fa284e5f05b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179303, "uuid": "30442ff7-d2db-473e-b263-96243d59f51a", "value": "T1242439067B0D0E43D1532EF0263B1BE04BEFAD9138B5E680751EBEC54271DF26589E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179303, "uuid": "33b49077-85d3-4297-b383-377feea95014", "value": "3072:5SEiH8eOs0KvlVT8M6aOEKx2+d5qpGnD34Br+3jZHnGjX:fKv78XrEKxb5qpGnDoBOjOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179303, "uuid": "190cd734-e3e5-47c7-8cf0-715587eb81eb", "value": 221992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179303, "uuid": "2f0b76a2-d258-450e-9bdb-cc5f082f30db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179303, "uuid": "065ecdbb-b7de-434f-b019-ccfe087b2354", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a8b3d4-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784213030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213030, "uuid": "d946fc90-7b8a-4b6f-933a-fe09886b15dd", "comment": "Malware payload (Mirai)", "value": "3aad9ed969d5d93364a85aac1f7366c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213030, "uuid": "0cfda013-f446-44b8-8fd8-15c399f6b672", "comment": "Malware payload (Mirai)", "value": "203b3f20ca5b99f7e544b14b7f7ea31acc4c7a10862d441e03a5a839d19b5160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213030, "uuid": "e955703a-7538-4f64-b973-cdb65d3fae70", "comment": "Malware payload (Mirai)", "value": "8a5ada31f90adb45c9acb5d6c783ea1e789a1134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213030, "uuid": "0fc58a28-5e55-4a85-9685-f08ece56aa7b", "comment": "Malware payload (Mirai)", "value": "2fd2d01bc8ea86b2e37510a7f9e3c7ccc4aa6d2c978eae6d227bca1bb05c54b83a1a6b1c7ae1af757bfdb3c8a8b63c68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213030, "uuid": "9d27e830-4245-4289-8f2f-fb822c9e80fb", "value": "T1A0F2F8D1B8825A2BC2E423BAAA6F518E336173ACD2CF7717D8111F507B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213030, "uuid": "7adc737f-0a8e-4939-93bc-ea050c424c9f", "value": "768:CzQJzX74uXq3GpKWKKZSo2Tjupjq3e+aErce6MjG:RXJXmGH2T+8SErceA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784213030, "uuid": "dffaaad0-380d-4528-9dd2-a2c8fc23f3ba", "value": 37120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784213030, "uuid": "dc2351ee-e708-4190-ac6f-30ed408dc4e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213030, "uuid": "3113e8d7-6f9f-4a4f-b2b2-866cf2eafc25", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b2fdf4-80aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784160615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160615, "uuid": "dc31e35f-971a-47cf-ac85-f4eb550b98c7", "comment": "Malware payload (Mirai)", "value": "4d630312ce785215e8097b0efff09a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160615, "uuid": "622ecfe6-1bc3-40d1-8e06-6c23407132d0", "comment": "Malware payload (Mirai)", "value": "20d9bf470d993f176a6a13ae2794bded557e1a4fd1ed50b2bb02838cc6f43189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160615, "uuid": "c0bbd854-98d0-44a4-8e58-d42b4fa5ccf9", "comment": "Malware payload (Mirai)", "value": "b470780fbb82a7d1b8fd11b69e9ab0be228591d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160615, "uuid": "2d881bf0-d1ae-4e26-be86-861456dd715a", "comment": "Malware payload (Mirai)", "value": "ffb937f1b42076cf8a971f92ae8c3bc3e5136b229e3f1b6dce25082c3f2f53fc79e1c25315e40bcb35c201306074e9f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160615, "uuid": "de41b549-aa7e-4dd1-ada3-f2a5901108ef", "value": "T1DEB30895B8D29A22C6C216BBFA0EB2CD772633A4E3DE7117CD145F21378751B0E6B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160615, "uuid": "8b391351-51e1-4153-b751-7327e7b8b099", "value": "3072:AF6rGHk7VbhwW65K+eIrdRO/z0X2Unbh:AF6rGHY9i5OI5ROu2Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160615, "uuid": "8f9e441c-671c-4516-8ca9-80d519a4f10b", "value": 117556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160615, "uuid": "986a9a69-204d-40a1-b133-b096657637b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160615, "uuid": "959e2ffd-f92d-45cb-9a52-58f509575e65", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f7e592-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784185255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185255, "uuid": "7d6612ff-23d5-4bee-bfa9-1d16a9813586", "comment": "Malware payload (RemcosRAT)", "value": "03261c3477551614ecc175b74873ff8f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185255, "uuid": "fdebf031-2a4c-4b91-9961-1567b83667ee", "comment": "Malware payload (RemcosRAT)", "value": "20d9ef98b15e9273ef3a0f76df9fdec3043972a4019ee80608e3cf3fefd2d21e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185255, "uuid": "45127d7d-3385-4299-bba6-fac962a2c74f", "comment": "Malware payload (RemcosRAT)", "value": "3e96b11398592c502eda246eb7d9378d3fde96e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185255, "uuid": "14092653-0982-408a-ac4b-e44db33ec515", "comment": "Malware payload (RemcosRAT)", "value": "095cfb01009d58f6f9e276633e981cc1a908480cadf1e979b0cc46b5457d6959cdafd51c57f65bdfcbea23cc506fd4de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185255, "uuid": "8c1de631-2143-4603-a3af-5c4c89c59a96", "value": "T122A57CC54BB802FC61A1D78CF51916B8ED0786A4BBBD18D2DE18B7522FD3F160461EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185255, "uuid": "02bf7e5a-82df-4b71-ae7d-2d09d79f291c", "value": "6144:P8/sq+00RxShUk9W2kP3jL++38LVP3jB5fqaqS+SNy:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185255, "uuid": "c07865ee-345f-4358-936c-ccbc3489319d", "value": 2261210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185255, "uuid": "f0b4a314-1c94-474b-9cb0-2a7b3ec4f439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185255, "uuid": "2704c3b0-d850-4a04-aca6-cfb2ece92578", "value": "1368377721.INV.HKG.HKC.1WP.20260714.154657.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155cda99-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185252, "uuid": "75a8e87d-de0d-4b70-a122-646356b44795", "comment": "Malware payload (XWorm)", "value": "19a58a6944ada3c05a3e439390b75119", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185252, "uuid": "13069cc7-63f7-4c3b-9c4b-85d2ec0fb4f8", "comment": "Malware payload (XWorm)", "value": "21327e4b5d555b1adfdea28de614bfd2d3bbbe05bfd849ff2e6019c70e09d117", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185252, "uuid": "e6c3c634-3463-4aa8-937f-64f56b40f5ee", "comment": "Malware payload (XWorm)", "value": "f3b099a78566d464c9fec9ee048f57d29345d15b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185252, "uuid": "ac442f9c-5bd8-4bdf-8684-2531542a92a3", "comment": "Malware payload (XWorm)", "value": "fd0f7f469f984363199778754e54935f0c56fe6eb67c550894b5aa06d69d6df33986945a352971b219caf3997df20836", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185252, "uuid": "326ef12f-3162-4a53-8fa8-69e805005ac1", "value": "T1FEB51277B6E60126D1AED7EA24CD9D72C51C80CC36640E8A256FAAE2D32E745CCC74F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185252, "uuid": "d9bb0e4b-1701-4a11-85c3-3718e2847655", "value": "96:3cKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKe:r8mxlqjT0rNAVGfBYGuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185252, "uuid": "330e6994-b403-4430-9ddc-509ffc776718", "value": 2463231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185252, "uuid": "4b7a0247-96ea-41f0-aeda-0da4d6a54c65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185252, "uuid": "117b3dba-f11c-4e82-bb1a-ce214ab9e9eb", "value": "pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4820cc-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227836, "uuid": "d8812ee5-8937-4e13-87ce-81b8082935ef", "comment": "Malware payload (Mirai)", "value": "f466584a9593d209016622dab13a2d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227836, "uuid": "dc6ba857-3fcb-4b7b-9c3e-a9137ac68e35", "comment": "Malware payload (Mirai)", "value": "2191e12021c86880ef004675629a23244afbc3ea3eec3acbfa0f7d8d3d5b62e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227836, "uuid": "1e87ac5b-bccd-4b76-aafd-d0ac9e097fae", "comment": "Malware payload (Mirai)", "value": "d1d34f77c4cbf304fcc94247baa1bc19e90f0e2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227836, "uuid": "03c8fbde-f9ca-4bea-a251-0ddcb6269b41", "comment": "Malware payload (Mirai)", "value": "5ee1095832da035d245e489850ef3efaf7c49deae2b689ff51c8d9ab0a47e17c6a47dac937ff742f630d777dbb897a61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227836, "uuid": "b0293ba2-186c-4201-a20a-358a60e4554b", "value": "T1C7E3D40E6E258F2DF779C23587F74E25A35873C726E1C645D1ACEA111E2038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227836, "uuid": "01072c0f-2e5c-431c-9fd8-dc6aae1fa55c", "value": "3072:Q1D+AyUhC3w4Wfv2akx7Yze9pgjMOZh5DRQga6awo0GauVmoytf+m+nbMI/:Q1DGUhCS5KblwfPCMI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227836, "uuid": "60b251d0-7c9d-4988-9856-5e3534b819e1", "value": 146428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227836, "uuid": "1bb095d9-f6c5-408b-8a68-7fd1a668e4c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227836, "uuid": "7599091f-c529-431c-bce3-5db25baee7dd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a008cf36-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212972, "uuid": "ff0b21c9-3f7e-4ce8-85a6-a6d33714d94f", "comment": "Malware payload (Mirai)", "value": "9e018ea621de092ff8eab7319448453d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212972, "uuid": "f6b1b7cb-f1c8-4341-a492-e5de85b07e75", "comment": "Malware payload (Mirai)", "value": "221bc3410b74403494bccb5cdb2a525f99de3b14dc6b9663efa060b671fcaf0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212972, "uuid": "d5236764-2b0b-4555-a0df-a3ce11c3f4f3", "comment": "Malware payload (Mirai)", "value": "42be901ae67cca559ef8e5d0aae98b0a37b76d93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212972, "uuid": "1ed1c05d-3b73-4fd4-bad6-bd0966f9f9c9", "comment": "Malware payload (Mirai)", "value": "888c42b70e52ab2723398efd833c24d28b27d256a107f095e729eb2156bcb4a0ed4a6abeebfc9551aa6e6510641cf1ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212972, "uuid": "492c5000-7c14-4441-a703-ec656c0e18d2", "value": "T1CD633A81BD815A53C6D112BBFB6E01CE372613A8E3EE72079D266F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212972, "uuid": "38efdf95-cb15-4bf1-9824-7b14a4c29070", "value": "1536:g1NnhydU0LklPVyUMt+Zo82Op3GlO9NUVyZvXo:g1N0YCt+yHc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212972, "uuid": "4c77bbe4-9001-429f-9f6d-5622742fcdb5", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212972, "uuid": "0fd1519c-afad-4504-9755-6bd6c43c0660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212972, "uuid": "eccd6ff8-406c-4738-9dca-992bce0d7e96", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98babe61-80e1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784184184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184184, "uuid": "00f666dd-7371-4a22-928f-65a7b65dc302", "comment": "Malware payload (PureLogsStealer)", "value": "e9a760bdd778e40a7ec3aa6d9e9861cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184184, "uuid": "589f082f-720d-4822-8211-79beb4f56f7b", "comment": "Malware payload (PureLogsStealer)", "value": "22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184184, "uuid": "84c217b4-dd64-4657-86b0-d80c50c08d18", "comment": "Malware payload (PureLogsStealer)", "value": "289ca4cc16975ca20a024738587fc7b8a345ce32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184184, "uuid": "658e154c-5038-4975-830a-74a3cbd1f8b5", "comment": "Malware payload (PureLogsStealer)", "value": "75b1383a9ca89c7c7582edd8a52cacb9b84fa09ac9fa1f861e93e5738938c737b5ee1429e155695734835e39373ed451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184184, "uuid": "b4e8806d-343e-4e18-9a26-197a3f27b159", "value": "T11B7523AC5452FA12CE981BB857A4F2B267BD0DAA3400D152CFCDBFEBFD657184C58092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184184, "uuid": "2ce84f52-2278-4101-a1e7-dd15ff89a7d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184184, "uuid": "3aedfdba-1ec2-4135-9972-59143fa7dc65", "value": "24576:vrWJTM4XPk75bGqtlgjKOTP4/kKq21xldge/Vv7c1czsPBKelcynMyTJCi5:vrAPXPk75bG+CJP4M0D9bsMeCqMKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184184, "uuid": "2ea37ae9-6d2b-4f10-89b8-71c39bf0f642", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184184, "uuid": "240a2658-f500-4a24-9855-2db9d12818f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184184, "uuid": "4dfc5629-9edf-4153-9f85-07446684166a", "value": "57008369310.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d899247-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784178823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178823, "uuid": "a3e7e173-d213-48a9-b6a1-20ca1eadb6d3", "comment": "Malware payload (Prometei)", "value": "23d5b24923ab86b2164082ec504b1d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178823, "uuid": "b9056ee4-e4a6-44e5-9089-cf14d6866c2a", "comment": "Malware payload (Prometei)", "value": "23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178823, "uuid": "2a631a1d-ea07-462c-b9fd-190a8042b9c7", "comment": "Malware payload (Prometei)", "value": "bfb86aa532d31cbf9abb62d226c0b861a0aec494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178823, "uuid": "8e227f73-317d-4fe4-bf35-da6b84d739ce", "comment": "Malware payload (Prometei)", "value": "cc4057819c060bbf44c9d4201a15c273a3ccdbe341f4e2afc5e56708682bb2f91e96d1fddd4abd0c56a750a26ecabc46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178823, "uuid": "637d8ab9-99c2-4610-8000-7c25fb1dc8ef", "value": "T19E85331639D6CA1CB595582DDD4B182EAD26755BDF2FCC1E009C0E2B49E32A270D3F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178823, "uuid": "b315205b-1403-41ee-8384-e5fc4758c45b", "value": "49152:0zKgCn/ayxJjG0Tpm2Gl3m2inAlWSzisMcR9pS:CVCyybrcHW2in8WSD5R9pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178823, "uuid": "19ef1f5c-9493-4652-8e0a-940f911c3ed0", "value": 1741760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178823, "uuid": "79486c87-dae9-4a7c-82a1-653abc26cd19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178823, "uuid": "37bd9e48-c82a-4706-8b8f-96a369212e82", "value": "23cc35d8a2be13a01a37e6518fe0c287c0895c66856e5862421ad134db5928ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c038f413-80dd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784182532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182532, "uuid": "61a827b3-61d9-44a3-bf9f-838a304a3ef9", "comment": "Malware payload", "value": "c907f9a79c8324af1f5293fbc1b36241", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182532, "uuid": "220eca1a-7bb2-4d54-8979-080f9f1a0512", "comment": "Malware payload", "value": "24fc28e45edd818e56b11dfff1fe1d7671959c55eac559ac9091316ecfa903d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182532, "uuid": "8dffee1f-1299-4bb1-a690-6b01de4867af", "comment": "Malware payload", "value": "0826cde8a072e03852cd61129cb622b0564cd644", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182532, "uuid": "3f84d1c0-3ca8-4936-9eee-6fc79b760a6e", "comment": "Malware payload", "value": "ea17eb74b54e3b20f1705b3a6b37f9267869d4944fb1dfb6dc4856c62afd3dab0da46ba8304b474f66b73bef07d73b1d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182532, "uuid": "1711cf0a-37ae-4c56-b58c-b2c58c3738bd", "value": "T1E7236C6516857C14AE99C8365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182532, "uuid": "98efa337-7f1c-41e3-80a8-f61260e40b84", "value": "768:fr9NyXsZztCV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jHusZ7cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182532, "uuid": "03c10f7b-2cf7-407a-b0cb-7d1dedb724a4", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182532, "uuid": "42a4c090-a64b-4186-ae85-3d15a9c7176d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182532, "uuid": "3d145dae-daaf-477f-879c-8787d8b59ec0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c129cc-80ea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1784188207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188207, "uuid": "5c207a06-e617-4e80-9cc8-74107acd9e03", "comment": "Malware payload (DCRat)", "value": "08945686ad13debd912ad29a63cb8e2c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188207, "uuid": "8333d725-ebe0-48ed-8d9f-0118477959e8", "comment": "Malware payload (DCRat)", "value": "2500305d3a21671212f9d98de0d4750cdda70afa6f55b4ea3f141932c2b9338f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188207, "uuid": "9f064380-0cdd-477b-a07a-26de766c2471", "comment": "Malware payload (DCRat)", "value": "46788e3ea9f4b2038e1448244c41ec369496754d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188207, "uuid": "7a0d1fb1-5002-409b-b7f5-72f8ea4ebb96", "comment": "Malware payload (DCRat)", "value": "4155b8a45521331168a7f7f67b128dda9c64770b5167884eb15444ac9a3e60c7db8f1be0f8cd4c92e65636f270933064", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188207, "uuid": "03be3964-05c5-4f15-9cfe-df780400e349", "value": "T1F2455B017E44CE92F0191673C1DF820847B4AD516AE6E72BBDAA337E55123A77C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188207, "uuid": "a4fbceb1-a809-4e53-8a58-4505ec9019b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188207, "uuid": "04461452-8dca-46ce-8204-4551c482dbd2", "value": "24576:85p82Sfb0A5iNQv2lQuNHsv5baICLpLTQq5dSo3y+so:8/WNJQyhbaIyTDgo3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784188207, "uuid": "3c56ce7f-e915-4484-a8eb-3cc03ed37b1f", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784188207, "uuid": "3ac44808-776d-4389-a373-4be48f54bc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188207, "uuid": "b3cb320b-a04b-49fc-8008-0cfa653fd5b6", "value": "08945686ad13debd912ad29a63cb8e2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb32cdd-8143-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784226152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226152, "uuid": "2293ae9f-4121-4496-80cd-5c8f386ee3aa", "comment": "Malware payload", "value": "96155e3d5a6ffe9fb02142274227ea55", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226152, "uuid": "d2812329-0d1f-46c4-be09-c46f39ce1826", "comment": "Malware payload", "value": "252653fff0e5c8ce66326b2f105dcb74a728c76d78991773e385fa580c0833cf", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226152, "uuid": "a39c96dd-1a70-4842-8949-c6d895aca067", "comment": "Malware payload", "value": "12ac50a3708c04510144fc8431fc85ba8945c437", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226152, "uuid": "00c45671-dc51-463a-bd9e-b7ef2d673e96", "comment": "Malware payload", "value": "b5b0093df4c8e9d2b36eb8c7f19277e1de777d31c353a4c4ab6bcb3cbb7ab7e0382fb4eb171603343420a9f6d5c2058e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226152, "uuid": "d15f354a-2cfe-4ff8-b358-af49b6082e93", "value": "T126D4C013B9A19076E1724635CD68AB54977DBC700F30A7CB67C0069A6EB06C0AF3776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226152, "uuid": "0efb59c4-1279-4993-a663-2002713ddfd2", "value": "cd702dbfbd74cf5a80f59195b2460134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226152, "uuid": "ccaf7e65-560f-4c4a-8e6f-2a9f62d8861e", "value": "12288:wUoVNdZJ9HO5ov7LJb7B4abhW9uyxBlDetAqxSvwiA:wUIvcojLJqa1W9uyb4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226152, "uuid": "1c2eac6c-a1e1-431d-b1a9-b07c004e4578", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226152, "uuid": "90276a8d-0725-4f8d-b103-68c33e2a4448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226152, "uuid": "f9eee121-f4bc-40d2-b733-b470305f274e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccde77ed-80dc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784182124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182124, "uuid": "8503e390-eb0a-4fc6-a9bf-7d137566eb56", "comment": "Malware payload (Mirai)", "value": "e3e01de69e4c4d19ba7d1e2ec4d006fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182124, "uuid": "bbead509-436f-4935-b085-e2d26efeadaf", "comment": "Malware payload (Mirai)", "value": "255d547f243f1d982d729ceae5e478b3fc7365d3ddccb403a770ac87557da280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182124, "uuid": "719336bd-fbbb-4694-96d2-9d5d18fd29e4", "comment": "Malware payload (Mirai)", "value": "907146604afbcb843e124f160f0f720557cd3d93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182124, "uuid": "eabc8c61-58b9-439a-8a53-0a54c36b762e", "comment": "Malware payload (Mirai)", "value": "2b7c231b0a4db9a5bce8661f2678b258db9e9fa645bf82e6b2a0f4b0fa0b3922e47372cc77d91801a97024726260223a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182124, "uuid": "ef014971-e0b7-47d2-b0a8-2f0555bd6bd7", "value": "T19A631297FFDC1FACBCC91AB807EB65DB1351903154B681A80DE65CCA846E9B1109A8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182124, "uuid": "d439a0e9-9163-49de-86bf-e5e7caa6c8b5", "value": "1536:37MbwKNGjjH+Xq34n/q8Zu41zmX3sDgP4rP4:37Mbp2L+Xqdfoz2sI4rP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182124, "uuid": "d2251070-3370-4ded-8904-e962c2aa0fe1", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182124, "uuid": "c567fda4-151c-4707-888b-ba1d4ccbf509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182124, "uuid": "38e715d4-65bb-456f-9869-7b178d89687e", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5494daa-8144-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784226752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226752, "uuid": "eed8f7fd-3c0b-4a58-b9ac-2cc3b535f006", "comment": "Malware payload", "value": "bf7c9efba2fd2795a86e92c555ccf21b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226752, "uuid": "ef98fb8a-7fc2-4b9d-aeb0-2e0becd28a88", "comment": "Malware payload", "value": "26a1a147aa545df54717c88fdbbef04a59c04f771c5681882dcb044be6983efd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226752, "uuid": "415f9b06-151e-4ac9-968e-cc99ae4420ea", "comment": "Malware payload", "value": "a3aeab2f7385cb485b83a74fe47bf7db71c0fd7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226752, "uuid": "2030e0ac-c3b2-4f95-8fda-2ecbed5a459a", "comment": "Malware payload", "value": "7bafb383fd5e4470c3baf76db6cb788657a58f96932f6ff8c65f2b29299f9ade037de647b0eb9297465ab79b3e32bf9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226752, "uuid": "b56c0179-28c9-41ff-ad93-240c75199911", "value": "T1A2C28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226752, "uuid": "2bc1f1d1-20de-49fb-bead-85d35f10fc3e", "value": "768:98vCB+25j6es8Rn9FYpMSUpi+20qUpi+20YQX:98l25JBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226752, "uuid": "a305d9e1-1b16-48a0-b037-51f547beed2a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226752, "uuid": "de615fe4-7325-49b0-81cb-1cdffc17c9a0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226752, "uuid": "9a8507e4-0103-4dd0-b2e5-940b2c8b1870", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251fe8b2-815d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784237247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237247, "uuid": "a44517b8-64a4-4473-9212-472b651a43e8", "comment": "Malware payload (Vidar)", "value": "bcd154e27ad0cd11e9837788ddba3d93", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237247, "uuid": "2a986e63-8a5c-4cbe-a44f-95dc951b66c0", "comment": "Malware payload (Vidar)", "value": "27800d5c4adcd70217ae3722b4ac4b6ad6e6de601a3c30c9fe908e5482d403b2", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237247, "uuid": "e0adda2c-5eba-46bd-9d64-b179323e40a7", "comment": "Malware payload (Vidar)", "value": "7c7526b3fbf8567960c2b8cd829c8b78f7e0fb74", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237247, "uuid": "bc810a72-df5b-490e-a6ed-e043c486eba6", "comment": "Malware payload (Vidar)", "value": "3f6fc82b41d1652ba8c6d80749777f6ff79490657264711f26f2dd7d1fc7315c5d491e8b4176f48d23053688a7ef322b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237247, "uuid": "196de3a1-f661-495b-a4a9-c4ad70585ddb", "value": "T17C167B03BE9504E9D1AAE73589B74242B774BC0D4B3133E72E50AA382F767D09D35B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237247, "uuid": "2565618b-7bf8-4c7b-a452-2d2b30a7cb79", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237247, "uuid": "15114828-e94d-4ce4-9dcb-721763e9e136", "value": "49152:fU88XqKgJ9IVom/tbg4l9LpAQgRq2aQNiYU7OFSiGvKv0PqdFTpaXABDzU6:fmB/t8anLSF0vKB5tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237247, "uuid": "0da06cf0-504e-4870-a88f-9c25892bc23d", "value": 4401512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237247, "uuid": "b5d876fb-b481-4f2a-ad16-102175bbe73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237247, "uuid": "cd78cc8a-2309-478f-bdea-70c20af259a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787bfa4c-8170-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784245548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245548, "uuid": "5068df2c-0856-4e0b-97c8-4591b936f26d", "comment": "Malware payload", "value": "e0593d318ca306414ddd1f71b942fcc9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245548, "uuid": "9875a185-29f4-4930-af03-7b62e49f500f", "comment": "Malware payload", "value": "27a3b0bd80b8038e73834b8824c88d5084f187a35037218192ca70d0dec8310e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245548, "uuid": "3afa1769-3beb-4f2f-853e-f419f9985e5e", "comment": "Malware payload", "value": "ef306e320b1426d60602a7ba306402366aca3377", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245548, "uuid": "a87ef8d7-e8e6-4a29-820e-4c6acdc99f19", "comment": "Malware payload", "value": "8ec889f5fc7588f40461bd969ec9dd1b94e58813ad85608aba51bfb6b6f55b486f0986ccfcea357f9a2ee24e280f4857", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245548, "uuid": "81712588-48cd-4e8c-82fb-9856d245dea2", "value": "T1B7C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245548, "uuid": "dac36f78-0454-4e84-ab79-5aa4bf96d4a9", "value": "768:o8vCB+25j6es8RQ9FYpMSUpi+20qUpi+20YQX:o8l25JWd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784245548, "uuid": "22d64702-df41-4617-a9ae-a0bd56643c3f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784245548, "uuid": "6cdfc4bd-03fe-4fca-bdd5-f4a6302c150b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245548, "uuid": "7d811dff-ba32-40c1-980a-ff49ad2557b1", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d434ca-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784186055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186055, "uuid": "49457d72-946f-4f15-855a-21ded002ddcf", "comment": "Malware payload (AsyncRAT)", "value": "8a9b6038d5f2ba5a2ce4cc6c805b5bcd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186055, "uuid": "b0fb7ba0-2b8d-4d92-b5a5-257d0c6056bb", "comment": "Malware payload (AsyncRAT)", "value": "284851633769226e2a9ea85d6421b1be15f155f6ecf4ba9c729659c32ff922fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186055, "uuid": "4e80bc24-18ff-4cb8-8bdb-5af8e491a7c1", "comment": "Malware payload (AsyncRAT)", "value": "dd4fb627e637ae799ad4ce788a21b1666fa740f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186055, "uuid": "2397a900-fc91-4166-a779-8d67e09ecbac", "comment": "Malware payload (AsyncRAT)", "value": "b1c841e0c11f53a7b173aefd513fb48042bd1208c941ac3308cc93388b57d5d5e7fd86d85f9947c10326c776f33749a7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186055, "uuid": "6dcf323e-6a04-4499-be20-652cc596ce75", "value": "T1C974734522C0A4845787A73F3FAEF0DAF46A0CD976844847E218F995FD7920EEAD6730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186055, "uuid": "5a865d17-765e-4a8e-967c-fedaceff0f24", "value": "3072:XSEyBTPLH7/gyysARMvwdtL2DTs1CCpdWy7oatbwiQkRPrhDU/ZLZ2G8KlO3XWGt:CEyBTP7UH8TQV7l1U/ZLZNlOZn/4pib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186055, "uuid": "a9fcd771-b767-40ce-a76f-188068bfc0cf", "value": 369606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186055, "uuid": "90dc7960-8b4c-4268-9967-c9983b1f247e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186055, "uuid": "3a8de44b-b171-4b9c-9400-c77729a97f3b", "value": "20260716103309159.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9de2d66-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234571, "uuid": "6ae2163b-d569-4c36-8e43-e6f7081f3ce9", "comment": "Malware payload (Mirai)", "value": "a797f249c69320175438bb5cdac5016e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234571, "uuid": "5aa74e35-3a4a-43d0-a692-d29d3fcbb601", "comment": "Malware payload (Mirai)", "value": "2914c453c16d69cb797ea1f92a6f56d251d3407e465176e730cbda891c6d9595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234571, "uuid": "65110d6b-f411-439a-93b7-361a3075fc35", "comment": "Malware payload (Mirai)", "value": "444601b56c780d6c1be20ef7c37b98fc30589bc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234571, "uuid": "a4effc63-dc4a-41d6-b090-07d1cdb2b936", "comment": "Malware payload (Mirai)", "value": "8d03ca36e74c3a34d9f456a6246e1cc5707413805cf3b1397e21dc7720250a1271885f6b4d13a7c1e2fa64537a5d548c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234571, "uuid": "6197bd82-e2e7-4c07-bf28-5d68df5f1ed2", "value": "T19DC36D22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234571, "uuid": "c502d54a-5eb3-4fd0-97bc-f306fc7ba5c5", "value": "1536:qZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnfAlQAPKC1D+tAlPYm5XLxgFxHJ:n3IbE/HnQWKC1ySNYOX1FXZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234571, "uuid": "c901f04d-6d5c-46ea-a166-9a149dbbec46", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234571, "uuid": "d7ca9b32-7456-4a89-8a36-f07ea142d558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234571, "uuid": "90507207-1135-4f1e-82bc-6c77b2c3e9ee", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46c1b42-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246158, "uuid": "257a8ee1-f4cf-4289-beee-567ebe910405", "comment": "Malware payload (Mirai)", "value": "b0c3644421352a0e544e590bbcd1e5f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246158, "uuid": "5daaf25a-6172-4d9b-8abb-5e082bb0842e", "comment": "Malware payload (Mirai)", "value": "2a2c89f18adebe537c277f96c0a4170de7e756ea3813b8bf1f141b6db9e10980", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246158, "uuid": "f800dca6-537e-4fe2-9a81-ab8f4f855388", "comment": "Malware payload (Mirai)", "value": "8699ec66c32d9ccb52b9a0af72367cd4753ad235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246158, "uuid": "fe05af5d-725e-4f81-9157-ce55f1e835bc", "comment": "Malware payload (Mirai)", "value": "557eaac641b6cbd44838b375fbe79966888690b942575f9989bdd527c07a695fd437b986d497ddec5aa3db727bb8c4da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246158, "uuid": "d23a1321-5a34-4412-8098-a9a0996d5f72", "value": "T14CB32986BD826622C5D423BBFA6E418E771623A8D3EF72138D215F2037C792B0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246158, "uuid": "740e2b9f-4c01-4f44-bbf5-134f147bfa56", "value": "1536:fOlvWIlGPodwHHK7CDvDNUsdnYkqlGBPRLUa7agWzT70Vhg41clTWzutuIe0:fOlezoONUsdnYkq4CuvWzHbnWyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246158, "uuid": "21c09856-c714-4997-ae6b-87f23a1efdf5", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246158, "uuid": "550353ee-afd4-4005-8a67-d7e2fbbb22c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246158, "uuid": "556fa5cc-10a5-4930-b7fb-479c6d38f356", "value": "nerv.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925add70-80d1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784177301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177301, "uuid": "b617542a-efe8-4a09-b42a-77f5b76c511b", "comment": "Malware payload (Mirai)", "value": "f2e07dbe2b728ba0847ff5ae7ea6bb65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177301, "uuid": "0445b97f-f18b-4862-a744-713be96c2210", "comment": "Malware payload (Mirai)", "value": "2adb1919a98fd6f46fa7087931c716ec35d71fdb9f279e43e6f7a6ceb5347541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177301, "uuid": "7a3ab087-05dc-437f-8461-d5a17a14ab61", "comment": "Malware payload (Mirai)", "value": "1a5b506e9d5bc58d8c977d8494eba24ba459d9df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177301, "uuid": "2d4b2c51-a5c4-42f7-b13f-4af389d144f4", "comment": "Malware payload (Mirai)", "value": "610d602d6e120f35da21944c031c5f31436b1e5bbd9a8b26bcb07d2f9e31cc034c3969c67842b8bbbb382511e288aca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177301, "uuid": "c46eb5e4-0f51-463e-8918-d877657d3959", "value": "T17B043A42E203CDB2C15301B112F7CB756E71FCB26E65C902E3B8FEA5AD656C169053AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177301, "uuid": "e84f7061-1298-486b-a2cc-f095bf87c6e8", "value": "3072:nmSuhoa2trtP4yC330ERdVpJ/K/duFvcUk1lp0M:mSukBP9CfRdVf4ovXs0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784177301, "uuid": "399c5fe1-9ff6-4790-83b5-46cce9f0d7b1", "value": 188632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784177301, "uuid": "aa17e5d3-6466-4ff1-86a0-327f600d241b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177301, "uuid": "e38d4d3e-c283-4e00-961c-70d1aeb083b1", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0838703a-80dd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784182223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182223, "uuid": "d589a15c-b144-4d10-abdc-094ac21c2895", "comment": "Malware payload (Vidar)", "value": "f3a01caba24ff65cdf1185d5eb98c41d", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182223, "uuid": "280c960d-6be4-45f1-b177-76134e00f6c6", "comment": "Malware payload (Vidar)", "value": "2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182223, "uuid": "22288b55-1357-4fd7-9bcb-aa8e700d89b6", "comment": "Malware payload (Vidar)", "value": "0072c06cf375c1beaf57c055716ff1f893731cfc", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182223, "uuid": "71bbe580-f9bd-41f4-bbb4-749624cb2ba6", "comment": "Malware payload (Vidar)", "value": "32325de8117be5ef878e8506d3f3479fbcff72fd544fcf31b42140d3f2028f82f4e1652b52005c3de1b8d0a4955b1dde", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182223, "uuid": "253728b0-7c9f-4c5d-afb3-95300f76a349", "value": "T1AC27330BD96A187DDB3F93B5F6CB993D6F19F096115C987C6220CB721C3C921E099B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182223, "uuid": "63e31c1e-98f1-4c7b-a711-351ca69682e7", "value": "42708d2b55d92e075f1f192a462703f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182223, "uuid": "c7cfa286-d2f4-4a71-8c17-c33646ce345e", "value": "393216:1u0Goe7O6bUtTVueiGsatFtoxP2TEL8MzdI6YeHjcX/1S48ALIbjvq9v/gdOnehe:1u0COMUueRtFt4D8466YeYX/P8ALYjv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182223, "uuid": "2f3b880a-4233-4b27-895e-752b245fae6b", "value": 21616048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182223, "uuid": "cb5495d2-b89e-4888-94bd-1a3420f3dc62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182223, "uuid": "5d1142b7-452b-4766-abdc-bb325aabfe53", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef650cf-80e1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184033, "uuid": "eb08dfe4-78d2-4538-b9de-f28529060510", "comment": "Malware payload", "value": "7cb79d9f4a0e00ea6161c4732c7c778b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184033, "uuid": "c59335d7-a8a7-46be-9ae8-7b02caa22627", "comment": "Malware payload", "value": "2c4cf6717cdc5227d8c96a4fd45af2b03e522d028964de25f76a0142bd1a714b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184033, "uuid": "271d3941-0a3b-471e-a983-734a55a1a397", "comment": "Malware payload", "value": "7c39dc62b04bbf70f542050471dddb2a85a9bbf3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184033, "uuid": "3d4565aa-ae4e-488a-ae9c-d5c84e1a1cb7", "comment": "Malware payload", "value": "32d07ba4f17f1c166eedd0c6aa22ba2acbc0b8e3287ad6b76261dae0c1224dd274461aebc63957886d79684fecbb4b59", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184033, "uuid": "b3682605-58fc-4845-8096-77d5ff563596", "value": "T137C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184033, "uuid": "44ba0120-591b-4dac-8bb9-5669c5c7097e", "value": "768:28vCB+25j6es8Rl9FYpMSUpi+20qUpi+20YQX:28l25JDd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184033, "uuid": "ea7ff2eb-273e-468a-a53a-9515c73e9613", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184033, "uuid": "cc7751ba-9543-4e38-ad72-69aa708bda31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184033, "uuid": "a54ef1d0-1c2d-44f9-a887-b010c8b36d23", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7192caf2-80df-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784183259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784183259, "uuid": "5dba761a-ead1-47ee-b684-4413b47d9e7a", "comment": "Malware payload (Mirai)", "value": "edc1cd62930d6a871e2716542eea43ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784183259, "uuid": "5d4dc3fc-8e26-44cf-b7aa-22c2edc1254d", "comment": "Malware payload (Mirai)", "value": "2c8f0dc19d756faf79080f820c886f075856c84a4b02f02003367b9ba1028aed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784183259, "uuid": "2b7b6540-3427-4363-8515-50e0c666eedb", "comment": "Malware payload (Mirai)", "value": "bbf75afafe1c22be62cd1d300ec81035993682bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784183259, "uuid": "4c7e5f91-ec16-4b71-80b6-80573d06571c", "comment": "Malware payload (Mirai)", "value": "778d0f7237bf06ec601b746d1c0ecec325fa4e3fe1558026b532d28bffbcad8ad9da29c2b6950355f1165eccf8d4feb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784183259, "uuid": "81fec74a-6274-4fe1-b29d-c5b1483efbc8", "value": "T13874F9117B47EC6FFC6E03B40AF78A7477E875B2256185DAE26ABF4D0E250D14D08AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784183259, "uuid": "f957a856-9d6c-43b8-ad95-246fa5e63a73", "value": "3072:5dgfu4aIPmHO/TWRJ4e3kJihzePg+kSIYfMaQuUC4suwadr4v3pci6lACo22s/Vu:PBdHO/TWRJKJ8zyVu9aKDVpBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784183259, "uuid": "25c33cee-1f29-4a62-8fa0-9daf3e15a5b7", "value": 344424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784183259, "uuid": "d5c7d38c-2635-4acd-9052-c810b40f3848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784183259, "uuid": "ea0419c6-2653-47ba-bb2b-79850ea10636", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13878c49-80d2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784177518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177518, "uuid": "f4a7bd9b-e4bf-4eab-b6ea-546c679a6461", "comment": "Malware payload (Efimer)", "value": "66dc3a6591ca1d58f689552a93443cba", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177518, "uuid": "95054e02-d078-4e27-80af-e1a4da8d056b", "comment": "Malware payload (Efimer)", "value": "2dc880d2bde626786b8dec21da6e688e096a2ea91e1358138ad2c05982f8d33a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177518, "uuid": "8a8ca06b-23c6-4b1f-9bdf-76aaed6b2d64", "comment": "Malware payload (Efimer)", "value": "b49e9596be2f6b2e994ca9e5b7cc4ad4415e7537", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177518, "uuid": "82a1cc9f-c918-4053-a4cb-eec5ede25e88", "comment": "Malware payload (Efimer)", "value": "64e08ed62b11447f724096b3f01c28b58afaf8b77b6dd11b4952804cfe2c7433c0914904e97cf8bae537c69c85d1e349", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177518, "uuid": "54dbb02b-d077-46b3-8eb9-073cfe658650", "value": "T1F8E63308BFC416EFEA73403DADA25256D86978360B31C2CB679493A27E171C24D3D7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177518, "uuid": "cc389f04-6f99-4ad4-8b38-fe95e83e88e0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177518, "uuid": "b40bba23-0968-440c-a997-5e7f4c5e347f", "value": "393216:J9shhXqAywXMW/WddSCHBvWnWXMCHWUjXXcuI3/PGTAI:J6bqAyrWMuWXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784177518, "uuid": "c442e20d-725e-4b72-b9ba-2563a4091974", "value": 14294652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784177518, "uuid": "4fab5e41-30d4-42bc-b0af-fdcd5117e428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177518, "uuid": "5fcd14b9-0182-4e83-9796-622ce879b88f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1f0725-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186503, "uuid": "cf165acf-f1e3-4c8e-bf67-77f8b6f4e58a", "comment": "Malware payload", "value": "3fd490f4bba7e7c8dfddb94008a6e5f9", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186503, "uuid": "8c0ffeee-b4a0-460d-9c95-05589e45c310", "comment": "Malware payload", "value": "2e335eab33e6988a3a07c7280933b8d91ec8a654e2017ad14d7fb1df8131cb6f", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186503, "uuid": "b0905c5f-bf8b-4ea4-b702-602c5c25fbe5", "comment": "Malware payload", "value": "0c7d096f91dc648e4cbf1f7140b56e05cbea4405", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186503, "uuid": "a386cf96-a6c1-4e76-963c-60c6629d3695", "comment": "Malware payload", "value": "a92de946db6db10a328a37811a59568110786a2f907ac39b842809bc05909682894cabf37c08c7846f21ab041458586a", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186503, "uuid": "dbe524bd-cff4-4017-8703-2f5349f3ef8e", "value": "T17705E150EA531CBAEE27DAFED18E68DF614E85E352C9072623F4C1F04A60AB0544ED5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186503, "uuid": "f432bd7d-c2f9-4ef4-95fc-baf4ad74a5d3", "value": "ce21766d52a5fd9cb38316242f7fcf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186503, "uuid": "db1c9b26-f2ef-43ab-bee8-1712e0205ca1", "value": "24576:xxRAAs7kHbtjGnpfNGQrU16uoXhodv/8N1:xxRfbIpfNGCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186503, "uuid": "712c5e93-d716-4268-a1ae-ba0e8ed0abcc", "value": 844027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186503, "uuid": "02446724-8757-4ce6-9c21-77ab2994142d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186503, "uuid": "8049ef03-83cd-4614-9efd-a68877b22b47", "value": "netutils (7).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cc86ee-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784239930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239930, "uuid": "d966b4bb-fa0b-4bf3-a0d4-5e3e7fa5cf18", "comment": "Malware payload", "value": "611903bc49358f006efce43e50a58c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239930, "uuid": "20ba9694-eaf5-44b1-941b-d573ae3453ca", "comment": "Malware payload", "value": "2ec51b9f4bd37c126e4b33c92135d4c98c6ffe719af6d1ebc33b0eff7099ad04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239930, "uuid": "2c10d93e-f939-4561-8e7f-333a4e0bfa5a", "comment": "Malware payload", "value": "a0a6edd6466b8bde7042487e16e01e743e394176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239930, "uuid": "3ccd8b5c-7c47-419b-a58c-06a97f5bb36b", "comment": "Malware payload", "value": "786f6902cebff75057e5f1b0039339f1ea30f5c5039c44f75d3e975070e35e6f60cdb60a6e42614fbdecfc2b95084712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239930, "uuid": "dbbdfa5f-d244-4a7c-bdb0-04da1d5fbff9", "value": "T182A34B96B801EC6CFC1BD67A451B4A05F638F7604F524F73A267BC73A9A60D5082FE48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239930, "uuid": "dc44d97f-33c8-4110-9277-a6d822dc2b78", "value": "3072:CYyqzisiwJrvUirw9OaTAf+qFODMiCY5bhOoE1:TAwJzYAugZY5htE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239930, "uuid": "26a33355-2116-4d34-99ef-cf24cf0b9154", "value": 102688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239930, "uuid": "0203ab00-ab73-46af-b57a-54d12857bbde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239930, "uuid": "ba16fc93-8216-4420-a484-7a59b974e519", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8126cbdd-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227953, "uuid": "39c66864-c2c8-4539-a4f0-bb029b2fd911", "comment": "Malware payload (Mirai)", "value": "f45ebc0e1d8851b7f0ef3e452ed102c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227953, "uuid": "27728ad5-a108-4175-b98c-abfac311bf46", "comment": "Malware payload (Mirai)", "value": "2ec5b69789b552a2bf8ac6fd61fc8b408efe26c422ad2ad6f466450800819035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227953, "uuid": "f188a937-2541-4b26-9fb3-140038f5d238", "comment": "Malware payload (Mirai)", "value": "8fcbc51da54fddaee0f67332bf39cbdce2871390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227953, "uuid": "39133981-a564-4c9e-a379-28829a55bc9b", "comment": "Malware payload (Mirai)", "value": "83fdda1f1e072313af86dfb2af300471e9f0055c153aaef559abfbe3be0821bd2bde6fb94ae5554469dd82114e6ab847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227953, "uuid": "e05bf6dd-d219-436d-bd9b-3af749b1011c", "value": "T17833F1A1BD6EF694EE39347A9B1BC002336E1D2AC1FD729D31F404949BC109A167D1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227953, "uuid": "bfaf5631-bca8-44c5-b4ec-557eed17da3e", "value": "1536:M6iCo2cK8cMrZ2D38pD33to19LNpG8CayXRNfy:vKwW2D23C19IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227953, "uuid": "0b0a7135-ae0e-4c77-bf5f-e51faa199b15", "value": 54484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227953, "uuid": "139a99c9-5094-4615-9dec-e6e3f1a6e42e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227953, "uuid": "0c102866-f168-4645-8c8b-327f215d28b9", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa59dfbf-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186361, "uuid": "56af96b9-1f45-45e7-93fb-07edef9baa4b", "comment": "Malware payload", "value": "baf7f5e89b96717cad9fa22383ead81c", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186361, "uuid": "82e9c3fb-5731-42c5-8335-def3eb7cd18a", "comment": "Malware payload", "value": "2ec69e39c687d3c71a31b55d3820dfe084660a85482246660b1efabbf9a5c884", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186361, "uuid": "8c9ec320-ad1b-457a-a451-e9575dfbcb0e", "comment": "Malware payload", "value": "ecc5276f707c3a95975fca1be9f81f283f318bd0", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186361, "uuid": "25bb7d64-013d-4fa1-89f7-bdf2c4934b55", "comment": "Malware payload", "value": "5700781704b327d34a15b58b02d8272b3f77a63232dc59cc16c3a869f3bd8ba63c4f90e43a89a9aeff3a5048bff3a234", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186361, "uuid": "07eca93e-ec22-4232-abb3-8cda0919944f", "value": "T1EE65F064B6D518BADF2359BC915A04DBA717F4A313C611DF3EB882E14B112D04CFEE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186361, "uuid": "030ee9e2-12a1-477a-b4d7-456bb5a7f45e", "value": "12288:Na1ib430+K2F4LFfS8V4u7knuqg8OzQlJjxb9wjhuejOByzJ/tX9egHs:c1ib43hSRBV4uQrg8OMj9q0a/x9XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186361, "uuid": "e37d7108-9638-4914-86d1-124a953f313f", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186361, "uuid": "57bc2aaa-471e-478c-9729-087a27eb3950", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186361, "uuid": "59d1f815-17e6-48fa-beae-1aaa66df4b42", "value": "2ec69e39c687d3c71a31b55d3820dfe084660a85482246660b1efabbf9a5c884.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad88b0e1-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185937, "uuid": "8862ff4b-b6f4-404a-a141-033e1e67086e", "comment": "Malware payload (Formbook)", "value": "4f87190a4d9e9734666e8d4cc30e9ed5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185937, "uuid": "531b7c9c-220f-4e22-8da9-e87171004b48", "comment": "Malware payload (Formbook)", "value": "2f06ba5ddac4670091df7015f9b98d5db9f616a326af8fe788f98890f3957536", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185937, "uuid": "9263e883-9418-462b-a064-a2033e775691", "comment": "Malware payload (Formbook)", "value": "e610937e894dcdcbdffcb9dc40f9ee426dd1e4fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185937, "uuid": "6a21f589-8d92-45e8-8c8d-6b2adf69c83c", "comment": "Malware payload (Formbook)", "value": "c4cd2ba81a676cd0b00bfaa7128ae4dc89ff99dd4deb24b1f422aad934f18cf861e963876b1a65166b407a1c6ebe6a22", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185937, "uuid": "0e66dcb8-8ffb-4103-b432-0eda38357730", "value": "T18C453361983A3A7E0EFD91F1387B1F083AA41FD1C4E6E5D072AD94CB4F57A518813D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185937, "uuid": "1ce567c0-7210-4a9e-a361-52c6928aaafa", "value": "24576:1xUZ2uFwi0sRpe5Kg32ennjjvvDbBlpuCDliyq0RoXAjYKnpV8khP8WMNk/:15VJmennjz7bm4EAjp2khqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185937, "uuid": "c103fc3c-cfd9-4baa-ae12-d984c762ce78", "value": 1278489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185937, "uuid": "fe495498-26c9-40f2-b84c-9af985847521", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185937, "uuid": "a80b50b5-9ac2-43ad-934b-bda4e0e12e1c", "value": "New Order Inquiry.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deef09ea-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246149, "uuid": "e2d70765-d02c-449a-94a5-52d42289c280", "comment": "Malware payload (Mirai)", "value": "73b7403a31c4644828a38dbdabbf93db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246149, "uuid": "7156bcc5-1577-42a6-8cac-4f71ef98ccd1", "comment": "Malware payload (Mirai)", "value": "30b74bdbf27c10add54294d75e73d34ddca5bd389bd61a5c9c51e1bab2705ff8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246149, "uuid": "9e5cdd06-3ea8-449d-802b-16b127629ff2", "comment": "Malware payload (Mirai)", "value": "6d9402c64de7ae37bac768936f6bc5472399d937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246149, "uuid": "7bcd0207-5cb4-4e0a-8473-3b18e7aaf9c6", "comment": "Malware payload (Mirai)", "value": "4f00a17a32489229e58b6403dffadb44b56bcbe40d535c1a76ebd0fc8a5ae1104d1e049dbc8cedc7080a7d271f938a46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246149, "uuid": "dc3c13ad-d470-4cdc-b946-2b232fd4e43e", "value": "T130B34AD6F801DE7DFC0EDB7F4457050AB621A36216835F3A6757BE63BC310A46922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246149, "uuid": "803b1ae0-22cb-4eda-b7c3-059fb6841027", "value": "1536:M/Fd8MNhs3SVr7fVnYMFNlzV2I1K8FFBGPtj6vpPc/rLU1BCuQJ0dpj0:GFd/GC/VnrNl52I1bBe61KPuQJGpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246149, "uuid": "6a232a7f-eb66-4677-8bca-f02c8a2c63a5", "value": 114956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246149, "uuid": "d30beba0-d8a9-491f-b8ff-301e808e540c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246149, "uuid": "95f98d69-2a10-44f6-89af-c516ca5017b1", "value": "nerv.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482626ad-8137-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784220985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220985, "uuid": "f3bac55d-f7c6-413a-81a7-c68c2590636a", "comment": "Malware payload", "value": "eba46fbe66148b7f07d078ca5c337bc5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220985, "uuid": "9fb9db9b-fdb4-403a-a692-052208f50082", "comment": "Malware payload", "value": "3119eb8493212bae139f320dd8ec291c10b0e71cffc9b4237bb35d2143b9cdbf", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220985, "uuid": "e9e87562-0669-48a8-8b4f-406fd4cc191b", "comment": "Malware payload", "value": "aa069f83f7e47b35d528d62ecff955f36bf954a8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220985, "uuid": "55a29c30-97ce-4d86-8950-e36a82fc80c2", "comment": "Malware payload", "value": "28803eb1c3e603e0419c9d70059a487faf739f43e089f73467991262e90cf60574b0a9409eb863425919bb11d7632cf3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220985, "uuid": "19a3d21f-4d8b-4946-be82-7a0c17f6549a", "value": "T1CAE5011B3B109411D65A1B7199A4CBB89735FC1DFB82838B31C6BE2BFDD9AD11E122D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220985, "uuid": "b7e9a44f-95a6-40e8-8dd7-f3799eb23724", "value": "9be8769722f912224e88155ac87b401a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220985, "uuid": "50645a33-98d5-40ec-a402-ce060009cb3e", "value": "49152:yhsJUSPqhICaTv/tps+Of4ffJ3/Wx4msSlY7qfIL6sqNCBj/7O7QAXJPFY:aVSP+ICaTvzbOfSfJ3+i4Y7hWsGCBjzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220985, "uuid": "1c1b3590-ca88-4ef5-b2f8-c3c329435582", "value": 3086616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220985, "uuid": "b0d3e150-4909-4985-b2ad-6f75074fe1ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220985, "uuid": "e6e9a9d2-b065-4492-aa22-8080cc891da7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d12531-8170-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784245706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245706, "uuid": "081b0249-52c8-4d42-b6b4-70e36f443f82", "comment": "Malware payload", "value": "e22822d6ea69264d894c7ec1712f20a9", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245706, "uuid": "4bc70fe2-365e-4617-8ac6-362d7d1c416c", "comment": "Malware payload", "value": "317343a58620066fe067f7729b65d0afee20b114c3d4565e89257a409ee9fd27", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245706, "uuid": "69f9a3c4-5ce6-4f5c-aa1f-fba257050542", "comment": "Malware payload", "value": "3a79fb25c10e47fd50de748f1525a6123a817c85", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245706, "uuid": "aa9338c8-b4dc-41eb-bc27-8f6e9f65b089", "comment": "Malware payload", "value": "ee5cecccf7eddf9f6786d642b866ef6866d4cf1c4a0ad01a65535f46cd8bf5c368c6970a3dadd1be29ba1044089ae5a5", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245706, "uuid": "d26d90cd-a3a1-4e43-ad28-fa28e043fd2e", "value": "T14BB5331367DA8134DA296BB544A24607003ABCE39F99679771B1B4CB22B3DF4E17072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245706, "uuid": "bc2bab85-6f5b-4411-b85e-cfe764f2d4b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245706, "uuid": "f61db314-2dc5-4c42-9f9f-bb63a08e0675", "value": "49152:qIMf275Mquh/aRIjJbTUUMjrHMAnYjGJEQhvF96Ip6Nqh4W:BMf4OMC5UBTMAnued9Zp6Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784245706, "uuid": "aa9fa051-3f03-4e9d-9b26-193dc2b03b37", "value": 2468352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784245706, "uuid": "d1f8619a-66e3-48b6-8936-4b0f432cd626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245706, "uuid": "a716caea-76e9-44b0-9082-704916279573", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe67b08-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784178827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178827, "uuid": "1fe04e30-2ea8-4dbe-ae3b-5ba7df6f4ab3", "comment": "Malware payload (Prometei)", "value": "2e001d94ef3867a22e9d6702aca8c9f5", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178827, "uuid": "302e038b-1c15-4d0e-8ffc-d07a0d72c729", "comment": "Malware payload (Prometei)", "value": "31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178827, "uuid": "02db5000-02bf-4539-8e25-39bd41f018a5", "comment": "Malware payload (Prometei)", "value": "b4c1f60be7d6e6468f9355044a279a8497eb8b53", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178827, "uuid": "6154d831-a20d-4ec7-a5e8-cba0b5ba6e12", "comment": "Malware payload (Prometei)", "value": "5783ad6e336a92a5e2c837fd201dd961bc2f3605e39b8cdb44173a91638336f0b51d8aefd75ce881f4a805c105a278d6", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178827, "uuid": "c09fec00-9232-4327-accc-930b9470d635", "value": "T16041236E74618E7033BDC8BC3885254C6796A66B48262F75B007783D27BC374B2683A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178827, "uuid": "7e352e75-a742-4f66-859f-b194abbcc907", "value": "48:vkwvpihneZZn1oB1nDL2Y21j/EmfthmmDo/6GUskURMTCSgMuayvN:vkwYheZZKLTujnFhmmD1o64/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178827, "uuid": "fa770d27-39a5-4416-8828-2ac77fc6667f", "value": 2151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178827, "uuid": "4b5cac92-d37a-496d-8fa5-2d1f385f932b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178827, "uuid": "253716ef-5e10-4bf8-bbb9-2ac8e507c73f", "value": "31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc57137a-8112-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784205316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205316, "uuid": "15820164-1470-42af-9a81-0bc74ae5d534", "comment": "Malware payload (Mirai)", "value": "c8e47c61b52105e3b934cc1d8d6bad68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205316, "uuid": "ffa6023e-66fa-4474-9a01-1aca7556fc7e", "comment": "Malware payload (Mirai)", "value": "31dd0a39181e65bf2681c6346fd165b1423375f7f605fa03b578b5d4da49c5d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205316, "uuid": "8a480053-a251-4e88-a2ae-d8668fe2206e", "comment": "Malware payload (Mirai)", "value": "e6b8d95e411632e4fa41865f22fc44efdfc3f6e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205316, "uuid": "fd046843-06db-478b-a521-f2eba684bab7", "comment": "Malware payload (Mirai)", "value": "fb7df086cb37872dcbd6f9b1ca00d4077c2395e1018e85d287dc880b8f4fcfcbce593d77205af6fcb1a45b741a300c1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205316, "uuid": "daed9be1-34d5-4664-9fab-295a0d536ba4", "value": "T16D04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205316, "uuid": "56cc9313-12bd-4754-80fd-07d5066fd253", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55waUXS:7eJpJUVD1A8n0YNgEJi5ani", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205316, "uuid": "46d3b80e-21d3-4f53-8240-0149bbaf9349", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205316, "uuid": "01258bf1-77c3-4e6e-93d5-2ebc3c7585fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205316, "uuid": "78ecb873-8f97-43e4-9045-c28531768262", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c009417-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239917, "uuid": "049114ce-564a-4056-a7fc-ef2ff339b798", "comment": "Malware payload (Mirai)", "value": "f4e9e45f50d85783b99b267a54971b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239917, "uuid": "7d47e677-b282-4763-b1c9-5c1726b31d2f", "comment": "Malware payload (Mirai)", "value": "31e1a03223438c819d343bbada505658bd34acbc9073764096dc044013e302bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239917, "uuid": "8b373372-f488-459a-9f05-d01bc2436127", "comment": "Malware payload (Mirai)", "value": "b80de60667aa9c9c47788a5e8480ea49826dab3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239917, "uuid": "4eff9ed1-547a-4970-9e21-53f4a9dbf3b7", "comment": "Malware payload (Mirai)", "value": "96b2fd062cefc6cf5fb666ccfaf899d158ae15f3aa3d591b2bbb984339fab632e4456d54b86270e46542c29d4ff29857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239917, "uuid": "b3e16105-3adc-47fc-8279-e384c1f4f27c", "value": "T16B839D63C59A2E88C691A3F1B4B1DF798343D45096030FBA15A7D6BD9487CCC718E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239917, "uuid": "69831e95-0115-4ebb-8471-58076c94616d", "value": "1536:Xi8E+rUu67e3R5asT+h7EfXEq3K+Ki6Jt7szo26CPqLnq:G+In7Cz+h4fXE7xiKqo26Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239917, "uuid": "013dd433-7098-44ee-a052-68f480762c37", "value": 84212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239917, "uuid": "9e027f90-0fca-4b43-a589-a229181ae0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239917, "uuid": "15647be3-d326-4e42-91d7-750ffbd46f15", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13f0dcd-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246153, "uuid": "63ebdcbb-2940-4905-ae90-30620a8d25b2", "comment": "Malware payload (Mirai)", "value": "0d7f16867ab6bd1a425f5ff30b055bf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246153, "uuid": "27d4af30-4326-47c1-9cf3-f8df2ce96401", "comment": "Malware payload (Mirai)", "value": "32bdd896bee92a8235ecc41a890208096d20fa5c834b30a4aa88fc9f31568c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246153, "uuid": "56a4002f-3ac6-40e5-94c4-97d0d1c0284b", "comment": "Malware payload (Mirai)", "value": "e4b8827adcd1ce105349a16eb78c70171631623e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246153, "uuid": "f9ef3f30-edd3-484b-893f-ac9a8e2ecb67", "comment": "Malware payload (Mirai)", "value": "12c38bc358758a41ac26de024cf42c2f12778710eac0dcc210e88edd6812448ca6f63b3b7c395e7384bb5881ded9dfe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246153, "uuid": "ad72e5e9-869c-433e-b675-9bdf9344e56a", "value": "T14FA33903B4C088FDC189C17817AF763AD972F56E0139F1FB2BD0EA166D4DE215A1EA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246153, "uuid": "31c152a8-a8cc-4068-a224-722508e76580", "value": "3072:EpSf3dIub3tZGahSksTYjSOYYQ2V1E1oRi6LbDMfsNMp/Uu:MSmub3tZrhSYjSOCiax6HD5Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246153, "uuid": "143d50b5-fd45-406d-87d3-208f8a67bce1", "value": 101232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246153, "uuid": "d3f384e0-5079-4398-bb11-2f8fbb535220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246153, "uuid": "c4748bdd-e194-42bb-a5b2-b3fc823b6ec1", "value": "nerv.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63a9610-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186381, "uuid": "06cf7072-ce53-48db-9b42-f614f851e395", "comment": "Malware payload", "value": "516dd01c4b56092ced7f33e11d9962c6", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186381, "uuid": "92fc05c3-0eed-442d-bd3d-b7ed3c217738", "comment": "Malware payload", "value": "332391ec68edab889a4949a0b5642ed45041261c84d3c940d3d07b25316ec7ca", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186381, "uuid": "3ca0a761-6359-4739-ba77-cf1316d0a4df", "comment": "Malware payload", "value": "f8bd9a962643d551a9c7af1a2242cb9a4ffacf4b", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186381, "uuid": "13904435-2d45-4343-bd27-d9da70cc762b", "comment": "Malware payload", "value": "c6015badedaf6a061eb0b9fe033743536498eb34c02baad208da71d896c254449b3f4870820e53691f889bc815cd4517", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186381, "uuid": "a7af1fee-d9f3-48a4-98c2-30dd544db91b", "value": "T1E865D02471A219A9DE272FBCA15D84A67B7FBDA2078201DB27BC41E5DF453C44C3EE18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186381, "uuid": "66567be0-6feb-465f-bec3-8e0d5c68f7d8", "value": "24576:+1ib43ZJb5xPWFj5C7I883pBsuvP2WYqp:03ZpHCw7Ij3MuvP2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186381, "uuid": "28506b64-f00b-4686-92be-3f500ba8fea4", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186381, "uuid": "97321b24-8d52-48dd-96c5-62b9b42f2d9c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186381, "uuid": "fa588e5d-0660-4224-a450-d1c7c02cc655", "value": "332391ec68edab889a4949a0b5642ed45041261c84d3c940d3d07b25316ec7ca.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4def470-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784225141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225141, "uuid": "daea04ec-a80f-4d04-be6f-73764c7c28ca", "comment": "Malware payload", "value": "f5917c4cf6e4238516489dfdf4b02455", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225141, "uuid": "b975cc2c-1815-477e-9c68-cbdbe4febd4f", "comment": "Malware payload", "value": "34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225141, "uuid": "a5ebcd9e-f702-45c1-8655-1efa564b1679", "comment": "Malware payload", "value": "459803e9570904544d4652707ea4d6692a746b39", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225141, "uuid": "da0fab7b-41c7-4d87-bded-0ce7ff929f60", "comment": "Malware payload", "value": "fdb35a505c9a593bc8291677fe3c3829631696af200e4b6e76af59356a74f3981fed20eeb1eb4612e33a1b9dc3dd35ff", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225141, "uuid": "236a463b-4c05-4bd8-bbb6-add91348ebab", "value": "T10266330767D210F6FC325A3624188120EE3D786C4BF5952D1EF6C2AD9F39784CEB2A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225141, "uuid": "0ae6a25c-08b0-459a-bcc4-9b5b3917e6ba", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225141, "uuid": "623e0dd4-ef70-45e7-8b73-beefa6e9980a", "value": "98304:JJoRb3aK2ayBzvcDSbgp1+8WES51qPzXQi3kjA8oyIG4hcDzGTkvIs04LxulqLxj:JEadBzuSbgK8WtG3kjpxSSzGT+9YqLxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225141, "uuid": "01947a07-7fb9-42ec-a12d-691f7f2e162a", "value": 6524734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225141, "uuid": "2649dca0-7e2b-4556-8d3b-b391aa097af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225141, "uuid": "0e78d450-cdc4-4e64-bb3d-0ee1bec85d62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef777fc-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225023, "uuid": "e270b332-e98e-47e2-bf36-0ebe41687323", "comment": "Malware payload (Mirai)", "value": "164e09d3ba85575738f8fa2f04252243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225023, "uuid": "27436e32-46ef-40bd-b514-c73d26569379", "comment": "Malware payload (Mirai)", "value": "34e94ee838194d93e30815758a2c61c036b3c17058274f6243d85d32ef7759b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225023, "uuid": "95b12a91-6b27-4a78-ac10-a8b177c7b320", "comment": "Malware payload (Mirai)", "value": "bbce91e8ec9815fed1018fd7097d6c490ac9fe6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225023, "uuid": "6e99d3d2-411c-4d08-b4c3-c73d5ab7faa0", "comment": "Malware payload (Mirai)", "value": "ad68c518b7af3709f573765eb061ee3f12eb5c54be920f0d397629d027cda8c851db6406c9202361051cd4fb705d5a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225023, "uuid": "10e8392b-f29c-41c9-8c71-d5255ec33422", "value": "T162B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225023, "uuid": "ab7b6e9c-24ff-4014-99e9-c00e31463349", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzI8rSR:t3SrlGWnKTU83AQB5A5Liy36fUUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225023, "uuid": "56f15804-78b3-42f8-9cab-0520d44454ce", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225023, "uuid": "8b8d455d-aa68-4501-b528-f3d542dfe57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225023, "uuid": "0357f72b-94fc-4f5a-ad9e-f20ece96d384", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bd9cea-811b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784209244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209244, "uuid": "de8f9555-030b-422a-8b3d-212ff1fb5947", "comment": "Malware payload (Mirai)", "value": "6023959ee628371f80a21777da8c7478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209244, "uuid": "c111bd63-167a-4465-aa15-9129aa486031", "comment": "Malware payload (Mirai)", "value": "351f1998a9c50263bf4c5ce1b82f8a70a1dac215c3e03ecce13d8831a06552dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209244, "uuid": "34bd18ba-cd18-47e2-9d35-305c2825ccbe", "comment": "Malware payload (Mirai)", "value": "a2cbdec001b2a2b7dbeb504cd9b82939c7ebd9dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209244, "uuid": "370df2e1-8f65-4b18-b5fb-4b8fa59dfc9b", "comment": "Malware payload (Mirai)", "value": "cd00d4a424477d7d0dc02c466efdb7dc5e9ecc74a5574a2a3a4dc2503904eda3f45454c10e407c08b43312861f5f6683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209244, "uuid": "92317fc9-2d9d-47ae-b3a9-26495e920d1e", "value": "T106C3F185BB6369D1C1A342BDA4C00AC387916E318BA313080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209244, "uuid": "ad05efaf-7913-4835-9811-1db5f532e702", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnu:0OCDjXG9qTWywxlxTnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784209244, "uuid": "6271868a-7464-4c02-b059-7d4ab77af6f2", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784209244, "uuid": "5bf7331e-4b60-4591-a3ea-14770767c3d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209244, "uuid": "521d220c-b955-41ad-af50-d8e6e40f6433", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf257be0-80cb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1784174799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174799, "uuid": "d830dab8-c565-4707-8c63-543f9867a87f", "comment": "Malware payload (Stealc)", "value": "c5301a1371c5be265ed62c10dc87e23d", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174799, "uuid": "ad173e3b-fab4-48d3-bc29-361d10b123c2", "comment": "Malware payload (Stealc)", "value": "354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174799, "uuid": "e78327a7-4e65-411d-870f-b8b68467532c", "comment": "Malware payload (Stealc)", "value": "a705003e5b1dff40451b6a87ca1d3de27491d0fe", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174799, "uuid": "01b42b0a-9826-4324-b0dc-b416c5f89e21", "comment": "Malware payload (Stealc)", "value": "b55da62af661ac39d38d95aa429993e48497da68bbd8c5ad6da84b4cb20648d9bd11870c873ad15a4983fdf56fca42fc", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174799, "uuid": "99122ca6-2cb2-4ba8-a0e1-d58965c55389", "value": "T1F2D4C013B9A19076E1724635CD78AB549B7DBC700F20A7CB67C005AA6EB06C0AF37767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174799, "uuid": "e2a52bcb-bb92-43b0-aa40-5d162c3d8ebe", "value": "cd702dbfbd74cf5a80f59195b2460134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174799, "uuid": "a6d8d40c-a87c-4929-b460-2eefe7b1a904", "value": "12288:ZUoVNdZJ9HO5ov7LJb7B4abh+1uyxBlDetAqxSvwiA:ZUIvcojLJqa1+1uyb4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784174799, "uuid": "005b561f-88bc-47f7-8bde-7945b884a016", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784174799, "uuid": "c3933e42-810f-4a41-b8a5-ea5f7b2829f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174799, "uuid": "6247104e-48d9-4b51-8811-2ab00735a90a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a6b01e-80cb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784174788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174788, "uuid": "f0fd3d1b-c60d-4ad1-ab1a-59af1d8ccbbb", "comment": "Malware payload (Prometei)", "value": "5365ede16870137cc0fdc393cc29fa9b", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174788, "uuid": "da275239-fb8b-4468-b742-f15815e0f6a1", "comment": "Malware payload (Prometei)", "value": "35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174788, "uuid": "6c6daa98-7e20-4977-a0eb-a8a4cacd5a2b", "comment": "Malware payload (Prometei)", "value": "2ae7c45a7431bc96e4b8401af67932b85563b228", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174788, "uuid": "3a0e66c8-8778-4996-8b12-2875ab918df4", "comment": "Malware payload (Prometei)", "value": "a76c02c5fc8581fc935f1b39a208992ce061625fa7068f018639194dd1230c0024999d4db830c34bf8f265a18596b997", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174788, "uuid": "b12f99ab-fa1a-48ad-80e3-3cbe7b711e47", "value": "T1CB31258F0B59C6B14B5E98EBD74582D79B070453004CD915B7DC8659BF36058F1A53C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174788, "uuid": "0119456d-dcaa-4403-b48b-b41f2420ab78", "value": "24:vP/iqghBgaU0dQtFw2AALFRYksYplmYlsYusYjsYwl2GY2sYtlDsY+lsK6YEllu4:vLCBC0dQb9AALf5sAlmGsPsqs1lpXsit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784174788, "uuid": "a4ad600e-f74b-4452-b3fb-53436d4cce2f", "value": 1459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784174788, "uuid": "790e4001-cfd7-4237-ab35-daac0da059dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174788, "uuid": "e08edac1-1d4d-4aca-a7c0-7bd1c5fcdee5", "value": "35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fbe94e-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186481, "uuid": "1e108a02-c0ad-44ba-a24f-fc23e4aec0b9", "comment": "Malware payload", "value": "c830324441d65b93cdf6b7cbd18e3ac7", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186481, "uuid": "afd2fbfb-d182-413c-b015-8a0f5fb2e9bd", "comment": "Malware payload", "value": "37a6b10fdd5fdf9331eee5af3be55467a3bf0fa3bd04c4ac382ca4e7fdbfb4b4", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186481, "uuid": "504a71d2-4b0a-485b-b92e-4c7664e4d0e6", "comment": "Malware payload", "value": "a2b288b38d15fc4b5c4c4350b02303353c6e1a73", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186481, "uuid": "127cb416-acf3-4b7f-a582-f0c8a9792cc0", "comment": "Malware payload", "value": "2979c3b94becc309ce7c9ab0aabc934a1452794835dedfd443affaf1fdd0b8edc400d8428ccee85d90bd00e3e95065e1", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186481, "uuid": "e07c8d1a-5c56-48f2-aac1-78a3bf664078", "value": "T1A905F168B6DA0A7FDF036CFDA24E08DBE74BD5A356C6101B2FB096D1890125448CFD9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186481, "uuid": "23db0f04-d680-4e9b-9b0e-4ec28828d754", "value": "ce21766d52a5fd9cb38316242f7fcf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186481, "uuid": "77f114f8-0ddc-4b07-8e69-0e4b3b8e7bb1", "value": "12288:s+K2F4LFfS8V4u7knuqg8OzQlJjxb9wjhuejOByzJ/tX9egHsb:pSRBV4uQrg8OMj9q0a/x9XMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186481, "uuid": "29fd2dcf-c48f-4d14-adb7-d37a43a5b838", "value": 844928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186481, "uuid": "5caa610d-33b9-49d3-94ab-d6187551641d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186481, "uuid": "5b51a67e-adab-42ae-b729-b7c71aac4325", "value": "netutils (4).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75de1fc7-815e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237812, "uuid": "852ff134-e836-4338-8a82-232629fbdcb9", "comment": "Malware payload (Mirai)", "value": "5fa2b3434db3b7524533896d5fb4c5e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237812, "uuid": "6f5f0b2a-cd80-43d2-8a02-46045717603b", "comment": "Malware payload (Mirai)", "value": "37ab76edb638dcc93f5f02574f7ce73bbbf98f7d895ec1b944575a19ca20a130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237812, "uuid": "6c937e38-54a3-4db5-9e2a-f9a40f60b05a", "comment": "Malware payload (Mirai)", "value": "39c1e9fc83b8a23e1c7aa5cba3fd71df9fcad959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237812, "uuid": "6a270e4f-bf10-4d65-9a62-efd798d15aaa", "comment": "Malware payload (Mirai)", "value": "85a84a2f3cde2e83fa9980523119f2ae3700f6c4bb9d2d0e31a3dde26c425d9de6b2ee60784d6251641660da52073012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237812, "uuid": "3aacafd5-e5c7-4103-9e2e-dc193d9a7dff", "value": "T12D33F1692C15DB70FA521C71DF55C7C7362B6BB5116074E306ACC638CBD4A6E1BC6883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237812, "uuid": "fbba4482-3465-4b50-8dca-27ce45072642", "value": "1536:F7DfXSjDmI+ShaNHJG2obod5ZAv0RRq1Z/nLn:F7D6/mIlhaNRSq0sRQbLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237812, "uuid": "a1306479-faf4-4b1a-907d-3c5b5944871d", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237812, "uuid": "ded1bfcc-c807-4234-9d2b-c2d8d9c6e08d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237812, "uuid": "9f3158d7-85c6-40f7-a214-60b599c54512", "value": "SecuriteInfo.com.Linux.Mirai.9816.23301.1785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ce43df-80de-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784182859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182859, "uuid": "14b0b17b-200b-459c-a61d-490ad12f4781", "comment": "Malware payload (Mirai)", "value": "8967a2210df2258578c99fca66801722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182859, "uuid": "25bd0ba1-ebce-4284-bf52-72c26c9e6f66", "comment": "Malware payload (Mirai)", "value": "37e0ef0edc991d2490cfcfe1f5de14b51b968242abbabf63fb6482ed2c1d0449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182859, "uuid": "27173f9d-25ac-4645-8690-03a7c599d95a", "comment": "Malware payload (Mirai)", "value": "c748cc5b44b4386972a1990e6ff8619840b49cf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182859, "uuid": "9e37ebba-249b-49d7-9b3f-277c23fcdfd8", "comment": "Malware payload (Mirai)", "value": "159b4a756e2e89f60d14ef7ca5af0f15b6ae77dffd61fc16b785673f1bee3f5e185045471af640026875a1757c1f3650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182859, "uuid": "350d261b-5a01-4096-ab37-c48333cfc597", "value": "T1FE241990BA59EC32C05D1C76A7FBDB593B4369D18EA2D100C460EBCCBB875C0AB68577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182859, "uuid": "e49d1409-5fc0-4de7-a534-3094031eae65", "value": "3072:bX8AhrYtpvPi1okfyjso6JeAeu0BoGdpuDVQ4wm37IUjb7nGtt3o:QAhr+vajfyIoaeu0BFGVQ4rTjqt3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182859, "uuid": "fbdabeab-6025-48c3-bee6-e62171eacd45", "value": 213136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182859, "uuid": "8e63a3a6-8a1f-4a41-9fbe-32ab51aa70f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182859, "uuid": "2ab0c8b8-59fa-412d-91b2-5f0147608c81", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8a7971-8119-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208405, "uuid": "b9623507-6469-495a-b323-6d42f4aecca4", "comment": "Malware payload (VeilStealer)", "value": "8aad7336935b15cbd088651a72ae1323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208405, "uuid": "2935a83d-4533-456c-84bf-b94886e829a8", "comment": "Malware payload (VeilStealer)", "value": "37f9de776d211aead04a1e54f2a5d8b453a1a51d1e906f3f4306868ac31501e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208405, "uuid": "383b1810-9a96-4ffd-a8f6-6fef913bd7d5", "comment": "Malware payload (VeilStealer)", "value": "1d59c589ca802fb5be1c92b2f33c888e64cd2346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208405, "uuid": "b962294c-eec8-4e0f-94e7-b31a6c00882a", "comment": "Malware payload (VeilStealer)", "value": "14fe781fc49e6a615175a8ba806129147249113cc592212ae4cad9466f44498f657093bb6306b00acc48b0250c752a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208405, "uuid": "99a06c3a-3bc2-4024-bb8d-a4451e9cd311", "value": "T159D64A47ED6501E9C4AED135CA629653BB703C884B3063D32B60FA252F77BD0AEB9744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208405, "uuid": "5a4c374e-f28d-47d1-8414-7d368bc4123e", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208405, "uuid": "6d542c77-8fd6-4ad4-a1ed-c8c3352b51a7", "value": "98304:uHIYm7v1OrbPeiAsWfxg9npX7AJppdSVSgbBrpEN:MMj1OrbPek30JvGtrqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208405, "uuid": "e609b771-97b0-4769-be10-0e1463525a52", "value": 13151232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208405, "uuid": "c4dc8461-bb9f-4a3d-bc00-e3d5240f5145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208405, "uuid": "537272b2-c357-43f5-a243-6db0d242c6c5", "value": "37f9de776d211aead04a1e54f2a5d8b453a1a51d1e906f3f4306868ac31501e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d36459d-80cf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176219, "uuid": "2c7765e6-835f-45ab-88c1-991413228adc", "comment": "Malware payload (Mirai)", "value": "e198f9fd23615fdc36fcbe2c8b4c6350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176219, "uuid": "50767d96-8d1b-41f7-a2be-922b3717ee57", "comment": "Malware payload (Mirai)", "value": "3848349f22cb1b97a4d864777aa128f3bd394eeb93540446a30e317fe4ba7cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176219, "uuid": "b2b8c3b9-5e9b-4f50-b259-06d3ed05ea8e", "comment": "Malware payload (Mirai)", "value": "156b56627e8841870bf94d2f2730243282edb40f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176219, "uuid": "655c45a5-e496-40d6-aee1-0afd23292cf9", "comment": "Malware payload (Mirai)", "value": "e5598572b7a0a1d5ce88c9e893a6857189ce68ccb1279386540d712c930c4f478ff48677763a410dbddfa62bdd8bd1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176219, "uuid": "09e1e725-6eaa-41eb-97f8-428185f4748a", "value": "T1D9731272217ADEA2D6B1843263433D9EB933487503B462BDBD7DA72FB446E105C0C56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176219, "uuid": "dbacbd84-c030-48f8-aa4d-53d61382fe91", "value": "1536:38zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmZVWbor1:MzRnwP0bMQ2RijvDZZ1rYGhG13/sS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176219, "uuid": "0dd26a09-8539-4b04-abb1-3c005e823f39", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176219, "uuid": "3bcb4141-680f-4366-93b4-832f20f7f63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176219, "uuid": "46ca74a8-4c48-4015-b003-930ea78dda8a", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631b9325-80da-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784181087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181087, "uuid": "36e1119c-d703-4994-a964-d24cbc7b839a", "comment": "Malware payload (Mirai)", "value": "ef211d1cddb4bf5f86b0a71dab25b19d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181087, "uuid": "f3830171-0346-471e-a623-20937d74433f", "comment": "Malware payload (Mirai)", "value": "38e7bad5f4c7c253634a05201c9813913ebd2dc1fa472dea04bf97e0159ae3c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181087, "uuid": "33c09edd-c05f-4388-85a2-855755d65994", "comment": "Malware payload (Mirai)", "value": "88954893d0c119469effccf46045b1ed55f9bbbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181087, "uuid": "0f13c065-bfb1-4e3d-81f3-901d2b521715", "comment": "Malware payload (Mirai)", "value": "da68cee11aa6b91121264f9cc7c7be021f2d8158d68352dd45dfb8f79cde0500387e3d97816f81024354c062220b60f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181087, "uuid": "5c23d28a-bcff-43a8-a229-83fc111e4fad", "value": "T191D3B021E4006DD1EC2129F578BA96B80350EE700BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181087, "uuid": "dd3f3d9e-3b06-4077-b8aa-380926abb27f", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xT:PiySSGp+PMmT7zMplZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784181087, "uuid": "04fa57b0-8c60-4d01-af09-5296929a3066", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784181087, "uuid": "64230627-07f8-4f41-90ac-7964e731b6e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181087, "uuid": "7ba2b43e-681b-40dd-a40a-64698bdb0061", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f59b19-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234640, "uuid": "823d67f8-8aa5-4ef7-9278-441a44ddfec7", "comment": "Malware payload (Mirai)", "value": "0c897ae66b2267b0d91a974cdcd15009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234640, "uuid": "9a0828ef-d470-4068-a5d9-6e20cef09540", "comment": "Malware payload (Mirai)", "value": "3ab5cc6ab6c35f180b8bdfd7c974124e71d0713a6f8d040872b4a0be617a3fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234640, "uuid": "17c554bb-a612-4cee-a59f-3b4d00f4c680", "comment": "Malware payload (Mirai)", "value": "f71b98fd10594f4296cb93e4dd1c3aaaeb68839d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234640, "uuid": "90e399a5-d2aa-46d9-8401-3ef9a9c5a31b", "comment": "Malware payload (Mirai)", "value": "1ae82b6ea654e8afe416822921b91faca4fd5c21872d747745ed414c2a19a1c81f1a124099177be89b287dac7f01fcf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234640, "uuid": "91de8c6a-1e8a-428b-a998-5235501a6c3c", "value": "T12FB35BC5E247D0F9D8160A302276FB375E76E17B1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234640, "uuid": "9fefdb57-dd21-4371-9084-25f2c2783f58", "value": "3072:vpe9zJgGmi+dkEF5nSMnsvxDb4ySUBNIHoC2BX:vpe9zRx+dkE5nfsMwIHoC2BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234640, "uuid": "e18c6e3d-8ebb-40bf-9e85-80483c1ec5f5", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234640, "uuid": "ebdbce06-e8d6-41ae-841e-41e37df21b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234640, "uuid": "f06ba30e-8976-4e07-9a62-278c60e5613c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc75b989-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186391, "uuid": "4a6df840-c1f9-40a6-9af1-6abf7c90f7d0", "comment": "Malware payload", "value": "9164b5b600300dd0c1ad86fd471309eb", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186391, "uuid": "b36d09fc-06a7-4843-a133-d4ddee26b84c", "comment": "Malware payload", "value": "3b69050c148e6309a1e0b0f21c54cc3ee99da3c542e8f6d00fb3a93d6c7dcb21", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186391, "uuid": "89025f8f-4c60-40e5-9aef-b681452be2f4", "comment": "Malware payload", "value": "91baeb590055cdc0cf894f38d484ce464089636b", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186391, "uuid": "f63060ee-7723-49fb-8f75-8d3101774a87", "comment": "Malware payload", "value": "48dde5c123858236df2776a225e985eb72243d0dbf77e2ed1a886283a675c95281add1a43707a877d38448917397d8d4", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186391, "uuid": "de6b4560-635d-4737-8481-c2caad8ea2d2", "value": "T1A435E01CD66D0869DA730EBC803948D6963AB4E2278341EB37FC84E78B933D4547EE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186391, "uuid": "226f8fc0-ec70-483f-9eff-3440d8382184", "value": "24576:3CRTNnaeQCfDJJuUKSJCSXUGQn4/u41ib43:onrJuxSJ/XUrw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186391, "uuid": "55760663-27d5-464d-9ef6-94d5003f9d21", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186391, "uuid": "4137b943-658d-444c-8e40-0de41674d182", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186391, "uuid": "b6442522-f146-41e2-8967-55d5e0a1f60a", "value": "3b69050c148e6309a1e0b0f21c54cc3ee99da3c542e8f6d00fb3a93d6c7dcb21.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5eb8ea-8114-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784205911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205911, "uuid": "45679a9a-bfe9-4047-b3ef-bedcba637798", "comment": "Malware payload", "value": "d5d0ac8a125733a4beb5657fda385a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205911, "uuid": "b9054146-0f72-480c-b6ce-315321fe1059", "comment": "Malware payload", "value": "3c9b1491aa35135daf8a38d0af7a972fdaec385e6815cef3858a855c3976788b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205911, "uuid": "f2d04e3b-8d50-4075-be87-7a7adc0268ca", "comment": "Malware payload", "value": "5787c8b4962e1d5d0a6c9d1421f499c107546e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205911, "uuid": "c04fc73f-2e5c-4562-b38f-5e269cc521b9", "comment": "Malware payload", "value": "d747698ab3710ab9829575e6e521e5dcde4061e5a25258a92fd4f17768f9a2356bd78c0756461c9bb28bb9e7b3e0fb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205911, "uuid": "9dba70f3-a886-4342-a0cd-b68af35a4f6f", "value": "T1FD08332C1532D05CE709A5B710D6BD72E388C222B13898ED59646FB427FBCCEA1DE617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205911, "uuid": "9deaaf68-cd96-4e29-a4b5-a3d31d557f15", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205911, "uuid": "91ed49bf-8996-4348-b8ce-3399c4fdcc10", "value": "1572864:Bt9IKPC97+u5RWYV2IpeL+QvGRJMpuoF3bI3IRVAIa5KR7:BUK69C0RWKHpeLDGRaRBbI3ik5KR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205911, "uuid": "959fab6d-8673-47fc-80aa-b03f48001160", "value": 77366196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205911, "uuid": "24e29bbd-32d3-4eb1-9106-9e7a404471da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205911, "uuid": "5825f4d9-dcb5-4a37-b0d3-5db453ecdf01", "value": "Game_winx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e720b404-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179591, "uuid": "6aeab2b7-8b7f-4e62-9a98-0621ddc67c0d", "comment": "Malware payload (Mirai)", "value": "82a1d2235510f1b13e78b549d6b10956", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179591, "uuid": "435947a5-34af-40a9-823a-845774a639ff", "comment": "Malware payload (Mirai)", "value": "3ca131018f514c922a35bdf8fa4c095a232b244ccf2db8006e2d47a758bcb10e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179591, "uuid": "1c0df8c7-86a2-436d-b57a-f87e6353cb35", "comment": "Malware payload (Mirai)", "value": "6e1c68a58bdc14cc22bb2d62bb403daa77683567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179591, "uuid": "f422f209-36d4-4853-9190-7611c6a140bf", "comment": "Malware payload (Mirai)", "value": "df374ff2e67a827b396aaf9df102a2cd3436848b696bdd689e9bfe3caf28e00244992e162f72f1ae96667a19e58242ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179591, "uuid": "498409af-68d7-4589-92cc-5f5d54ec9c4a", "value": "T166141B45FA43CEF3E81304F111B3A73E4B31ED3A4426D159EB98AEB5D9236C166097AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179591, "uuid": "92734a90-aa3e-47c4-b819-a357c8a96519", "value": "3072:4C3pKFGEe0K0GEFmVrEsLU+ZuNj8yx+dXLeSIbA6F2SPSAKlpAKI:4sp9QH+28NbIrvPSHAKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179591, "uuid": "72d0c87a-68d5-4a78-8a1c-2b55c1bcdfb2", "value": 197148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179591, "uuid": "3adfb32d-53cd-4cfd-a169-4c39b0a230c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179591, "uuid": "1369d68d-97b5-4092-93a4-9078b017a6ac", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4a6081-80d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179678, "uuid": "c682d0bf-087f-4003-be9b-fb77ecf64a7b", "comment": "Malware payload (Mirai)", "value": "c4b9e086e8956a0085ac8df162219569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179678, "uuid": "8c5064af-2cfd-492d-8517-f94e891b6584", "comment": "Malware payload (Mirai)", "value": "3d6a5b0cd6006137539d962e148695b19b7b3aa11fbaa8272c14f9f718693ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179678, "uuid": "cbb62895-f6e9-41c4-a681-bf171744005c", "comment": "Malware payload (Mirai)", "value": "b687f28660430a0fa3eabf9f0d0756b1083278cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179678, "uuid": "b06c3191-efdd-44ad-94e6-14f220d84c2c", "comment": "Malware payload (Mirai)", "value": "b42137182c31b64670dc321847ed8e71839ba70b71fed06c76c9267ecfce879afa56b2a5b122a9d153ad646bad20acf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179678, "uuid": "e025683c-d584-4cfa-bd9b-9c8d02eb9fb4", "value": "T12DC32B99F890DE52C6D12679FA5E028C33235778C3DA7206CD249F3477EBD5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179678, "uuid": "4ba77bad-bb8c-4b47-abc3-03d8187a3963", "value": "3072:6qUSL3sCco5iFM/UQ4g8OyC0w0PDlCGII4osS3f1Dl4:65G3sCX/UQ4g8Ov0wIVII4o395", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179678, "uuid": "d241d409-16d9-4185-bd1c-99233ff20b40", "value": 120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179678, "uuid": "d075b5d1-62ba-4dfb-92a8-024e570e991b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179678, "uuid": "bdeb86e9-bdc6-41c1-99e4-c85d2929f30d", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65f5800-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179590, "uuid": "1148dc9b-964c-4e83-b503-2846f7c89f73", "comment": "Malware payload (Mirai)", "value": "2f6e4bc7f6611ce3760a69e7db82f71d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179590, "uuid": "7b084c24-91db-4cf1-9800-09f3dd9f6caf", "comment": "Malware payload (Mirai)", "value": "3dac054aa4e1e74dfd56d7f073430eae9165a80ca693239ca3c9f8b8ddfa66ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179590, "uuid": "e1d0dd18-9dc1-4683-889c-98962be80ef3", "comment": "Malware payload (Mirai)", "value": "4132b15ffc49ae1676ae5cde85bc3be4ca2fd181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179590, "uuid": "47f071ad-8a89-48c8-9f66-583807d1210d", "comment": "Malware payload (Mirai)", "value": "03a05c536563a2de1714502d3abc92a9f7015b0f8564a2c8ff4194e84103c4888c91e43550eafc0c99323868fef88128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179590, "uuid": "a4c7d849-14e3-4f36-b3ce-b71300d10e43", "value": "T19A24E947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179590, "uuid": "413eef17-2ca8-4a35-8e90-a3d331734024", "value": "6144:phRdAoqvp7+4vqljlB1FJagFVL7mcZ0wNlm/WjU83:phRvqvtvq9lhJagPPZ0smujU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179590, "uuid": "196ea7c1-c861-44e7-81a8-1466001aaf9f", "value": 222020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179590, "uuid": "a55f92f6-4236-4978-b48c-6119244844ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179590, "uuid": "19af71fd-26d0-4830-a860-1082596e5db6", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9184f7ba-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185460, "uuid": "8a03eee0-d02d-4399-8e5b-e40b32683e78", "comment": "Malware payload (PhantomStealer)", "value": "cdea837cb5475b1d2a572c7ec31da6a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185460, "uuid": "5da63bf2-bf3b-4b7c-90f5-1d6c73d47f75", "comment": "Malware payload (PhantomStealer)", "value": "3e163ea4dd8e3c9d965f976cbec9775a34640baae15901be6d8148ea7177109c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185460, "uuid": "f51b2198-0096-491a-9f2e-e1ca5e5a2537", "comment": "Malware payload (PhantomStealer)", "value": "0fad6f8b71e253ac4303e5f03ebb4f51a758207e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185460, "uuid": "b0a6f80e-3be0-4d23-ba3c-010dfe7c975e", "comment": "Malware payload (PhantomStealer)", "value": "1214ca700f07f3aaa64b446a7786029b156f3832fb83c3d7eb71bd2e65ddc41eb38f537a40b39acb04141823941554a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185460, "uuid": "4261babc-a673-4d52-b070-8e0a094ae808", "value": "T19F26F2105FC86FBB8AAC1618D0BE1A1EB3E107854567BCCEEF737D4A6FAA70051171A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185460, "uuid": "b13a019f-9454-4e59-af9b-3885c123f08d", "value": "49152:zrAfyPpzlnEmrawAqCOE7CX5ddlHBJucai1G01TUXXIHAadAKC0toKK5:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185460, "uuid": "dba9f680-a89d-4896-bab0-2c7b2d7a1564", "value": 4820152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185460, "uuid": "b053b1aa-8cfd-4a71-b7d2-2f77351ce5b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185460, "uuid": "ae33e1e1-a0ef-4ea5-ae89-adefa6c1ad97", "value": "PO309842.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5010c3be-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784185350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185350, "uuid": "66951321-888a-45b2-888b-1a0847da8c06", "comment": "Malware payload (VIPKeylogger)", "value": "9e81e7124437ae804aa4285b6f1f962a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185350, "uuid": "05b2d96a-c137-4460-a70a-13003ea766c2", "comment": "Malware payload (VIPKeylogger)", "value": "3e6551a629af2742aaacd6690d2a0d9e917fffed56294f6e4f53125072c2920e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185350, "uuid": "601722f3-5a8b-442d-9f8e-dd9ba9312b47", "comment": "Malware payload (VIPKeylogger)", "value": "2cba6f9bb839b223df74928a013fe264273f8840", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185350, "uuid": "342c983b-5b2a-4da9-8a51-b93d6f22abf5", "comment": "Malware payload (VIPKeylogger)", "value": "8d1670b06fa606bef34db565ae65c654e6b07b07136c4b99cd0c0e0d4147c3a9031f1a649b4e433f6ae0af60cdf87ea2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185350, "uuid": "8227a073-17fb-4a75-a203-63712b215a55", "value": "T182A502C50BC77536C251A25F54768740AF90CC6CD92FF5F921988C8B9B26312A6AFCF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185350, "uuid": "a1026c84-cab6-4713-a99e-7a710e0b45d7", "value": "768:vEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE/:77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185350, "uuid": "45546211-b309-4920-95d9-12bce95cbce7", "value": 2255161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185350, "uuid": "9fef0677-a7e5-4c64-b66a-70f8451fd7a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185350, "uuid": "d3653dd5-886b-452b-a9d0-957ca70d1e4b", "value": "Comprobante.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27eb278e-8144-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784226515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226515, "uuid": "0f9afd62-748e-4757-a807-9740d9160117", "comment": "Malware payload (Mirai)", "value": "2034b6b3a6e12f4fc7eec46b89a5f643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226515, "uuid": "834cfd54-2198-4df7-843e-7f1b197c3352", "comment": "Malware payload (Mirai)", "value": "3e75d0909a774cbf121619dd3c49f6c416d06bddc03341b701f1b9c44a1f861e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226515, "uuid": "22a667f4-162b-4dde-ac79-b565d6e8af9d", "comment": "Malware payload (Mirai)", "value": "ea33a81787f1e112ebf5769cadad043fdc41b020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226515, "uuid": "f5652677-094f-4077-b083-fe78e7cf743f", "comment": "Malware payload (Mirai)", "value": "925ee1685206bf382bf35ebd577c1c929af8a6a1564283391227f7efeed6018339043a85ee7820832770c18c6f65c561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226515, "uuid": "dac66a94-1484-466b-8a1a-e737e909d432", "value": "T11EC3F185BB6369D1C1A242FDA4C00AC387912E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226515, "uuid": "1159ca57-ddd3-41b8-bceb-daecc5f3df56", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTn/:0OCDjXG9qTWywxlxTn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226515, "uuid": "04cd74ce-27e8-4054-975b-9e0a0f33b5a7", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226515, "uuid": "4dedf1ca-d57e-4551-bb98-8f26a43b49e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226515, "uuid": "756b9405-84db-4134-ab5c-8364002ae532", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb61241-814b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784229637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229637, "uuid": "fe5a848b-f7e8-4ad1-ba65-bd58bff9960c", "comment": "Malware payload (Mirai)", "value": "1c32009bf5d184f1400d2a22e6fc0ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229637, "uuid": "a6063c2b-6d4d-42e9-8515-26b77c3bde96", "comment": "Malware payload (Mirai)", "value": "3f3cb8f888e7d6257296b31ee1335bc41a05d0cd258028ede72aa2f19e040945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229637, "uuid": "5d38271c-455d-4124-91cd-43d4d8a02158", "comment": "Malware payload (Mirai)", "value": "8a74f3bd3a4f7127dce15a5b3d9fba3da12dfe45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229637, "uuid": "a09c0670-c963-4c39-9198-641e09333053", "comment": "Malware payload (Mirai)", "value": "dafc75df1cb52df59b8130f19fa4c26406463bab8fb167db7ffcdcb40a2d15481937d7e34e031b41bba1ec5292bcb80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784229637, "uuid": "4418f4f8-9572-4fcf-8a2e-884df0a51f8f", "value": "T10D53086AB9819F19C5C4167AFE1E534D331317BCE3DE7213EE146B242B8B56B0E2E406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784229637, "uuid": "5035d96c-bf5e-46e8-bd0e-235ad0bc189a", "value": "1536:vMn/k0htBVLpXQieD32HuDL1qmQOVj5U7irywtVmOmkn9:av//ik2EmQOVhywtVmOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784229637, "uuid": "cddf17bc-3ace-4c40-8ea5-035cac8fb453", "value": 63052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784229637, "uuid": "8b520f93-5e2e-4a44-8be2-9d8b7a0bd047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784229637, "uuid": "d0d88fac-75f2-4e31-9101-2cadebe10cc7", "value": "dbgw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4365cc8-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784185975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185975, "uuid": "5e5644d8-2078-40b4-b5a8-5fc3022e492a", "comment": "Malware payload (AsyncRAT)", "value": "4f5bf83f9852d11972288b7fd5bd55ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185975, "uuid": "9468898b-50b1-4874-9888-1f2e8659ede0", "comment": "Malware payload (AsyncRAT)", "value": "401b70e0313d7f6dd1fd444a8d61e25ae433a5944a2607405fe5ddbc9b8f7afc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185975, "uuid": "61bf8892-d4c4-4286-9403-150e021e10d4", "comment": "Malware payload (AsyncRAT)", "value": "48215c4bc010d90e8353291b137d8432c73cd033", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185975, "uuid": "52497e3e-e776-4ca9-9421-8abe81dedff3", "comment": "Malware payload (AsyncRAT)", "value": "3a2cb2a54ee420a1610d3ef2f2153cb33ab72f6793eb13f76a7532d53ac7397ab56e248a7a21e09ba16a4ed30ce77bd2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185975, "uuid": "aff07044-9b97-4451-b375-44c07a3626e3", "value": "T13341311F4942C56142B3CD7593BBE968F846103312114A16344CA5CF7FF2366CA932EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185975, "uuid": "818673ca-dbcd-4252-b802-69db7fafec4b", "value": "24:hPhR7AHM2d44WWEr9GbnyGaYYTH+4MbLGTd6jMk+WLMRApZ6OkT2Mf:tbjq4JWosvYTletjwRA+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185975, "uuid": "dd05d7b8-a27f-46ca-8922-8410194aaf05", "value": 1948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185975, "uuid": "732ea328-7a06-4909-9ecd-77344547de03", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185975, "uuid": "d69c8d90-7077-4e62-a1d3-d38629f04fac", "value": "Products.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a1e914-810f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784204066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204066, "uuid": "67734d50-4e7d-48c9-9ed7-6d7160a7ee04", "comment": "Malware payload", "value": "137616c7b95fd756b059c490b04941f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204066, "uuid": "55a3e386-7e20-4c63-8fa1-df8da775a3d4", "comment": "Malware payload", "value": "4061ebd685f6dd0f2e280392ea94ae9a0045faf420ba0dfd52775aec3e26a06f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204066, "uuid": "0d582e2c-8dec-4b07-8c3e-1f4722eed6e1", "comment": "Malware payload", "value": "5a0182d0efac860c28863af3fe94da44d2d13494", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204066, "uuid": "f9d82181-994d-4c2c-afbd-34aee0b379b3", "comment": "Malware payload", "value": "ad6298ac6ad94e2e48425bd9042ef100877c140ff4353e32d8e3233ad28e9fecf76b87168fe33dc8662d01bbc9550559", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204066, "uuid": "31322162-7cce-4b8f-b28c-ded06c9d729f", "value": "T1A9236D6516857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCB3CF28C5A69D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204066, "uuid": "884818bb-7991-4de1-bd2b-f24d683eceb6", "value": "768:cXRWNGxVp9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:QlxQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784204066, "uuid": "c83ac7b5-d016-497e-b02b-758ae48bf26d", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784204066, "uuid": "833366e5-7894-4d16-a5fa-53948df5f73c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204066, "uuid": "1ce51202-2f82-48c4-8769-463fb4fbd0fe", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f19d770-810c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202475, "uuid": "5a85f157-9b09-4e0e-962c-ed2a5d9d4062", "comment": "Malware payload (Mirai)", "value": "9a075d212221a2c86dd50b1395497ced", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202475, "uuid": "68670184-38c9-4bf6-806b-549646cab466", "comment": "Malware payload (Mirai)", "value": "40765a23f87fa777c0cfbf73c283eaac50ae142d89355eaaa9e72a966d9469cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202475, "uuid": "ffd41f28-441d-41ca-9ecf-b258f2228901", "comment": "Malware payload (Mirai)", "value": "58658872b66b08d48c6e16dd24c1122113e84c87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202475, "uuid": "452658d6-0a71-4433-b6eb-d8dcacc1a648", "comment": "Malware payload (Mirai)", "value": "1cab08e56ee22f9a302f7143cf4badad7f948d5ce2943702b2fe616cc69acfe60445b404d1500ef767a251bbb76bcb1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202475, "uuid": "b31d0cd8-8bbe-4252-a6c9-5b2e6e8e3e45", "value": "T1F86302CB6E702F1BC0D8A1B6713C15CACC3EDD8AE2438A5C97E1A796473953654C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202475, "uuid": "d106fef9-2e10-4a88-a93d-6fb69e2a4e14", "value": "1536:1axZLmYKVDNSl2y08yumeJyGYVmIMGauYN8:1axZLmYKX+t08jmeJhYTAN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202475, "uuid": "53149f59-3f8a-4d1d-b674-446371bbda24", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202475, "uuid": "ba2eff98-c2bf-4158-b246-f22df49132e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202475, "uuid": "72b8129d-fbe6-4d1c-8888-9aebf5646520", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3ddc62-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185507, "uuid": "37f63318-431b-4802-b189-676fd6657e18", "comment": "Malware payload (XWorm)", "value": "cc81d851b4b82e2ac4b6d465dd319b9c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185507, "uuid": "d6fae81f-a676-4748-82aa-59ed190662dd", "comment": "Malware payload (XWorm)", "value": "414adc9d44514fb2aa210571d1330c64ae2ba691c796859f21ba1b6aef2a4e4c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185507, "uuid": "ba672b4a-4757-4419-b037-718c5d260ffb", "comment": "Malware payload (XWorm)", "value": "4de917f9ce24fd5e5b1865ce0da23813c76bbf2b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185507, "uuid": "30caff95-580e-4648-a19a-54d868031b44", "comment": "Malware payload (XWorm)", "value": "3c05fb024a7986eda914003543ede62f23305f14c30f36321304e77d5ea1821ccc89185dd74b16b5988bceaeaaac2618", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185507, "uuid": "31eb218a-e066-433b-af78-769f17c4b7b8", "value": "T1FF354209AD56BDBCEBFA29E5FCC96DECD894E60C10F83D5E61973B41503219083A067B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185507, "uuid": "01d1cb01-69b5-4b9a-a535-5fe13a6ce275", "value": "192:jVdmdWpAgVdGs2ej64s0dndbdudZdCz1dDdCkG+bhFMaRzd8dKRWLXdn:RQeNW4P9Zcbwz1lwgtT2kIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185507, "uuid": "04a01321-3318-42cc-adb0-8989dcee2b69", "value": 1085150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185507, "uuid": "e483864c-9283-4de1-b678-2fe99278fc9c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185507, "uuid": "a5f1efb0-c5cb-48a9-8bd5-64f240338943", "value": "POD-DXB26184.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b46278-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784163833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163833, "uuid": "4ea08073-786a-458d-b8be-285093d61f9b", "comment": "Malware payload (Mirai)", "value": "3bf6c523dfa2475d24b13552c57a8789", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163833, "uuid": "0b2e8c03-3e89-496a-b5c9-475236b26563", "comment": "Malware payload (Mirai)", "value": "41e3673069a4c07ee11f566d6bba1523255b6d9cc0fceabe42da04d7f0d944cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163833, "uuid": "16e937ff-cb91-4ab6-b563-1603296d3b5d", "comment": "Malware payload (Mirai)", "value": "f7e0bc2251ec2616af7e5e1bbb51da71786e53f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163833, "uuid": "8692fb1c-a711-439d-be72-ab7558bc3dc2", "comment": "Malware payload (Mirai)", "value": "045a47a7c76d203563afdb51f693cf75059441fa62cb679d6af11f7e04fd0f29aa8dae0499f47daba67e416de0d006df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163833, "uuid": "270d7f71-d6a2-46c8-bb34-262dacca9612", "value": "T115C329A9F880DE52C6D1267AF75E118C33231778D3DE7109CE249E3467EB95E0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163833, "uuid": "d86a93b9-f3af-4fef-adc6-54d7d4538568", "value": "3072:3KkAGfJqpUqVL45zcQrT25YcYEEU1aK2x2SPpkh+ip8RNaY7AAf1Dl:3K80qrGYcYEEU1aKM2eCh+/r0A95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163833, "uuid": "4adf176e-011c-40af-a6cb-1d6e656adbd2", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163833, "uuid": "f39050cd-7e65-4b3d-9b12-eaade6d0baaa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163833, "uuid": "0af48ac6-224e-4266-b35b-d33f1f13ea4a", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029e9456-811e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784210131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210131, "uuid": "afcf35fc-db98-48b3-bda7-dd5f7de8ba72", "comment": "Malware payload (PhantomStealer)", "value": "0c14e6b5a3a8c1cf695b38a71adf8647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210131, "uuid": "77845706-d01b-4a99-bbe7-bc229584f82d", "comment": "Malware payload (PhantomStealer)", "value": "422fe14be9e911b265d6b9852ba4f03bb3245f3dbd8cad10dbd6697a04ff8e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210131, "uuid": "5e7d4a8e-c4a9-49fb-9905-62b7fb4dace2", "comment": "Malware payload (PhantomStealer)", "value": "3a4b518a0a8c513c5e3bbd2c0892b127d2153480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784210131, "uuid": "f26c8187-db25-4ec2-ad7b-d20b3c6ccc64", "comment": "Malware payload (PhantomStealer)", "value": "9b96b87f0f2481e84981f8ebc4fc4c732de390c3fe65314626dcf64b73fc691953fdd51c5e5bc13b26c9b63ede14ad94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210131, "uuid": "c20d5a99-5d9f-4f8e-948d-50f863dc4157", "value": "T193F59E89ABD80AD4E167DA34C91A9332C771F86A0735D34B1D64C3062F77AA34E77326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210131, "uuid": "770eeb58-c782-48d1-9744-ca807d971c1a", "value": "b0253ae8279600c3d8dc02919670baab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210131, "uuid": "83a3afab-2cfb-41f1-9aea-4b838c889c24", "value": "49152:i7KE9fnAnGY/RRSLvztWcDgFcM81CPuzubosKVWVR:NgngYNCPrbxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784210131, "uuid": "8734d72c-5ccf-4cdc-a7e4-09c2f6629c20", "value": 3382272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784210131, "uuid": "0fddb742-11ac-45ff-98ac-cd42af84426f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784210131, "uuid": "11f3c0a7-84c2-4160-8b41-39f634cecee8", "value": "ENQUIRY - 6782600551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60da794e-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239925, "uuid": "8cb8d885-d794-42f1-b563-63dff468e1d1", "comment": "Malware payload (Mirai)", "value": "1275106502c7e12fce4973a3cd01d022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239925, "uuid": "beea0963-dfd9-4fca-b62b-9b0a576dbf6d", "comment": "Malware payload (Mirai)", "value": "42444bfa4b05d26179c69d9e10ec80350c0a3cab34b2277ce573c9db2e6ac25e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239925, "uuid": "f2b825e9-57bf-4179-a2c8-757707df0237", "comment": "Malware payload (Mirai)", "value": "31871e16b8745cd4d33b8c1246a1bcd4c22e57a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239925, "uuid": "ba932dce-1774-4940-b08e-c42e02f558ad", "comment": "Malware payload (Mirai)", "value": "9b6319f7ffa63b94daa220e8e03e334033a7d150dc426c31bbab7e83cd67899825d3fc7c57458ce202f9f1b1e7b3a846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239925, "uuid": "3424bc89-092e-4587-bbf8-5481d7089f7b", "value": "T1B9A35A327D79581BC4C4A63A22E74771F6F6478620B88A2F7C210E9DBF5066032A77B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239925, "uuid": "f9cba87c-dde4-497c-8ac7-86dfd9eca0b7", "value": "1536:zbcwn1GalzjmL9Bnf2y/Q/vmGR30gzVnbVo+5540tpvSW:vzUalvcBJQHBRZ5bVoI4zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239925, "uuid": "71f5acb9-c752-4e9f-8ca7-407b1c2ff167", "value": 99800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239925, "uuid": "7652c2b0-08f3-4553-9de6-e6f217739ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239925, "uuid": "98cc12e9-48e6-4d9e-925e-c9cc79d147f6", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d988ad-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784212949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212949, "uuid": "41c53374-8687-458f-8d6d-34fd5d5e61fb", "comment": "Malware payload", "value": "fe0fda0a0d424550900ca274ca9164c0", "object_relation": "md5", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212949, "uuid": "e613e64f-fefc-4ea9-b631-46b7b0738af4", "comment": "Malware payload", "value": "425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095ca82ce", "object_relation": "sha256", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212949, "uuid": "260cc1a5-2258-4ae6-a8c2-0851682b36dc", "comment": "Malware payload", "value": "ea0bdcfb79b5c47988bf1fb7d39e5515a83e5d88", "object_relation": "sha1", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212949, "uuid": "bdd34b7e-2424-4bd0-9995-6ec474a03be6", "comment": "Malware payload", "value": "b0279827c8b63c112d2bbc48e00349b5e613af4220c0586b1eb9865111bf2adcb24b2e172c1b991f8f9996098d6d8021", "object_relation": "sha3-384", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212949, "uuid": "1512a949-67ee-4f69-b135-1e9e38ec8f5f", "value": "T16E83F989FA408A51CEC565FEFA5E529C371307ACD3EEB2029E115F3026D65570F3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212949, "uuid": "42f23a07-f844-4812-9a1d-30a4b3b03670", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+C05E:bGVAZyojaPTIsFsGO9Zr/REugmPkXC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212949, "uuid": "4c7b0001-23fb-4d90-8629-d74d51f0b0c4", "value": 86168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212949, "uuid": "8b7caf71-dae1-42bf-91a1-a605ec035e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212949, "uuid": "2d82e2a8-7af2-4a58-acec-93c9e3955680", "value": "1glx5bv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0cfaab-8113-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784205421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205421, "uuid": "62daaa36-0fac-4869-aa2d-55ae6f42587c", "comment": "Malware payload (Mirai)", "value": "111c3118a09ab69eebcea7bd334d60d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205421, "uuid": "959dcfed-5ccf-413e-ad41-e9527e4ed1db", "comment": "Malware payload (Mirai)", "value": "42d28652642c44401d9a8b6f8d4e8edefa0a227e3e189ba9bd5b10b6a1ee1196", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205421, "uuid": "7cb7fbb4-7370-47cc-9992-dcbad642d022", "comment": "Malware payload (Mirai)", "value": "8618fda2cfdedfa63132739d2609293c4d21b5d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205421, "uuid": "bc16ee6b-bccb-40b3-9dc5-67d65fb5971c", "comment": "Malware payload (Mirai)", "value": "0f214fe7fa94ab96099aac16909613b0c20edeb8999346dc9ae248d3b518b40f190077e91503daf5cb7ffaaf6c9fd3ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205421, "uuid": "7c36d6d4-1aca-418e-ad67-17c253e7be8a", "value": "T1ECB3E085B210AE55C02672FCB1870A9093B17E7B4B9A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205421, "uuid": "e7d65a06-68a7-4534-ba07-0e13453956b3", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wu8:as5zqhr5Nzy7wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205421, "uuid": "39f82ac9-f9ec-4f51-b5ea-ba05a727c6a5", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205421, "uuid": "66995459-c80a-4c37-a0fd-c280183a5c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205421, "uuid": "b40375f2-0ff9-49a3-aec8-08325341ce7e", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efb5ef5-80b4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784164652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164652, "uuid": "7378038d-59fe-4c97-a25e-fc2a3da08aba", "comment": "Malware payload (Mirai)", "value": "98f6119c8a099aa2cc3f99bfa3d16f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164652, "uuid": "55cde9c4-c947-48c8-bed9-b1284641813c", "comment": "Malware payload (Mirai)", "value": "42d85cf2179b3a10e2ac9dc572bac3fa540b3aea4aa87898740f7b0caeb1809b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164652, "uuid": "99e64919-0508-4ada-a41f-faa469d2612d", "comment": "Malware payload (Mirai)", "value": "bf8c90ecfc67c8b2dc6467b88fb0751ae9872337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164652, "uuid": "ffffe9c8-e82c-4967-bb26-07234d0f5417", "comment": "Malware payload (Mirai)", "value": "9977dd57b0ed40b9169b15aba22981a3fb0833a7b62ab6314f28b4a3b6639a8566d32c4389ee23562f691b30d2ec6a10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164652, "uuid": "22ac1eea-9cf5-4942-8b31-469950dbef3a", "value": "T18FC37CC2B10D7DADE5977E7CC20A27176A1C9A518C83510150F5FE072AB72E72E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164652, "uuid": "a5cbef51-a5c3-4b2e-8bee-cf0ec1550f54", "value": "3072:sLWznSQrERPmhb7ZXrSfhKDarKjWvAuQJNQLLjyol:PzcmhvZrGhKe5vAuwNQXvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784164652, "uuid": "29829888-7624-4a20-81c0-c14da0b217ef", "value": 125240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784164652, "uuid": "78ce383c-0da7-4b3c-91d4-d60c243b7c0e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164652, "uuid": "8fce4293-d4a9-43a5-8b2c-2cb8ebf5cb5d", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085e8176-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208423, "uuid": "52994b9c-e746-4567-adfd-87cf01e050cb", "comment": "Malware payload (VeilStealer)", "value": "2f10e086f9474cecfaf5b8a3e5988cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208423, "uuid": "90d0ea6b-f210-45e6-95fd-7b9728ab9fe0", "comment": "Malware payload (VeilStealer)", "value": "42dd676a77e7fdcf2da653c4150ed2b339ce062fb91e5ff7e7a1f2b1c5e32f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208423, "uuid": "58400dd0-e310-4ef9-a962-9e3b57a0ac3e", "comment": "Malware payload (VeilStealer)", "value": "d749a4be17123767b3c014e1ad70312f8f2bebdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208423, "uuid": "1b7f6a59-fc64-4209-b3ee-89e3f1e78608", "comment": "Malware payload (VeilStealer)", "value": "1f515473fd477b4f0712e17526b2f0bd9cb9460590db200b8cd56832adda749919b6e97405e4d2d2b3f97cb5fc730c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208423, "uuid": "8a932023-e6ef-4a69-b9e9-6faf78bd78d6", "value": "T190D63A87E96A45D8C0AEC135C63692537B713C9A4B3163D35B90FA242F37BE06EB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208423, "uuid": "b322326e-2709-4cbb-a833-edeed91fc349", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208423, "uuid": "ff3c989f-cf7f-4d86-9260-15a7c2fd83a3", "value": "98304:AnD9nvuKOPnNyxq48gIf0y8hOrSZsI3lGgGvjSfhAHE:iZmKOPNQq4elSf3l9ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208423, "uuid": "92c74049-fa6b-46af-ba8d-84e9260d8192", "value": 13826048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208423, "uuid": "3807ab30-9eb9-40ce-a83d-ccb11894512c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208423, "uuid": "6be21c56-c09e-4604-8fc5-402b18f582b1", "value": "42dd676a77e7fdcf2da653c4150ed2b339ce062fb91e5ff7e7a1f2b1c5e32f44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf75377-811c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784209503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209503, "uuid": "c696079a-6298-41ba-b7f0-91badc232c5b", "comment": "Malware payload", "value": "741d14a88f4d6f492a9ce2643810dbd7", "object_relation": "md5", "Tag": [ { "name": "15-235-40-46", "colour": "#561730", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209503, "uuid": "5dc4b574-ed5e-4e9c-aed3-4be57f162ba4", "comment": "Malware payload", "value": "449386b354a3ec20eb195cff373d42c037b706e67422b1d7f25018edfdb7255a", "object_relation": "sha256", "Tag": [ { "name": "15-235-40-46", "colour": "#561730", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209503, "uuid": "965d725d-3a23-424a-ad00-69967aed001e", "comment": "Malware payload", "value": "a7df72cb19168da199e41a5d982b2d328785860d", "object_relation": "sha1", "Tag": [ { "name": "15-235-40-46", "colour": "#561730", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209503, "uuid": "4ffacb25-e5cf-466f-b813-0ffce32f3aa0", "comment": "Malware payload", "value": "1b1fbc8a282186a616ccc48f7b5c7316b92add9e34ebd885dffd1fc94abf5a9e8a1f0f808796051661d9adba564294e1", "object_relation": "sha3-384", "Tag": [ { "name": "15-235-40-46", "colour": "#561730", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209503, "uuid": "3f6047f9-ceaf-4ce2-ae12-3997e8700bac", "value": "T13DC52A9C765075DFCC5BC972CAA81C64EB5074BB630BE207A42316ED9A0D99BCF184F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209503, "uuid": "a168ed53-2bdd-452c-bce4-12d5bb7df213", "value": "49152:i/keCMabiYm3NBqyxs5VR0fElzySrXx/Xmk:MkeCMabiYaTdAVR0fEY6x/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784209503, "uuid": "e8621a93-c7f0-4505-828b-ca942154dcfd", "value": 2632192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784209503, "uuid": "2b3cfd84-9456-4aa2-b866-1e6c726025c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209503, "uuid": "b829d722-5af0-48b2-ad1e-3a8e93f1e09b", "value": "449386b354a3ec20eb195cff373d42c037b706e67422b1d7f25018edfdb7255a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317ff97c-8133-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784219229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219229, "uuid": "175128fa-9a9a-47fc-b865-4dc017a7b7f0", "comment": "Malware payload", "value": "0a198ca0a610873c021dc3586fdb636b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219229, "uuid": "c7ce9314-7beb-4b93-a287-3244991fd104", "comment": "Malware payload", "value": "4573bdf440dca3958e138cca96bd9cc67ff8eeca632edea5193f5e6348cb7923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219229, "uuid": "274e8bcb-e650-470e-b01e-5dbf1e74c1fc", "comment": "Malware payload", "value": "8f6799c3777cc1ebf02d9b8e90d396cc474b567d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219229, "uuid": "e3985b58-6c0a-4277-b514-e01b1f7e2c9b", "comment": "Malware payload", "value": "a051da592a836df6c5c22561c7194aab491866d38de830927f7bbefc88d09712eef85713138b8c6611bdc37642e2adae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219229, "uuid": "00a71c6c-b91d-4273-8206-52806e2df7ff", "value": "T1D30749FB30D4859DC19EC13EC2538F55E93F71BA0736C2E7629452A41E16AC42E7EA2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219229, "uuid": "3714ecdc-15fc-437c-846c-150d32b4490f", "value": "df663ae202ee069eb0afc7b268b8bcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219229, "uuid": "5da7320a-2f8e-4103-8cc2-dda64ea1c74b", "value": "98304:FrWSLr6oM6DhnGyO4q/Ys2eEMeqNgEnITJIOvOLoNNvqJYktz8a5gkktwQbfBEEn:hLrlMK5OTYs9EMzXITpvqZtvgkEwQND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784219229, "uuid": "0a217413-5f4f-409e-89ee-816840adc605", "value": 17918976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784219229, "uuid": "0212e243-66a4-4b60-8293-daf91d18d50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219229, "uuid": "cdb6c7d6-f459-48d5-958f-8c17cf97b7d8", "value": "18.163.217.102_770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326d7995-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212789, "uuid": "68a95388-e5e0-4dee-b2a8-5dd28ac8b33e", "comment": "Malware payload (Mirai)", "value": "b75b1d9e70f84eb77cec0f7f8ccc9d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212789, "uuid": "6219074e-7517-46b8-b575-c35e92e98d42", "comment": "Malware payload (Mirai)", "value": "464305a052963d50b9ada0aa37692ceb2f26c1ddade4e11b7f81e8d4f5b3283c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212789, "uuid": "efa24fda-89b8-4cb5-ac83-802188006654", "comment": "Malware payload (Mirai)", "value": "030a3f247c8e1697228e38a4c788cb5693ea2ce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212789, "uuid": "cff7d10c-c852-438a-b164-77a710fdf430", "comment": "Malware payload (Mirai)", "value": "b46025b2ea10dbe20f6f92540003ca931134acb0f0ac3244f0ca97690f47a0b70f4b15741110e079fcd7d9e06a9bb77c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212789, "uuid": "1cdd61f7-1b39-4e75-b450-02fc027d1504", "value": "T12EE2F18A88D8AE0ECB6553BC556ABB80FA15A4A42F5F53016ED5CCC2A8033F5F131933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212789, "uuid": "4ed721db-4f0c-4770-afb8-f7e4847dfde1", "value": "768:WBbVkTrCrlw46JCSVO0smsL0AjDTK1xtltOX:KpFADsLjPK1x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212789, "uuid": "04c060f1-dd71-4af4-9ee9-437653cb9e2f", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212789, "uuid": "d1d9d864-364c-43a1-8b9b-d236f3e7766f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212789, "uuid": "90d626a5-bdbe-4ca5-94ad-614b4984a61d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36218283-80ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784160826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160826, "uuid": "e8097f72-cf49-4c26-914f-751075744f42", "comment": "Malware payload (Mirai)", "value": "2bddaa779ac692193fc8fcb0c1be47a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160826, "uuid": "60bc7de0-4991-4b74-a841-1736d055021b", "comment": "Malware payload (Mirai)", "value": "473f4b5e2d22a4fb4790813e18073f96c1a2f450d51259ab463b924e7f40244c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160826, "uuid": "24e7b81c-8b61-49f1-8a24-8c01ac031ed8", "comment": "Malware payload (Mirai)", "value": "a72e76214d3b4f0a457d39386d6428aae3f32e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160826, "uuid": "db1349c9-1b5f-45de-96b9-9bb2562f6f5d", "comment": "Malware payload (Mirai)", "value": "eec1cb6def438d44eaad67e95536300298c4430411d2c5b532f38566fe5096949634c0b9aaa5fb9fb7d95df3dee171c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160826, "uuid": "d7ad51e4-6c0b-48ae-8c68-2f013e182c00", "value": "T12AC329A9F880DE52C6D1267AF75E118C33231778D3DE7109CE249E3467EB95E0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160826, "uuid": "41bb5cf5-db76-44b1-ac4a-18b1cc997e09", "value": "3072:3KkAGfJqpUqVL45zcQrT25YcYEEU1aK2x2SPpkh+ip8RNaY7Adf1Dl:3K80qrGYcYEEU1aKM2eCh+/r0d95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160826, "uuid": "a95c72f1-504e-43ad-a8e3-8af31ef38df4", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160826, "uuid": "c20c1d30-1bed-45ab-b5b1-1a55c7b0f6c2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160826, "uuid": "cdd0f7ba-dc6b-49b7-b101-328867dc378e", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0dfbc93-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234583, "uuid": "ea3de40e-484e-42cf-a337-85d3bdd20d06", "comment": "Malware payload (Mirai)", "value": "bad2e7862a06203714b30eb403e08d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234583, "uuid": "14f82bff-a404-4c00-9653-1f9b9ae25ccd", "comment": "Malware payload (Mirai)", "value": "48be86fcef86046be0828fe3ad6df34b7ed1657fd75ccb25bdbce4d6f195b610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234583, "uuid": "bd191242-1a09-4d56-95f3-27cc98547edb", "comment": "Malware payload (Mirai)", "value": "d67e1d0d31b701a7115f6e34363e22e03eff00bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234583, "uuid": "a81ec4ed-3bce-4a3b-afb1-f207fafd4ff5", "comment": "Malware payload (Mirai)", "value": "26b021f050701d43147ce77d2459d1908a648c99eaf829be8d0be6f07d4d4c74419d8714e29e974e32244710bd4c4199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234583, "uuid": "76f562d2-cf1c-4354-8326-36544c54079a", "value": "T1F8230262E7AF5409E8992A3D5E7B242C25088A35C0DCD6F7EC843D37C948A7D2A7C761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234583, "uuid": "ab7bdcfd-0b71-4380-9325-2009d62e90b8", "value": "1536:OgWL9P3CRKhUskZ3Q4hQn3/CNY2UHdIzmRHbfW6wnouy8oyK:OgCPCRKZktQ4hA/CNY2+SCEoutM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234583, "uuid": "c829da1a-4637-4edb-9557-948d9a14808b", "value": 49832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234583, "uuid": "39ff6d03-d1a4-41b9-8498-80f1eb4bf823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234583, "uuid": "f23e50cf-342a-4f27-9a4e-afcf9f273896", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71767d2-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246082, "uuid": "03252322-105a-4d1e-8171-cc2290bbcc71", "comment": "Malware payload (Mirai)", "value": "448aa15a1791fffd5daa7f6804a00f2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246082, "uuid": "30180586-153a-49b9-9b74-cc665f7bf575", "comment": "Malware payload (Mirai)", "value": "48c87b2b9f07b95acc572da0221641011d454c3f587001e820dbec71990a72cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246082, "uuid": "85244171-c574-40e0-98e4-9fcf8b010e3b", "comment": "Malware payload (Mirai)", "value": "0e8521f5886ab0ebc34d88d25b0faa6e3dc987b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246082, "uuid": "cb7edb86-54cc-4f35-b236-1700783bec86", "comment": "Malware payload (Mirai)", "value": "9d41aa64aed6c20f0e15ef4e2d1b23f9512ad6793f0ae3c84f2c9aac382fe96f22842c9743d7ec3e21c5fd7e3f3d6173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246082, "uuid": "1f6ba5c3-19ac-4b6c-8398-c61c281d7f8c", "value": "T10EC339A9F890DE52C6D1267AF75E518C33231378C3DE7106CE249E3477EB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246082, "uuid": "d3bfa4ff-b2fc-43f4-a79f-d96e33e39995", "value": "3072:N2348J4ZU5Ng4EpPOoX9tUWcYEEUv57pMx2+jSOBFt7QUkZu+2f1Dl:N2oc6PuWcYEEUv57pK2GvBFzA5295", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246082, "uuid": "f082da0e-6d3d-4ccb-a7ce-3239ad5c9381", "value": 128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246082, "uuid": "dbc19622-849f-4a5c-98ac-36ab036cb1fe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246082, "uuid": "fdb38855-a27f-4738-9c0d-56037e1e0723", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13128b4f-8141-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225191, "uuid": "1dd95d38-cb2f-4b9f-bcce-dbc27b6af171", "comment": "Malware payload (Mirai)", "value": "dcd90c18503601e0053fe6368677cd1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225191, "uuid": "cdc2d56c-ae81-4914-8d98-777f2b833496", "comment": "Malware payload (Mirai)", "value": "4905171b3639ab690fbc84b3327d349b9961326fd87de001672581759d92b473", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225191, "uuid": "d178e8ef-a093-4d30-aac3-7605e068357e", "comment": "Malware payload (Mirai)", "value": "c815052b3c93ed8401e72ffb9a6af062c8d8c318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225191, "uuid": "6f0e2050-0767-410c-8a24-2852314eed9d", "comment": "Malware payload (Mirai)", "value": "6daf60bfeb2f695c704c38c3d10f9cf8fea1d868aba951b02cb757b7bf770517056e6e56527acd797b5e80aa6571bd64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225191, "uuid": "ed1dfdaf-3496-4f97-8622-8e576217e44c", "value": "T1A4042A496E756BFBD05FCE30152E830712DDA44FA2F6A73EA278CC4C399A24859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225191, "uuid": "095d393e-2733-4818-b342-f6ebbdbbdcaa", "value": "3072:dCj1g2ZPw6hkPXCObDkSGc5jSEj+VNfF8gCo7ftQi1DRP:dWa2Zo6hkPXPbQSGMjGVNfF8gCo7CYtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225191, "uuid": "9f73b7ce-bdac-498f-a3e8-4ebd919a1141", "value": 182552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225191, "uuid": "dcc6c5dc-c372-4a8f-b972-5a40a543a8d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225191, "uuid": "72f9f0b9-dda7-4940-aa01-c2d937bf419e", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3743eb04-8120-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784211079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211079, "uuid": "f7a33061-ce30-4ff8-87e2-dd257bbc4ae3", "comment": "Malware payload", "value": "b8661779c95d8224b233c6809501370c", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211079, "uuid": "9c55b21d-fb5d-4e21-8707-dd49676be20f", "comment": "Malware payload", "value": "4918677f8c77dbbe93d77225a871467ef6f5b0fff11e558460725370e228252b", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211079, "uuid": "cd341e3b-d2fe-4e1d-8cc7-4304db657197", "comment": "Malware payload", "value": "f6b106a1fbe9b859e0ac4428895ebd86f6e3f7d4", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211079, "uuid": "218ca6ce-2b5c-48d3-b811-1bd65b54a584", "comment": "Malware payload", "value": "825ccb2ee96b9c2a99ba646e5b4cba01ec2d894ce00a8030e94db3f2ba5cfdcf936c99070eb6efc6de2f10374c94d320", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211079, "uuid": "0b407678-d338-4327-b1d7-e0c972462b5c", "value": "T12A52CC2835EC1119E1F3EE716DA8A7C59E7BBAB3AD76154D484912090902F40EE62B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211079, "uuid": "5946d28c-1907-46cf-adcc-d24c5350fb52", "value": "48:l7Pa9mpr4Xan3y7KEu+njt9Kb4Zw7Pa9mpr5anxby7KEu+njtdQca38/E7o/uZli:l7EDyp+njnKcy7E4yxt+njXQX377B27f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784211079, "uuid": "5f28e929-685d-4fe5-bcff-b3f6d45ddf4d", "value": 13334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784211079, "uuid": "67349590-127d-4c71-9158-8ee654b2b0a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211079, "uuid": "7cf81778-2e31-4fc6-9ad7-9bfc76e5177e", "value": "NAKAZ_MO_perevirka_mayna.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188d1119-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185257, "uuid": "437e48f7-6715-4da6-b303-9884be7d681a", "comment": "Malware payload (Formbook)", "value": "c49548bbe22d448794255078927038ec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185257, "uuid": "1d7dd414-9ef8-4a78-a41f-aede1c4c1c9e", "comment": "Malware payload (Formbook)", "value": "49464c53d46170bc929cb3dac9fcb440453f68372fc74e4a687ced160ef00d65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185257, "uuid": "e0e3d5ce-cd06-40ca-8454-cc85084691ab", "comment": "Malware payload (Formbook)", "value": "6ef4298d2899d0fcc8d172538ecda9fe3ad844fd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185257, "uuid": "d85ae4dd-2fb7-4c24-b7af-46d41ef233c4", "comment": "Malware payload (Formbook)", "value": "ca3cf5b2dc01e86113eb1bd23cb86ead6d022bd5ee2471f7b4235ce4f3a394cd7442ee551d0ecc9b6f0288f61e2a3367", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185257, "uuid": "e8aaa2b2-9927-4bd6-9d2e-f1192ef689ad", "value": "T16B26F11057C46E7D86EE5F29E13F65AEF3E00DC910926CCAFB22BC44EBA63049A17574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185257, "uuid": "78462474-998f-4257-94fb-5d7259dd3d39", "value": "49152:oG4P/HDHSuniE4CUiR5n0SmhxrfOtUDHSuniE4CUiR5n0SmhxrfOtK:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185257, "uuid": "aa99c57a-347e-410b-8d94-f28a97be28f7", "value": 4562770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185257, "uuid": "f3754aa5-c082-46bb-a93c-4400a09244ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185257, "uuid": "654fbbe1-4162-44d0-aaba-24c83aa9a88a", "value": "SKM_224e26071509550.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d550de-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185439, "uuid": "03e95f85-4768-42b9-b594-6703b051f675", "comment": "Malware payload (Formbook)", "value": "b64ff88bd62d2f687a27b9ead72f3c9a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185439, "uuid": "2c6f4690-1fdd-4797-b4f3-a0b41d4f8194", "comment": "Malware payload (Formbook)", "value": "4996ce987597c10b0d729f35b32119e799aa9eab023fe75e157a07001a3dd31f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185439, "uuid": "e97f845e-fcd6-4e41-9140-a9221e85da9b", "comment": "Malware payload (Formbook)", "value": "76b952930f6d2ce11446131afd0cf3e22dbbc32f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185439, "uuid": "49c4628c-6e22-464e-9b7d-a72e25ec53bf", "comment": "Malware payload (Formbook)", "value": "82b6834df14dde87f41882b8752c50f484545a29eb7afcaaa13658d1ddf4794d499cff82e1e183a4e60d97b3c89e2472", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185439, "uuid": "05e0ea57-7901-4bc1-ad7d-91958a2933c0", "value": "T121343C20EE20067A4F575B9DFC6A0A61C9FDC719853680F4F6DA470D60069ECE3BE26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185439, "uuid": "e5fce14f-b5ab-40f7-b215-1360194f6209", "value": "6144:NWABZedwQxa18wrqibVE1qWjR07w9Y8TJVRG4qEt4Uh:MEAdI189iGqmR07w9Y8rHDtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185439, "uuid": "a96d641a-d864-4e56-a9d5-613421850f05", "value": 239812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185439, "uuid": "5a9a16e4-0ff4-4411-958c-4eec71d09e3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185439, "uuid": "1f0dc4fc-ce09-4114-b2b2-8082ee7dc8ff", "value": "Afspndin.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15735f4-80b6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784165730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784165730, "uuid": "00989c5b-8717-401e-8b78-064652ba907a", "comment": "Malware payload", "value": "595b149335f82abfc6f0d6c4c9803e69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784165730, "uuid": "d9e0b241-0a32-4421-bd3b-5b9dc96bd7ef", "comment": "Malware payload", "value": "4a6d1dfa22c10d10030b7d7063abdd31e528c1a152568febcff3f6a6a140fdff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784165730, "uuid": "0d51cadb-a61d-4eba-b658-754b7bde3487", "comment": "Malware payload", "value": "7de31a451844a9630666ea0dd35deda9e0c4a07b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784165730, "uuid": "3bd40699-632f-4378-99c2-295eb543b82b", "comment": "Malware payload", "value": "a4bfa3b9e0462555e989e4b8fee4d41d760169578654ebce75d7e1a8f3df7e1b5353b2e897ba2c76db2eb8c02fe470c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784165730, "uuid": "15b1e32b-a92e-4fde-8cef-1dc9e423d550", "value": "T18A235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EEBFCB3CF68C4A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784165730, "uuid": "57ee481e-fadf-4d4f-b798-ed5196528498", "value": "768:Z+09GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Z+5cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784165730, "uuid": "98855778-d306-45ed-97b3-b5f93f4b7f44", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784165730, "uuid": "48c62378-0b4b-434a-92d4-428c4bd8a563", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784165730, "uuid": "72ca91b4-f98b-4008-856e-f77064989df3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1731399-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185192, "uuid": "213a8bd1-c825-4790-877f-deaa3767263f", "comment": "Malware payload (Formbook)", "value": "7b37e0a51b32c1cdda55062415b09741", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185192, "uuid": "10de9568-358b-4d69-977e-a9ca73075365", "comment": "Malware payload (Formbook)", "value": "4acaee2094fa991342ea890af4a14d24a08e011dd9a97a33ba9b2bdf16df5a0f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185192, "uuid": "328af234-afbc-4d07-b693-9449e8e98922", "comment": "Malware payload (Formbook)", "value": "05db49716332440c4a6fb2ac711ba2a66db68790", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185192, "uuid": "5c9e2c29-ac96-4b02-89e7-d07bb9e5c78d", "comment": "Malware payload (Formbook)", "value": "bd3816ada03ee29a1e0d30b1c8b18e79407afd8bff9778dc86d0cbe5ae510f0d49a1a8b24b3670e913ef7965ff2b40ff", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185192, "uuid": "ee7851bc-a5d3-4506-96cd-17c535af35fe", "value": "T173A502605BC45FBE8AAC0A18E17F165EF3E00A85055778CAEF337D49EFAA70091275B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185192, "uuid": "65e1402d-f305-43f1-be01-b390f3dd6dc6", "value": "24576:roWyZDlxtf6aPEsPnKCZ29e3N09VO6XSNCQGEMSvN7E0bKT52RfFvKCsUUulAYBX:ry5TS61wwV3tfFkTU/HBv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185192, "uuid": "72179d2a-6f79-4f4b-a7a3-333bed9dcfd7", "value": 2167506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185192, "uuid": "5fb68edf-b7ae-46a5-b459-0e99776abef9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185192, "uuid": "4ee76bfe-17aa-47e5-914b-358d9a0e6b77", "value": "Purchase_Order - SEPT-013-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03db8a5b-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208415, "uuid": "70f2cfd7-b3d7-483c-ba5e-bdfe95c9b65c", "comment": "Malware payload (VeilStealer)", "value": "b8788234a4975fc5009bf927b3bf5a2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208415, "uuid": "2b884eb8-21cb-4f65-b381-580a9569aa8b", "comment": "Malware payload (VeilStealer)", "value": "4b660a310fc1125a079f8154a86edd0d43501edbbc4bc759dd55f1d4fd0c6d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208415, "uuid": "ee5fcca8-aee6-44a9-aeb6-0555b6aa5950", "comment": "Malware payload (VeilStealer)", "value": "e16a015a28b71c26bc32c92854733b041aee14a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208415, "uuid": "b1ba1b3d-19e1-4600-81cb-3910d8a903af", "comment": "Malware payload (VeilStealer)", "value": "5d56845ceaec0b3780c905b58784f9d76e724e181e6f89f52c8c37a45402132b746430e8dfed65ae6483456a6bc219ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208415, "uuid": "845d4be4-8bf2-482c-b706-98d0cb04586e", "value": "T112D63987E96555E8C1ADC136CA269563BB313C894B3033D31B50FA292F77BD0AEB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208415, "uuid": "19ad367b-9e91-4e7a-a9bd-29d59b76070a", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208415, "uuid": "5e9b70a6-eec9-43bf-9993-1a60872a2770", "value": "98304:thpJ5exQ0g8yjoNnQScU4mYFTCD42+G32GgGvjFdJqEWm:PdCQ0xykNnC1XzG329o3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208415, "uuid": "3981c1f9-3c50-417c-af46-e6683bbf2bb0", "value": 13824000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208415, "uuid": "faed4340-5686-4350-84e1-a5d26deace26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208415, "uuid": "6edf35a2-ecd2-4fbb-a8fc-97e98e21f2fc", "value": "4b660a310fc1125a079f8154a86edd0d43501edbbc4bc759dd55f1d4fd0c6d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d9e3aa-80d4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784178695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178695, "uuid": "779219b3-c1b8-4d26-995c-a714c4b3c577", "comment": "Malware payload (Mirai)", "value": "ae7e92b50849f11f738baa1f1c8ec4ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178695, "uuid": "9481d89f-d2e2-4c07-add5-7bbfda2adcaa", "comment": "Malware payload (Mirai)", "value": "4b895fa8b829b56983c5bf2187bf7db726e3ad613956b22212a87305a7b6e315", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178695, "uuid": "1382e1cb-6b44-4151-902e-6648c4d51fd5", "comment": "Malware payload (Mirai)", "value": "05c83cf0619c3e5bf978c790ebc0f5da60433202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178695, "uuid": "a1b79166-4b5e-4ed9-94ca-66f2bb7978c3", "comment": "Malware payload (Mirai)", "value": "64f3f6de973cbc6434a43b002f48389cecc307a1b8b87660a795c263172230171dd47d5dab4862a45955763859c149f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178695, "uuid": "4d49ea81-05c3-457c-bb0a-313143743d83", "value": "T143148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178695, "uuid": "1e953295-9a27-4a8a-9383-2d5439696545", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxI:bOVfbEdxm4iubu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178695, "uuid": "c250a855-2625-403d-8b32-f5413e7879d1", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178695, "uuid": "160c8c40-892b-4570-be36-17f20d6bb84b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178695, "uuid": "6c7acb36-59c6-4e4e-89d0-315d4a7f1b46", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c7413d-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185175, "uuid": "c0f35972-e139-44f1-bc31-e894934f7ec3", "comment": "Malware payload (Formbook)", "value": "41f68d6596ee4f5fb34557ecd2c9ae22", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185175, "uuid": "f4490848-7715-43fb-bae3-c86393c2eebb", "comment": "Malware payload (Formbook)", "value": "4b9f1dedd74b796c39c299b67369d5043739c3f1002d0b5df1e12db29369f7a2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185175, "uuid": "cf4088e9-473a-4859-9646-445d580b7d7a", "comment": "Malware payload (Formbook)", "value": "00fa72f4cfaf47916efc70304a4206e7cbd2056f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185175, "uuid": "a26f73c8-0de5-45e2-8171-9da9a2250a82", "comment": "Malware payload (Formbook)", "value": "a7dcab392e0c65bb4383607efd70b9497cdb0f59f721afcf91aa71177e37aaad0059261b7146acb838cf5dc946d77dbb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185175, "uuid": "ee746e1b-49cc-4fbe-a2f4-4649814854af", "value": "T18F469F516E5859F5EF8C2A0E90AE6F1D87F042176A3370ABFB41DF04BDDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185175, "uuid": "308cbe14-d169-489f-b598-7e1077fec976", "value": "24576:6BDM3ojNKZWZDztp3lZDc2E9zaeRAup8lftxzQ9LYqBfwVrTPimmsW/L6iI2y5jW:SMKiK+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185175, "uuid": "8217f41e-5726-42ef-a05a-ba776400214b", "value": 5487545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185175, "uuid": "24c95e2d-27d6-4040-b114-fee105e6641a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185175, "uuid": "c01d58b7-be6e-49f1-9afb-09d14d25b6fe", "value": "RFQ-RFQ#6000222713ADM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0bf3c2-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239915, "uuid": "ebccc05d-c964-4702-996d-8fd28716f99e", "comment": "Malware payload (Mirai)", "value": "0aa7146fd5064984013416deaa7a3dea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239915, "uuid": "c35f252d-676d-4335-b861-7403f5c0b472", "comment": "Malware payload (Mirai)", "value": "4bd17c2bf9c2cf17a4728f0a7753761be3c788910041390b0e374e06c581a8c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239915, "uuid": "90287e2d-ccb9-4ac7-934e-75db4c4912d7", "comment": "Malware payload (Mirai)", "value": "932b62f07a4114e39700a7e8eae6b38c171aa33b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239915, "uuid": "4d1e5d70-244a-468f-9b47-a464a75d8618", "comment": "Malware payload (Mirai)", "value": "78f73d897e92e884f4c140d93e9189edbe656ca26eda4e04f2fe06db6e6ee59a9180f2f2607e475589ea1d7b07d5204e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239915, "uuid": "eda1bf30-5ab2-46db-bdb0-292a4811c722", "value": "T113B33B07B992CA12D5D322B9BA6F904C33132BB9D3DA7203CC249FA477C79D70A7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239915, "uuid": "d9492605-d2ce-47b9-9763-1fd76e8e2ffb", "value": "3072:U0RSx7iDpDtGi7Chq1ai/IKOVZkLaqRIH:ULeDBtGFq1a7KOGRIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239915, "uuid": "47a5bf46-0c10-4645-b088-40a8268feb5d", "value": 111500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239915, "uuid": "a2099497-5953-4754-b8e7-738f58a9e0a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239915, "uuid": "dc1098a4-1236-42b2-a497-69163aefa841", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d472995-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184997, "uuid": "cd173e11-42cd-426c-94c8-659cf4a676df", "comment": "Malware payload", "value": "fdaf99a23f971f0045288f889d79a4d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184997, "uuid": "d5a6b615-9f23-47c3-821a-61cd6334dff4", "comment": "Malware payload", "value": "4cdc0fdced74262a543237e1cfd5c9c001209ce295213a1d84fb486511062401", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184997, "uuid": "ea32db2b-6238-4839-b568-a143ab2a1da3", "comment": "Malware payload", "value": "a572c8c2886f9b1a77cb1b94a0dc252820544f0c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184997, "uuid": "dd8c3a7f-7f29-420e-83f4-6cac2ecfcd30", "comment": "Malware payload", "value": "08e4269c1c62dc4af6501a5dcfa6bb948e62e06c84a98f51e9a8e2d3ffdf80118f1767eda75d281b148e64ed5b0e6ee4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184997, "uuid": "9402d8c6-76d8-4282-8eb7-830fa983750d", "value": "T1B3236C651A857C149A99C4371D7E2F0CBDAD43E6320852DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184997, "uuid": "7d9ae279-aba1-45e0-8f7a-83b784d0f1f9", "value": "768:SVEJVIhtM+Mt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:oEJ2M+Mucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184997, "uuid": "00128395-0d8b-4bfe-b764-cfc386a133ea", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184997, "uuid": "4a309da7-9318-4f02-8063-9117bc1983c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184997, "uuid": "dc002b4e-28bf-41eb-9023-041fa9ed917b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5cc03c-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234632, "uuid": "c011bc30-10aa-4fd9-a0fa-a373601e699b", "comment": "Malware payload (Mirai)", "value": "c3abe0d917bd9f1ecc3729f0aa6d6913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234632, "uuid": "4921f46a-0cf5-4edf-ac3c-f29add634033", "comment": "Malware payload (Mirai)", "value": "4dbd794da83ec39e87a52c05eeb96445a727c3532b668f78786934e95f7e3faa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234632, "uuid": "385d0785-003b-4c5b-ac27-fb8437a26827", "comment": "Malware payload (Mirai)", "value": "0efb828f5b7ab5dc4301288b990dbfb9bb8f52a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234632, "uuid": "d4512159-6cf6-4170-a4be-495999ac3be0", "comment": "Malware payload (Mirai)", "value": "7faea3b3a6bff5ff955fa1de802371efe5632719e827f6e9a34a477048ef66def6120be2af77b53915962fb5fee7172e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234632, "uuid": "5fe08f22-2800-4d07-8172-61390e0acbcf", "value": "T122C34B0273180B47C5A319B02E3F3BE687FFE5E021E4BB89251A8B5A4575EB75449FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234632, "uuid": "37518470-1bff-4c4e-b57e-56a20fb78fc9", "value": "1536:WqL5Jj5lED60/rhmv8+f2e0NZIJC7aFV+1mWdHKyELsHV4:WqL5JjQ2w9qmM3FYmLGHV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234632, "uuid": "87d108c9-0d43-45ec-b685-023b96bdc6d6", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234632, "uuid": "4bb609af-c4b5-4324-898c-206ee6646740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234632, "uuid": "630b428d-81a5-453f-9005-ab66cac6a91c", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b47704-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784184961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184961, "uuid": "4ec54737-150f-4a12-a9bb-f032d3b4c929", "comment": "Malware payload (RemcosRAT)", "value": "7c835f2b689ecb71300a3df30e346355", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184961, "uuid": "3ec57db0-edcf-43c2-8730-ee8004dc5bdf", "comment": "Malware payload (RemcosRAT)", "value": "4ddd9b6a12a30440fc92d0d4e20a082421c4aded564d356e732af1087d708b1a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184961, "uuid": "667ffa92-eb56-4b6a-9ef7-ea6b36baf446", "comment": "Malware payload (RemcosRAT)", "value": "cd5919329c03959f9eb1132afea4bf907938aee7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184961, "uuid": "669e6a87-af42-47d9-81b7-2b2f00e7db43", "comment": "Malware payload (RemcosRAT)", "value": "56f692d77809ac6be8a41ec449f39e191d81da906c2fd56f40122b5e17e7e762b713bdce610f13b4343fd11c4ccc9825", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184961, "uuid": "40080e71-8846-45b6-8c21-6a51eb60c329", "value": "T168A513F81BDE720011EE5BB7EF5C8D15BCB4E06D9CA35A9EAD324AC94244E5103D3D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184961, "uuid": "580abb93-5fd9-4c59-aae4-0aedcd3120a2", "value": "192:EanUanUanUanUanUanUanUanUanUanUanUanUanUanUanUanUanUanUanUanUan+:4uQ1USDDXRUDSHW2Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184961, "uuid": "07e211e0-425b-4769-bbf4-d3a4568139a8", "value": 2241777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184961, "uuid": "e8b0d1d8-fc7d-43c4-8a50-ce68048a83ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184961, "uuid": "71740ef7-df85-49d1-ae48-734a016dd526", "value": "weneedbestthingsforeverywheretounderstand.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b151d1ec-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185943, "uuid": "931c4165-ed64-43c1-ab26-acde2ad1250f", "comment": "Malware payload (Formbook)", "value": "966851f93d90b245923d8291deee79d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185943, "uuid": "51088f4f-de9b-4bd0-a937-080d9bd27b9a", "comment": "Malware payload (Formbook)", "value": "4e322f047b202f3ff1a36fab7285fb09114c926db9b7aee21e4ee976b934437e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185943, "uuid": "5c3f708a-8beb-4f0d-a6e0-e0297998c223", "comment": "Malware payload (Formbook)", "value": "2960a253f3a0ef7a7b97c46a2c7ec0ea3c0b2283", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185943, "uuid": "66a39307-86aa-440a-9d89-5eb9d98bfa0c", "comment": "Malware payload (Formbook)", "value": "21b4c54936ef286ff25650e0509af5d291ee565458084fdd4592c1860757ce95143f9f04537ff0cc3557ba4fb8e62c3b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185943, "uuid": "d91ff462-e317-43e0-8215-9484c26b5b3b", "value": "T1834533854AE64D8FCDB8773B40AF0A1909A2AD65000E799037BA6C5F3FDCBC55B03D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185943, "uuid": "b2ec311a-01eb-4133-9a4e-208a8c29b99d", "value": "24576:SUmm+C00bTwCdOaxwe65A4r3SvN1SyNIs6AHNNkjly:SU8KkaxwM06jNIsHH/kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185943, "uuid": "f5f5a0ac-0b9f-4720-afb1-c090e40dcbb5", "value": 1277117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185943, "uuid": "fe6cad25-9b72-49d9-9f05-900f2fc6e7ee", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185943, "uuid": "044915c9-7c77-405c-9e45-2e1776860e7a", "value": "New Order Inquiry.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0a724c-814e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784230956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230956, "uuid": "7e4c203f-a557-4c08-8370-c97afadd8ce0", "comment": "Malware payload (Mirai)", "value": "5030cfc952637e631ff976ccbc4380ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230956, "uuid": "7704c334-edd1-4577-acad-f13e663a6574", "comment": "Malware payload (Mirai)", "value": "4e44aee1aa88032105eee44845fd34f31e9a7be7a86ef787dbec87155da19a46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230956, "uuid": "cfced784-9983-4e4a-b9a7-2e55bc7ee006", "comment": "Malware payload (Mirai)", "value": "9e6c4dc8eba2262969036934dc89a98db95f01ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230956, "uuid": "1930296a-15ed-48cd-a2cc-de2adf0c7a90", "comment": "Malware payload (Mirai)", "value": "728ffd3c9185d4156fa8694618dbff610e39ee275b03c4c278de80afd2f01d65916f2a6322d23f870300d8cd100b9cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230956, "uuid": "b3346acc-4274-41fe-b93d-2b38e62445db", "value": "T1CC330165FD6EF644ED78383A9B1BC006336D5E6A81FDB3AE21F041948BC50C521BD5E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230956, "uuid": "fb790fa0-6ca6-4dd0-aff5-0118b95a3d84", "value": "1536:J6iCo2cK8cMrZ2D38pD33to19LNpG8CPGfh:6KwW2D23C19qG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784230956, "uuid": "4715a366-8d76-4677-8049-663e4c672cd8", "value": 54484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784230956, "uuid": "7954cf7d-5888-4b60-b178-8be613d94065", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230956, "uuid": "3bc473e2-ddbc-4465-b4ca-bd7e10607915", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f87d20-80e8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784187286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187286, "uuid": "0c949e5e-c74c-4f1b-8fd4-147256493e05", "comment": "Malware payload", "value": "7e034642aa06dd01f80476fd027eb51e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187286, "uuid": "5ebc66d6-2dfb-4897-9177-54d5123c73af", "comment": "Malware payload", "value": "4e81d94aa44752c3077a3f5039159f47797a3ffaa1def4d6147b657b79e0534c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187286, "uuid": "a1c85f37-ea87-4af0-845a-cda9ca8a7135", "comment": "Malware payload", "value": "927315442d3cce6f101cd97df851df20ff619955", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187286, "uuid": "63ead3b1-f508-48e0-b009-68b7ae7d058e", "comment": "Malware payload", "value": "4170fe6fa5ad060291871f7978c6c0f509602cad3775da2e0f412634a5ebc067d6c43fb369883ad1625039e775836b34", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187286, "uuid": "f988eca3-1928-41da-b95f-3770a5d10548", "value": "T1D911C2601BCB5A00F3F58B30BC3A921519647C2C89318B8D0385196C0C26A109826F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187286, "uuid": "394e21c3-aa52-4693-a225-260ea47ece54", "value": "6:4xtiy6LgolHKlFcnlj+SEEgykQLPfBMlpIoF6SaU/k1ARokJxt:8oyj4QkCikQLhMbHFMf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187286, "uuid": "6060908e-d615-47c5-8591-8f60f5845a99", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187286, "uuid": "ae2573bc-4428-49fe-8c57-beead81311b3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187286, "uuid": "7e2a8e54-cb00-4ddd-829a-fee3ab22b1de", "value": "4e81d94aa44752c3077a3f5039159f47797a3ffaa1def4d6147b657b79e0534c(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d3820d-80cf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176475, "uuid": "f91bc2f4-c1e7-45c8-985c-5f9700fa6793", "comment": "Malware payload (Mirai)", "value": "8a2f082d282b1b8c52227e591848b27f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176475, "uuid": "1eb14910-62f0-43d8-8082-f746b951d8df", "comment": "Malware payload (Mirai)", "value": "4f299843a954a5604d745911f34c28f57d13703425ed566ab0737a055d89d038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176475, "uuid": "0bd1125c-26c4-4162-aac4-d676c9d0e9df", "comment": "Malware payload (Mirai)", "value": "5003015fccbf3c7a6701c5c0ee6844d0932ff24c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176475, "uuid": "a173d446-7786-4800-9d07-b263a759b8aa", "comment": "Malware payload (Mirai)", "value": "2d2b50c5850510f37e97b0a3c41be003b167ce021a506b52fa6022d6b9dd7006966975c9d0a7a52d2960db174a055cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176475, "uuid": "9502efa6-cc85-42b0-b094-58d05167eca8", "value": "T10874E9117B47EC6FFC6E03740AF7CA7467E8B5B22561859AE26ABF4D0F250D14E089C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176475, "uuid": "7eb2d0d2-eac3-4928-9b98-f4ce3768a37e", "value": "3072:odgfO4aIPmHO/jBRJPu3U5VhDP8ntbhfZfTZ39rxvf+wad74P3pcaqVQCo2RxVpx:SBdHO/jBRJH5/D0F+9qCzVpjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176475, "uuid": "c6388c88-e086-4e23-a09d-3d36d94b332c", "value": 344424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176475, "uuid": "7b66b2c3-9326-4c21-8ca6-73f6116dd24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176475, "uuid": "10d2bb86-e92e-4783-bb21-ac586642f9ad", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e99135-8113-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784205704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205704, "uuid": "88bc4c29-c980-4b9a-a5f0-2812baac574f", "comment": "Malware payload (Mirai)", "value": "116e292c0341b345ef987bfaa4ab8e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205704, "uuid": "02163525-ce38-4cbc-acd4-07be1a3db023", "comment": "Malware payload (Mirai)", "value": "4f8465a6cc3261e3175a7cb9520c0969bdcdc039cc848a36fa6ebb5b1e4b079b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205704, "uuid": "7a87b18d-2ea4-4840-9675-13974f94e2d9", "comment": "Malware payload (Mirai)", "value": "f22162466cf26181a15a9e78f4c57e0c0029c241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205704, "uuid": "4885e7e4-b2c1-412e-912a-32c98c2ae61a", "comment": "Malware payload (Mirai)", "value": "8b47a0a5da8eac365f480eb28bc4b3050f2ecaf7f8a6504c3d43fd2b290e19c2c14db2857e4e937ca200d8887d51249f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205704, "uuid": "d4dbb368-5570-43ac-bd52-4dce6473cb89", "value": "T12CD35C0A78D274FCC687D170926E9F61E63A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205704, "uuid": "21814fad-60ee-4da8-9538-3b54986cd883", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQq:yIRfe3xvvSrlvZZ7Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205704, "uuid": "eba42344-d3e8-48ee-a6ca-819ee30d8931", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205704, "uuid": "e66e5810-3e7c-4dc7-8cd5-529b4ac2431e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205704, "uuid": "b2d870ab-cf69-4586-b9f8-dae356a41f58", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6f6bc1-80ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784161459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161459, "uuid": "da280006-26f3-4a28-a284-439ad347586e", "comment": "Malware payload (Mirai)", "value": "3e42645af1ddbd3dec6f2a2823249d8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161459, "uuid": "7585d74a-6243-45d6-a2f1-22b3e290be04", "comment": "Malware payload (Mirai)", "value": "5060058f19b2271985ffc751dfe35b9b107f051a368de01358e6be85335ab1ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161459, "uuid": "81562160-6422-4d5f-84d7-c7a9de164797", "comment": "Malware payload (Mirai)", "value": "eeb13183798f502356436685d7335b829693c103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161459, "uuid": "294d14bc-c362-4f64-8eb6-9360fadaa865", "comment": "Malware payload (Mirai)", "value": "9c4716d192a4d03ef70a355fe46abc7eb14a1082d565f77d46f4bdf389b35058f395c28d3d315525a88e055fe5558df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161459, "uuid": "0ddeb451-68dc-425c-8430-cb3094545838", "value": "T1693301707005B17ED580C134FCBD8642FB5329A5D1B43A6F0AA1D7A9AD42AE773FB280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161459, "uuid": "299fbf75-6806-4cd9-8536-3343970b0b8b", "value": "1536:bvVXlTrlg4AnNzW0EKU+m2eAKhMCa6m0uNfx:7PZEnFZEKSMKZa6YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784161459, "uuid": "64dbdd3a-7c26-4b72-bf12-186f3b4bcc3e", "value": 53416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784161459, "uuid": "14a092e5-bda9-4c64-bd04-dc4fed65386d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161459, "uuid": "d2b11f2a-c878-4740-a477-7ffb92fb8ea7", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d24a77-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184907, "uuid": "7ca1c95c-98f0-41f8-866a-1318ef983077", "comment": "Malware payload", "value": "df41d5941623fd6d19662e749a4aa478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184907, "uuid": "2d876bc8-173c-43e6-b643-aecb874c2420", "comment": "Malware payload", "value": "509bc1b45c0601df6dc7efd49bed0674cbc7381f5218bb665ebbd9ea03bba319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184907, "uuid": "c1353f4b-7da8-48dd-a5f8-0f32f53ac815", "comment": "Malware payload", "value": "95b1e8da6f02c86fccf3e6a1a89ae60ca6283836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184907, "uuid": "53a14152-075d-44f0-bb6c-7e0cb6dd70aa", "comment": "Malware payload", "value": "9110f03c1d5ac5fdfcc097a3b9623d8c9fba1cb06e3765d89d40dfbaf4ad231110c501052fe3f3dbe0050d9b02542b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184907, "uuid": "dc6fc618-4384-401b-a67b-b1f1ca035a93", "value": "T1FFC4F66B6CB950F8C4FEE1358A27B616BE623419033427D72FE04A600F96FF165B8B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184907, "uuid": "0b9523a6-c6c7-4e02-a6e3-bc8624f6b645", "value": "12288:BrKJjDjIn1U4REYPVsvplNHcFV5gpH0+YcyN:BrKhIn1U4RnPSHNigpH0nXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184907, "uuid": "3d24c76e-e8ac-4231-a3b9-667ed9fc6c52", "value": 575926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184907, "uuid": "0d23937a-78ac-49fc-bc0e-0200b400b2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184907, "uuid": "489412a8-4ce6-4ece-b618-9a4cabf73d6e", "value": "tXmCLyGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be6b624-80b3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784164325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164325, "uuid": "de1dc85b-a961-401f-913d-107d7bb6dbee", "comment": "Malware payload", "value": "0d7a7df9b22e0b0c05aafca137d0a4ce", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164325, "uuid": "8baed37d-1d6a-4726-8d40-6cc19a7d05cd", "comment": "Malware payload", "value": "512adcaea143fa04941516599aed5e2cdd97d374673bc645d585e3ea63183b8e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164325, "uuid": "a1a8c2c7-ff7b-42f9-a965-d5a9e8227f16", "comment": "Malware payload", "value": "21c0629df4e7298b5ef39cc2f0ef6ff90963dc64", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164325, "uuid": "be46def7-fed7-4584-bea3-6e52e919c2bd", "comment": "Malware payload", "value": "9ac0646f6c43e36da8254d66b8d86713305077641bc02c89958ccc38e663144294acf2a2832e7fecec9e954a58b8deac", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164325, "uuid": "fa7505d5-4937-4fc4-8091-2d0beb768c86", "value": "T16E762807FCA918E5C0ADD1318A7696127F71BC490B2123E71BA0F6287F76BD0ADB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164325, "uuid": "fc466704-ef9b-461c-8609-a8fc8cdf8b69", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164325, "uuid": "93e0e772-4f06-43e2-a658-b5dfe89a288d", "value": "49152:bnqCtdYBOHDfMNlVi0dPwhxrPC150JOyCm9IblP92ajVLhvEa6i8jcE9ky8IwyEJ:bnqy8kz04e6tggr1J9j4+vE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784164325, "uuid": "80f67394-b371-437b-bea9-13d333442e48", "value": 7603200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784164325, "uuid": "478325b3-0185-4d82-912e-72255618743e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164325, "uuid": "27a4414f-5566-44f1-b221-59b9a16abcde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0051ae0-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185189, "uuid": "9bb5adec-c446-405a-92f1-cf1e19ba1376", "comment": "Malware payload (Formbook)", "value": "37cd3b88d603cf06ac5d3f0bb60bc2aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185189, "uuid": "cfe7342e-81f6-4b89-b5a9-3339a902a574", "comment": "Malware payload (Formbook)", "value": "51379f4acb028f106dff9e97d2fffe91ef2ed5eb377dfdafbe87b14d4f64044e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185189, "uuid": "a32463af-72dc-4184-8a7b-d2be22bec51d", "comment": "Malware payload (Formbook)", "value": "85a9f1bcbfdc1a05c49550b447675044c5bbfc0e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185189, "uuid": "787f17a0-9aeb-4997-a64f-983af7168448", "comment": "Malware payload (Formbook)", "value": "4e5810777259721ab3c0e9061b334e96b1a361407fa3f2662f108e4ad751bc8a8eb695743963660cf885fda8c95baaca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185189, "uuid": "26ebdc21-12c4-4ae5-a9cc-aa5423a4af4b", "value": "T1E9459E6A0B6C401ADEC9A12B264D65C3F8B1AF01F170B450E7B849B5F6CDF8930796E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185189, "uuid": "054c9908-c186-4603-bbfc-a5d79a24b0f8", "value": "24576:+IOjh6Kz6O3FIMi6IPqbUTX1W/tjwvClgRBn9CF9C7DhBy60K1:+x9xi3qog/oC+tCWm6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185189, "uuid": "d9e170c9-3c24-4a14-936e-b5b2603c18df", "value": 1228947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185189, "uuid": "183ca591-292d-4be6-a8da-a6b900fa45d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185189, "uuid": "f3eedf7e-6ad6-4a75-b7d1-c41af596325a", "value": "mohafile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bcda43-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234987, "uuid": "c4d9dc04-124b-4f5a-bd8b-3c037fe88a1f", "comment": "Malware payload (Mirai)", "value": "361c4539aa73be44260d0c8f9f711b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234987, "uuid": "d6ee3810-e913-4677-a780-ddda3a3c2c8f", "comment": "Malware payload (Mirai)", "value": "51ebfb1a149332bf947b3f0e1063f18e59de8ff3e5b75cf2ae101969dc56e5f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234987, "uuid": "04ce107e-5431-4dfc-b056-c8300a598ab9", "comment": "Malware payload (Mirai)", "value": "9916eacb60c9056eb7839c72ae72920a85c6f06b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234987, "uuid": "052a578b-9c60-41fd-9378-89a6836fc698", "comment": "Malware payload (Mirai)", "value": "db8a06e5c59e71d69dceca28f55bb2dd487cc8b20da0a91624fd59ce2d4a0b086570d8e8973b3cf308de88b5d9d30c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234987, "uuid": "9a604fa4-e3b3-4ed2-867e-9f2a5b78d5e0", "value": "T1CF330281E28EB1D9D16A5835886D0349C9061774A607B7632324B3DD12C7ACF6FB6E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234987, "uuid": "b9aa43d5-fa68-43f9-ade3-c5808b801e56", "value": "768:Ylf+sSSx818AMmihjY2NwNr2NswbcHxDmUmvwOSzGnCvwtkBR6b7qNLD/8nOgrXK:YlS+818NDBS/xSUewOL7ia/SfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234987, "uuid": "b19f114c-af90-4421-9568-3e8b4f234446", "value": 54604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234987, "uuid": "8c6f391c-412c-47b8-a460-72866a6f198c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234987, "uuid": "774c8d70-95ac-4beb-bc47-44a2984ce4d3", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a590a998-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1784179481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179481, "uuid": "d06c66be-647b-4cd5-ab2a-fbbe64e638da", "comment": "Malware payload (Stealc)", "value": "fa0c43c86d978311778e418ed5d9cb83", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179481, "uuid": "24085750-d00e-4d41-926f-64668d9475b0", "comment": "Malware payload (Stealc)", "value": "526abca3f813871d7e2930c99bbe9c1d6a660cb7e6624e65e54154e4e3cf897d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179481, "uuid": "cf021ff5-ef11-438a-84eb-26885c78b270", "comment": "Malware payload (Stealc)", "value": "c349761b7c3ed4439bec4502449eb51387714260", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179481, "uuid": "dcce7677-df97-44c2-8269-60f7682fa68b", "comment": "Malware payload (Stealc)", "value": "0d0d2c3dfb962dc9b6ab1558b7985d3e8dfd0f98e9f3c57bc6679577ddd84c17bf6b569a9ffb98547891d2747504390e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179481, "uuid": "f373cbb5-2a0e-408b-a135-870b4a80497e", "value": "T17CD4C013B9619076E1724635CD78AB50977DBC700F20ABCB67C005AA6EB16C0AF3776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179481, "uuid": "08a7ecaf-07a7-4b47-84c9-7d7a5e7d34c3", "value": "cd702dbfbd74cf5a80f59195b2460134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179481, "uuid": "60555a54-551b-4036-b748-caa59bf53376", "value": "12288:2UoVNdZJ9HO5ov7LJb7B4abhBZuyxBlDetAqxSvwiA:2UIvcojLJqa1BZuyb4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179481, "uuid": "36bed6e0-1ec1-497d-ac11-7463f8cc6084", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179481, "uuid": "ffb10e88-8f42-4df8-9128-3c1f81b4436b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179481, "uuid": "eff4052f-8181-4cb7-ba9d-8593be337593", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754a8a3d-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784227933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227933, "uuid": "2361d59b-db6e-4293-ba14-07da841f06d6", "comment": "Malware payload", "value": "9884f1c5d1a742cad2f47f4002602794", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227933, "uuid": "4b31740f-39a9-4a08-b6b6-40459d534584", "comment": "Malware payload", "value": "527b8a9118bd448b9cd88d7ea80acd1947d026d6f43d84b8f895bac1cad7c05b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227933, "uuid": "908d3598-b80a-46fd-bccd-05e2021a475c", "comment": "Malware payload", "value": "1f34d4baaac5554f35036194b660c83d8bfe400f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227933, "uuid": "ec9c38d3-5014-4e26-8222-d222fc3102f9", "comment": "Malware payload", "value": "9776418ad2ef2f1cc0e2102be7522616b9600cc5bfaa15095db5a5b60039518f68cb3e8cfa69a47c33f08c514fc00af3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227933, "uuid": "54b7ebee-59aa-4df6-a203-174961e65685", "value": "T113E6330E5AF812DEEA63017CEDD19A55C0B2B4700B71C5CB4BA887729F9B2C0693D767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227933, "uuid": "8637d6ef-4b5e-43ab-b3f4-2b93ccd17c39", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227933, "uuid": "132770e4-1718-4610-83fe-d9d10b9520fa", "value": "393216:md8d4HR2QqzJmpNHIXMCHWUjX+cuI3/PGTAI:muawQtIXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227933, "uuid": "c0b275b4-f511-4597-b72b-7609ff0e0e71", "value": 14279684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227933, "uuid": "635416ef-5cb3-41e4-9c62-c448fe1d3765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227933, "uuid": "6e9e3206-aa7b-44ca-9554-fc6742290924", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf54287-80b8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784166717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784166717, "uuid": "0dde4f1d-16b8-4f89-89e4-e7475f604100", "comment": "Malware payload (Efimer)", "value": "00d3c17953afb258440c9eb9e15e30b6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784166717, "uuid": "2769261c-f4fe-4165-a7da-4a2b3f7c5bc5", "comment": "Malware payload (Efimer)", "value": "52a1f9aebd6d8f42ed0fa9a36c8c0cea56dccaa7ab941a62c7d70be02479f6d9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784166717, "uuid": "cfa10918-6ddc-46a6-84e0-2808f1e9078d", "comment": "Malware payload (Efimer)", "value": "23902109c0301caec968660ea08cd5cd165354e2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784166717, "uuid": "1717a067-ef02-4f30-8f02-94e090f35920", "comment": "Malware payload (Efimer)", "value": "fc869b0a0b8d53e6d3bc24b1f449cf054b1a3dc6b958f752c1ad0878b1ac800700b9cd68709bdf78c8ef1b7fea83feb4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784166717, "uuid": "190feeee-0ff0-47a5-a499-6c0d55f37665", "value": "T11CE6335C6EC402EFD9B3003CEEF26699E926B4724731CE9F17AC92622E530D48D3565B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784166717, "uuid": "213de0b5-4a37-4250-ac83-65772fb26f76", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784166717, "uuid": "62e3cb85-7515-4233-9d55-f87ff2c8d00c", "value": "393216:Ghd01M3OWld0GIAh6OK9XMCHWUjX6cuI3/PGTAI:G7RdtsO0XMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784166717, "uuid": "1e4270c9-ff0c-49cb-b716-e28affbcbd40", "value": 14289497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784166717, "uuid": "687abde7-cae7-45c8-b7f5-67fa74184e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784166717, "uuid": "446d7784-c273-41f2-a964-5440167b4806", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0349e950-80cc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784174914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174914, "uuid": "cb140dbf-79dd-4a00-89c6-988a821c9705", "comment": "Malware payload", "value": "483412781e359bd72c973f2508c5e4d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174914, "uuid": "85edceac-7894-427a-a29a-d899b848df6d", "comment": "Malware payload", "value": "5351c7b45ab310a4715ff18a5b135c0a62a044164fa427cc51582614234e7c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174914, "uuid": "285e9f84-99ee-42f4-ace0-5f3e5d01e31e", "comment": "Malware payload", "value": "958992e1f2e4374cc35ada1fd1205547ba50a2bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174914, "uuid": "479dd933-6ee9-4105-a60a-461a9fe48174", "comment": "Malware payload", "value": "f17665053af75181247a8c6bd7ea158b51c399a96c73025894ad5a4617d7ff768f39fe8d2a0ed6589cb39cfd5b86a87f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174914, "uuid": "68d470b8-ab78-4072-b587-da91817c6f5a", "value": "T19B32AFEF7E09E515E98266FE1657C875A5E9E9040F159128B4E0D0F10E29D873D0AC2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174914, "uuid": "09152166-2dfd-4f7d-937e-a0509382691a", "value": "192:eV8voSN11pgLSpn7vZeEL+MpbiD6kSpol1ZDjJSXVFNh7f7Y3tUPq4EulFKqeU0S:/TN11psSdAWQSpm2rFs36PjEu+qftP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784174914, "uuid": "eda5c4ec-32f5-4ef9-b630-667c78e09c72", "value": 11104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784174914, "uuid": "988a9cc4-ff63-406d-8a2c-89fd0cb13215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174914, "uuid": "62c56834-412f-4b7d-a88a-784396030368", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b57367-80b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784163343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163343, "uuid": "091c652b-9942-464f-b0b9-aee05d754908", "comment": "Malware payload (Vidar)", "value": "f5bc84645c88f57a988cfb64f254c937", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163343, "uuid": "644c5a49-9529-4ea5-a487-782827bf25e4", "comment": "Malware payload (Vidar)", "value": "5421de84ac52626640c8004a94732e2abadace7cb828f2a499901f59df259bb0", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163343, "uuid": "e9bed70e-d17d-40ab-8144-390217e48fa5", "comment": "Malware payload (Vidar)", "value": "b646bce9d63740a5a1c0f8256a5456478dec8e50", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163343, "uuid": "5be5e176-b8c2-48bb-8fed-a31fdeeca901", "comment": "Malware payload (Vidar)", "value": "b6fdca49669c64c8dbc891ce7540918c672a61d886b107b19fd6bc6d0fdeda25f23fc028b850cc14bb17974a2075a543", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163343, "uuid": "768c00a1-db4a-4cad-80ab-a532aa1abcc5", "value": "T1E5168D07BDA148EAC09AE23188B76156BB64BC0C1B3133D72E60BB782F767D05D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163343, "uuid": "ba83b597-d566-48de-a41e-a2a971e1df0e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163343, "uuid": "aa348caf-3d6a-47e7-af4d-c3796dc96a13", "value": "49152:GHDgAKoisznVrspN3jn3uULSOeutrI34gRKdyCFbipb5PN:G8wKvqOe0I4giit5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163343, "uuid": "3fbea736-914f-4038-bd70-b1be8ffd1062", "value": 4111688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163343, "uuid": "cd354893-6c09-4e0e-b0d0-81033c23f8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163343, "uuid": "a8b49207-086b-4b88-8a12-fe783ee755cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac44ace9-80e1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784184217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184217, "uuid": "faee4b8d-c820-420a-8cbf-6cfe2f72b5d1", "comment": "Malware payload (PureRAT)", "value": "547262f05e47bc0c4a56c29611ef0b0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184217, "uuid": "39dc2f75-0fcb-47ac-ac5b-84c328690575", "comment": "Malware payload (PureRAT)", "value": "545916cb0c7569ed136d04e3e71446bca2717a883f5f16a17f8cc32189c93d52", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184217, "uuid": "f372e85a-af49-4bb2-bab0-792eb0ba0b79", "comment": "Malware payload (PureRAT)", "value": "b469bba6a757472b5c0050d1899276608eba2e45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184217, "uuid": "09b7902c-9645-45c1-893f-21474d46d6bd", "comment": "Malware payload (PureRAT)", "value": "9351aee101606c6354a809c7f13ca96d0fd09d002e2d115db2952eded1ce03912dd5c54c95c02ebc645d80e9a9d61498", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184217, "uuid": "e90682ea-7eff-436c-9f4b-d12ae8b2b2ec", "value": "T15E258D1EB3F80555E4B7863984A7421AEBB278141752D3CF11A0827C5F27FE5AF39B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184217, "uuid": "8777d244-f29d-4161-ae44-9d171187ee7e", "value": "873076e5898304e931762d5077ae3fe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184217, "uuid": "86bf6613-0b83-4cbe-8da8-b9a3ab15e245", "value": "24576:qBZEFuXjnGTRzq3bPQKN/hxCTQA58RvNYbPn9LgZdjGU:qB3TnGTRzhKN/if5aNYbF8zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184217, "uuid": "4365e4d9-69e6-4e95-8b60-89ba6ccb7ce5", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184217, "uuid": "939d82c8-fe1d-4f36-bce5-7d41b1279752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184217, "uuid": "994f7e23-a590-477c-83e7-295f4573b519", "value": "547262f05e47bc0c4a56c29611ef0b0c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0286a30a-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1784186079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186079, "uuid": "9248b1eb-1711-482a-b64f-039f0d0de756", "comment": "Malware payload (LxBaseRAT)", "value": "f627c254a2530765a64f5ba8a0e9c56f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186079, "uuid": "ec6a80c0-088e-4f5d-a1ae-816b1b7fe09b", "comment": "Malware payload (LxBaseRAT)", "value": "54bf45e0266973006ac4ed10f1dd4e6a27dc5d3e214f30fc757346e87acde68b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186079, "uuid": "6513e65f-234b-4431-a3cd-5ce844bbf8a2", "comment": "Malware payload (LxBaseRAT)", "value": "a2ee4b39be73e7cd42bf40445cb6f4f1bf3b3c9b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186079, "uuid": "fac62a5f-66ff-42ad-af3d-71bd81ae10c4", "comment": "Malware payload (LxBaseRAT)", "value": "f6730cb2c0e73f637585e34810f8a26821665bc10e46c67cb47e19ed72db8f1c9c26c06328cd7b82a379c206456a2d8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186079, "uuid": "060cffae-9eea-412a-b644-6b3ee2bdce27", "value": "T160859F74BB26FEFB4079C465CBDC262082116C3C6D6A125840D6FFA08F35ACA7655CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186079, "uuid": "2d1e0c3e-42cd-4257-94e4-510c3fda398e", "value": "24576:fBfLojL85aoD5unY6hGSDiIbG3RfHw1YiUTIPHfqsj3zGShcKeoen2cU39Yb5uof:fB0jLlDYG1Z3qujGSb4n2c31uxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186079, "uuid": "81881a09-9177-4033-9aab-32aa249126c6", "value": 1862289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186079, "uuid": "c6ea1401-bec0-4736-a5fc-090dbe7648ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186079, "uuid": "6204ee13-3fc6-4166-85ba-a9d87ef4700c", "value": "T\u00c0I LI\u1ec6U GIAO H\u00c0NGW.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f4cd66-8133-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784219351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219351, "uuid": "68071490-0cdd-4c68-bf0c-916bb4913e92", "comment": "Malware payload (ValleyRAT)", "value": "3a85be4f475378e774b44aafd20102cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219351, "uuid": "daa3e8ff-d84a-447b-b16e-bd85864b4732", "comment": "Malware payload (ValleyRAT)", "value": "551854f430801e8352f6562a48077cb04f399cdc505b42f0daaa3ad61d0e9f62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219351, "uuid": "d2376324-69ce-42a8-864a-05fc9d1d1735", "comment": "Malware payload (ValleyRAT)", "value": "9f4426b75d6dca82fb22a1f5ebfef3205ef78bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219351, "uuid": "ac1168ee-9784-4bbd-86bb-2bed79651807", "comment": "Malware payload (ValleyRAT)", "value": "ee5d633146ac88dce4fed5e15f68c5baa5bd2937c0f55b71071f108169a5bdca4570b1b3b09519316a31efb0c372142f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219351, "uuid": "039025d5-f5b5-4fab-9ad8-6bf6ed393ccd", "value": "T1D446E7F720D692ACC40AC93B8353EF6A895F71360B36D4E3B198D2525D16DC43A7AE1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219351, "uuid": "f965334c-6fee-402c-9d16-ad49d449d88c", "value": "b6b5d3b43e46f9dd896a962322a5108b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219351, "uuid": "af59c18d-4ea1-48ee-bfe7-289d76266c6a", "value": "49152:9heA6Fk7Z0q9med65MbllMmeDDH65YWOl+Sef6vci39O3:C5kR065YWOl+Sef6EgO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784219351, "uuid": "91cad2bb-8ffb-412e-9b1c-f2a4a1c6b260", "value": 5751904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784219351, "uuid": "5a29d5e2-26d9-4f93-8652-292283c1a638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219351, "uuid": "008768ba-1602-4cc7-aa8b-efc04df68b12", "value": "2026.07.16\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848_SUET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02491f47-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185220, "uuid": "057715dd-15bf-46c8-b633-223362c8c906", "comment": "Malware payload (AgentTesla)", "value": "9556a614ab79d71799fa7e226849963a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185220, "uuid": "cb86b9e7-f707-42d8-a957-9f95bdf13c2f", "comment": "Malware payload (AgentTesla)", "value": "5519eee83a07489c142b4f71ee390a6aab4c96e93972ec8f10c860d0de47fd2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185220, "uuid": "5160b64c-f115-4718-aecd-bada35ed94ec", "comment": "Malware payload (AgentTesla)", "value": "ef3d220c7ea319a1c36a1cb0121f64b04c1fa4aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185220, "uuid": "d8c7b5ff-ad22-4a9a-81b6-88d485cfbb0e", "comment": "Malware payload (AgentTesla)", "value": "114f6c3d5e8ce21a6afcf81847466919284befc3700ac6b6c3ecfc3a65a40aedc89560f98e47cf5c27b020d66a767c48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185220, "uuid": "d7974a40-221e-439d-a00c-09cb1c368772", "value": "T1C3F51700922C68B1A56ED33DD13AAF6C464D6003319DEF1D39AE0624FA57F47A78D9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185220, "uuid": "3e59b051-f448-4b92-9603-a999befe0cfa", "value": "98304:t2eHlp/OjinUdto422PIVEV/nncEsdB7fgFsV6brZ6QOWnpbGO9LeibHS:VKtK2PIVEV/nncEsdB5EnZzNiiby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185220, "uuid": "15fcb92b-19b4-4e90-8af2-2d707f9fb0e2", "value": 3471310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185220, "uuid": "5d964ed5-6074-4371-a570-116c3a4d0b69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185220, "uuid": "64e32176-3ab1-4919-a9d0-4f9b97a26d0f", "value": "RFQ -TGPF00144ORDER - IXYS pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9441105a-815e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237863, "uuid": "dd5f9784-b4a6-4665-ad01-e0d22b1db89b", "comment": "Malware payload (Mirai)", "value": "9da5669c6df30fccd1016ca291a2fee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237863, "uuid": "4a70892f-9106-47a9-9263-19eb9eadf404", "comment": "Malware payload (Mirai)", "value": "55b293c2cfbe7425b1486377eb3c5ec69f64583d04170b55e5a554cdf6020391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237863, "uuid": "a8757c27-f773-4ac7-948f-e8050ab63cbb", "comment": "Malware payload (Mirai)", "value": "d6ccd3d2859b6b3420442055bbd54502e92feadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237863, "uuid": "7f2c8730-d941-4eb5-97c3-d132e28a4a8b", "comment": "Malware payload (Mirai)", "value": "319b28fbc96e28d78815fc0b18dab6bb8ba7200f1e469551ae84109052a428dd3966d65ec327d8984a773ce8da6bac0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237863, "uuid": "650b635e-6cb3-4647-b0c2-8312817e2a9e", "value": "T1B0E3E80E7E218F7CF795823447B7DE1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237863, "uuid": "c3bcff99-47d5-4c99-a735-3deb4e53fa3b", "value": "3072:ZhdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpURzrnPcH+14tTI7V7mFM7mYQrm:ndK+SE7ktsNOT8wR41M7qlkoKrMh8XQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237863, "uuid": "ba924a00-9164-41d3-aa72-b87d249d75a9", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237863, "uuid": "881f8a4e-dfc9-4840-b257-980973d5bc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237863, "uuid": "6b8a36e6-2b1e-4d4b-b0d4-a2af4cdba96f", "value": "SecuriteInfo.com.Linux.Mirai.9816.1947.19075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81cb88e-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185498, "uuid": "7993f211-9cea-4ad4-af81-2fa7ccd31cb1", "comment": "Malware payload (XWorm)", "value": "b59e29d037c6a24ef862304efe95b25c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185498, "uuid": "cff3ae2a-89f8-43e5-81d1-08c39295dffc", "comment": "Malware payload (XWorm)", "value": "565f971ad49449edb483a26a837a1d88d50ea4f43520c4705abb2051116a077b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185498, "uuid": "63fc087c-e3a9-486d-a28b-2a051336669d", "comment": "Malware payload (XWorm)", "value": "14c890513b9f2eabde1e18ffaa9e0cc098745f40", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185498, "uuid": "e2384950-b862-4b25-93f5-8bc5e3adbd71", "comment": "Malware payload (XWorm)", "value": "bab9967995b7ee3dbfb5a8bfe4ba738459c2e3ba535fe1c8ad1e311201b131a319b349c4661de31d8aa087d7757ea524", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185498, "uuid": "bd1c9bef-ba01-4b28-8c68-56997050d5c3", "value": "T1FF4543C6BA1B1049FDF4A272652F4C970CACBCCA613854B16F03A19721CA8DD7951BBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185498, "uuid": "7a8160ce-98de-41a2-9c2f-5542bc609351", "value": "384:i+B8WJPIWdrxONWJJcn2/0Cgh/0jrjWsoNMOUM49tEf:i+BIUcC22/U/LsAR49tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185498, "uuid": "872f05ea-1eef-431f-a74a-36b9ed3bee1c", "value": 1194393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185498, "uuid": "a3c2627d-d80a-47e8-98d6-2945f535a612", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185498, "uuid": "e0f7032e-196e-479f-b6d2-14c6a3418f96", "value": "Copia del pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc89fbfd-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246145, "uuid": "81974bdd-1350-423f-a571-c7373649dbdd", "comment": "Malware payload (Mirai)", "value": "f8e24a6c90ffdb4560953150b718e405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246145, "uuid": "fc7089f6-39cf-4a84-84a7-8fbde362e623", "comment": "Malware payload (Mirai)", "value": "569aa5e2595d7e43f98234445da9f7284c8d307b09f0c2d599cb2568763eb410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246145, "uuid": "b25f9a84-69d9-4711-85e0-ebd16b246e68", "comment": "Malware payload (Mirai)", "value": "7d2bc151426e90db1148fd9dfa53f2d92559358b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246145, "uuid": "89535ca7-65d3-4947-8a7c-09244f438d85", "comment": "Malware payload (Mirai)", "value": "60506089745d262ad4856f0437826e4d796a18e78adf56f7a856b6d6c121192e530019ed40e53bbb0b340bf64ab10226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246145, "uuid": "705df06f-2eac-4691-8e83-6fc5e62f3431", "value": "T187B35C22B9751E2BC4D4A8B661F34361F1F3579E21ACC61E3D710E8EEF246503257AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246145, "uuid": "97f60615-e11d-41cc-b1c4-5ec4c51d0d54", "value": "1536:3t/ikUw0qX/ySCcYIUkKrN8v4AOaOHqkDfBAXoCJdhIyAiWY2IdtorNWq5F9AcUv:3pDwN8AA8h3CrdmrNlDcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246145, "uuid": "d378b26e-f8a0-4e89-abe0-a698f06c884f", "value": 112644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246145, "uuid": "ecfd0388-61de-4917-be93-2331f58bba39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246145, "uuid": "bc699e97-c370-4658-812f-d36223c77d6e", "value": "nerv.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8debf1bc-8149-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228833, "uuid": "1608d10a-091c-401b-85d3-74996237af2f", "comment": "Malware payload (Mirai)", "value": "69217ca260018d07528918facea9833f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228833, "uuid": "4e3aa8cd-ef32-4688-a07b-17fd8b6c865b", "comment": "Malware payload (Mirai)", "value": "56c52a322002465f87f847e9ed0798635b6dc8990b73676c0f49f91845af5cd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228833, "uuid": "dc6a1432-e2f5-4949-8dc6-91a6a06bfb9d", "comment": "Malware payload (Mirai)", "value": "dfef93b88ab9b42052e9877207df0db138d9f43c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228833, "uuid": "2908f5eb-da07-4ac8-a2b2-22fcb2a7ef77", "comment": "Malware payload (Mirai)", "value": "4266854d48f3a18f029f13dfa63ce33574e06e04334c0b55b659712b3b358a4981eeb4388e19a2d263b1499f9b03a9b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228833, "uuid": "6d300af5-d4c4-4f00-aaa6-369818901bd7", "value": "T1B5932984BC41A622C7C222B7FA5F018D336647E8D2DA3343DD295FA4778A95F0D36B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228833, "uuid": "e91cfa34-2809-4060-9a92-6c2ec9f1b182", "value": "1536:umw8lkZ63uBIfVBmFTiUJ3HSpMECl+gUOpv7CR5Wvw83CDoMjU0IwYQ:umw8lkZ63uBIfaFTdJ3HSJCl+jOBW8tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228833, "uuid": "791e5c22-16f5-494a-a611-cbdb55bd5fe6", "value": 96024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228833, "uuid": "37af7573-5129-45a8-a5ac-a1d5dbae9403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228833, "uuid": "587326a1-aa1a-4fda-b2b9-f84dc7fea5d6", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0739642c-8145-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784226889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226889, "uuid": "c44279e7-786c-4d88-8cfa-44fdf07c2d91", "comment": "Malware payload (Mirai)", "value": "92fc6f9e584c53f9dd44f3fcdd2bfccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226889, "uuid": "90331915-04b1-4fc6-a099-ba3feffe2b88", "comment": "Malware payload (Mirai)", "value": "57274155a14ea45dfe6c92217c396777b5f6a6ecad1c0b61fe2192e2c518aa69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226889, "uuid": "7979b9d6-852c-4652-a6d9-d194b17aa9b1", "comment": "Malware payload (Mirai)", "value": "acffccfeab9299b598403acc869166f0ea9928bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226889, "uuid": "f6c4fe2a-b1d2-41da-848c-a8cc9e3a72cf", "comment": "Malware payload (Mirai)", "value": "9db07bbbedaa65c73cd3d60e66e64da7c4118d4ab08af893de5d332a10862a7c43de29db7caa1dabae8f9394a12e38b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226889, "uuid": "9cabef46-46ff-4f5c-8311-da9661772442", "value": "T11B148D68FE4F68D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226889, "uuid": "0be88912-5073-4266-9871-28e3addb7812", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxe:bOVfbEdxm4iubE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226889, "uuid": "526d8ad5-728a-4d49-a712-3599b4f20eeb", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226889, "uuid": "3769df2b-02ec-4ba4-aa99-64a0a58a8aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226889, "uuid": "c413845d-c0ae-45d8-91cc-a54b75907267", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e6aeaa-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185224, "uuid": "3b07ba2a-fe37-476b-a6a7-c2172b3af156", "comment": "Malware payload (AgentTesla)", "value": "f0eab2b312a71a0dff58dbd09766ed2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185224, "uuid": "04067ed5-f0e0-4e21-9999-0c0986a20af4", "comment": "Malware payload (AgentTesla)", "value": "583efa3edb8e6418c8033af8d0393242b7de59785cd7ebdc4b8a36f3a307142b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185224, "uuid": "9b74e9b6-85d3-42c0-b07c-ef5d3754fdea", "comment": "Malware payload (AgentTesla)", "value": "b3705bcb3ef75eda798cc83667821d1c843272d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185224, "uuid": "5ffb008b-4daa-4e87-9c8d-354e17d233cf", "comment": "Malware payload (AgentTesla)", "value": "352e5cf31a98f2fb6f39df53d2742c9b68afa015f318ff0dce3eaff0cc9fdf7d73bf8079323b7f58176cd0eb053087c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185224, "uuid": "fa0015a8-f5d4-47f4-a03c-a17af62b1ec3", "value": "T1D274734522C0A4845787A73F3FAEF0DAF46A0CD976844847E218F995FD7920EEAD6730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185224, "uuid": "4f2da18b-80da-4c37-95e8-f201dd61deb0", "value": "3072:XJEyBTPLK7/gyysARMvwdtL2DTs1CCpdWy7oatbwiQkRPrhDU/ZLZ2G8KlO3XWGt:ZEyBTPmUH8TQV7l1U/ZLZNlOZn/4pib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185224, "uuid": "6a12d8a7-087a-4915-aaf4-50cf365693dc", "value": 369626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185224, "uuid": "caced3a6-486c-4b76-9716-4a92b4222bd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185224, "uuid": "606ca419-16ea-423b-865f-b9525734f6fd", "value": "DRAFT COO, INVOICE DAN PL.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e57c6f8-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185482, "uuid": "56abd0f3-9914-47b5-82a3-0f83a261d419", "comment": "Malware payload (PhantomStealer)", "value": "2c493e803ef4770e21765b4c94ab0013", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185482, "uuid": "a8d2c54e-07e6-4c59-aaa7-91f874424e42", "comment": "Malware payload (PhantomStealer)", "value": "584814db188e858512dae1520594041731352e980cc22c0537a5bcfe9037c99e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185482, "uuid": "9380da90-4d28-4ba0-b3e2-621045789739", "comment": "Malware payload (PhantomStealer)", "value": "865b823550aa841b31b89f4cd49f08acca895a37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185482, "uuid": "1d27db89-6523-490d-ae99-ec570ffddee4", "comment": "Malware payload (PhantomStealer)", "value": "bc313d79ea6281f052f7b7101c1c382d2c4efb2fb94a4930fcb6ddce36f9126c86f49cf6e4a6c8fd24e651a1dfb0501e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185482, "uuid": "255a6c5a-93ee-4897-9934-fe9f003a7f38", "value": "T1F726F2215F881F7FCAAC1918D0BE161EB3E107895467BCCAEF737D4A5FAA70041271A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185482, "uuid": "65a619b5-aff4-42eb-96c5-a64af491f68c", "value": "49152:3wfSnJiXpGGfu3/0tUU1gMMXN++A+cZ5gz3LTFy+RZ33havtUc0Zc:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185482, "uuid": "a4e748b1-bb3e-4578-a3aa-0afcbaa4ecc1", "value": 4817106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185482, "uuid": "5cd6ee89-5bd4-4a8c-8995-5db720db8636", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185482, "uuid": "72c798b9-6376-4f0b-a726-d1a04ebd2e4a", "value": "PO-3094.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5dff04-80c3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1784171277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171277, "uuid": "d120f565-dfcf-4e68-bbf9-b16c819581dc", "comment": "Malware payload (Joker)", "value": "c5d02939d865d5fc4bce13e6ad6d5d77", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171277, "uuid": "49d601f9-c280-496e-83cc-264deac870bc", "comment": "Malware payload (Joker)", "value": "58fa325d6a5619e1fba43d6bd8a913632521284306631c8fb7bce7ba8dda3393", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171277, "uuid": "497ee454-7e7d-478f-9e1f-ba731472ed7c", "comment": "Malware payload (Joker)", "value": "a365abc4936a89b756c70368a3da472468fb66e4", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171277, "uuid": "0d146f44-98ee-425c-89ed-5eb4027ace48", "comment": "Malware payload (Joker)", "value": "d6ea0bbc9df0a9cea37403ccb159f13157791063ef36527d0f1ced4a7501b694ef194f785e4d80a74f5079fe82602440", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784171277, "uuid": "f6cbc8d9-85c4-4802-b26e-254632e622dd", "value": "T18A671206FB0DAC3BC9DA647C8A574B9131166C854290D3976925F618BFBB7CCCE26BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784171277, "uuid": "fbf8c477-5e25-47f0-8d55-db49105bad70", "value": "393216:tJXgcMrH0gnn81Dm94/W9B4GKtO5+dg/eva91YORrKVFDLv9GW5YNE9qkeRGXj0:7gcwVX94/oB43tOCgVRrKVBFesXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784171277, "uuid": "04d38a14-55fa-4126-ad68-78cbd74f810d", "value": 31944757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784171277, "uuid": "dd9cd606-ecc8-4bcc-8f4b-86dd2109214c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784171277, "uuid": "4c2da7fb-7b5c-4ce2-b93b-2d43ebb31d0f", "value": "Font+Keyboard_1.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ba8fc9-815e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237811, "uuid": "815372b5-790f-4877-83b4-5f5caef98e11", "comment": "Malware payload (Mirai)", "value": "5c810fb883e0af83eaf65fa6dd44c7e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237811, "uuid": "0b44a028-a628-4748-b282-87613fe19972", "comment": "Malware payload (Mirai)", "value": "59b756899825573563cd53ae62bcd1f703a765f85797c352964e5246f04a85c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237811, "uuid": "b7a15de7-0101-4e8b-9fbe-3c3088f4d228", "comment": "Malware payload (Mirai)", "value": "d6af82b2b2583104beabc66ea759be799d618175", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237811, "uuid": "a0c604e7-1b2d-48e8-a411-3b3f12c62c56", "comment": "Malware payload (Mirai)", "value": "f9a3acb45341267041dd99ca7b0b1ce947421138dc55b82acc43aeccb9ca4d3c11db3103bac51e57f8e0c3ce28ca8809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237811, "uuid": "78611e91-69ce-45c0-869d-c3470a8c7c5d", "value": "T14933F1EC5F8C40AAE1C6E17BC9F7CFB02F220761F443ED91BD4899868985D88BD87581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237811, "uuid": "37e6cc3d-10d9-4e24-8a16-11e43a9841b9", "value": "768:/sq/h788rVWM1m+UcwUf8FkHBkcvATyba/05VSI3Hk590Wt9dcjcSxj0AoByAJgs:Eq5QM1ttR8Ttybz5rI97POAS5oxVJuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237811, "uuid": "4ba2e740-e026-4463-ae94-5ede95045cdf", "value": 50516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237811, "uuid": "b0be1736-442d-4b7d-b639-7db47ede7e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237811, "uuid": "f40dcb53-3dd0-436d-a937-7172f543716d", "value": "SecuriteInfo.com.Linux.Mirai.9816.1947.19075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbce8075-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186444, "uuid": "25f55a6b-3c95-4d22-9831-8a820aac1f0f", "comment": "Malware payload", "value": "5a6779bfe185ad4d2a152a81bbbfefd3", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186444, "uuid": "98a9e6a7-7b24-497e-9a78-cea61a19ad84", "comment": "Malware payload", "value": "59d7b1f114a2b4ad204603409f20da5196c1e77492ed29d440bec25621ad38fa", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186444, "uuid": "7937bc08-5137-4338-bcf4-a703ffb41ce5", "comment": "Malware payload", "value": "4f69398f144fe7611b82f9591f6f72a8ce1ed0d8", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186444, "uuid": "639c15b2-0ac8-4417-9ea4-cb3b00a6ddcd", "comment": "Malware payload", "value": "c3eef186a8f88e0a9101bb9db88c4c2f3e1dae04c767164348f9e575143a513491ae7f6019a8ded24cce5caa912aae72", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186444, "uuid": "5a0c5a14-7d0a-48ea-843a-3d4f9c557c0a", "value": "T1A005F1195A547BADCE334DFC829E04FA7E6FEBA346C6012B6AF542D28704A50442FD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186444, "uuid": "0027ab5a-54f5-4d7c-8a4c-3600782b984c", "value": "ce21766d52a5fd9cb38316242f7fcf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186444, "uuid": "1b94f5a2-e139-411f-aff5-26a4090af096", "value": "12288:op9j/0uHXeOeVKc6dKNl3Et/reXvq1vu7RR7v+JWl8zC2rz7jOfYjbdh:qN/pHXeOeGoEtqScjv+ju237qAjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186444, "uuid": "25d43038-4fb5-4d41-ad7f-4f0bc1e41cca", "value": 845440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186444, "uuid": "f951d539-dd18-453d-b74f-0378d1cad962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186444, "uuid": "c7c8691b-0786-4f09-bf39-4a591b8d050a", "value": "netutils.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1bf2b0-80d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179707, "uuid": "f2e97355-6e21-4cbe-be44-0c0d6fcebbb6", "comment": "Malware payload (Mirai)", "value": "1c37c753ed7f99f218b664fa563e0ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179707, "uuid": "0e11e102-2238-4bbc-bcea-9e5cba5eba70", "comment": "Malware payload (Mirai)", "value": "5a58a0b98ee139ca5264d58e631e947eb124b837d7555872b184ab5a0afc1788", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179707, "uuid": "6b3475fd-8bbb-4400-a646-feb9b5eda250", "comment": "Malware payload (Mirai)", "value": "c067b7b13c78117200d02485fa77b8cc81e42008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179707, "uuid": "f8fa2382-2250-4609-ae6d-88abbbbf3c21", "comment": "Malware payload (Mirai)", "value": "9841a1b34b1d35277992cf36561132f366ddca9c884f85947852f25f5f230b2fabdc6d40eac28f4995777600be8b2847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179707, "uuid": "87d71d9a-cf97-4a7a-979d-258faa41ad19", "value": "T13BB3BF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179707, "uuid": "3fc07b0b-d8ad-4df7-84c2-9e53f88127e6", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzq8rSR:t3SrlGWnKTU83AQB5A5Liy36fmUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179707, "uuid": "842c869c-2562-46a8-976f-54d7a37ece84", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179707, "uuid": "9cf53f90-2ffa-4933-832f-aacda6e97db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179707, "uuid": "723a78bf-0f79-4a34-b33b-0142a5b39310", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff756bf-810c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784202476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202476, "uuid": "0a15d2c8-823b-4073-bbdf-f83d56662d4c", "comment": "Malware payload", "value": "b43434d26b9aeddbfefc2b69d066b17f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202476, "uuid": "b42e5814-5f7d-499c-9213-e567972507b2", "comment": "Malware payload", "value": "5b0b64839e19f838b8d09f3a5c598a27188b9e11e3c5c7eb793b9860fe83aeca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202476, "uuid": "a799ca74-0488-4966-96d8-faae6afa5d8b", "comment": "Malware payload", "value": "d860b03e80c3f1fd50fdbd51662fa6ba811181b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202476, "uuid": "3127e6b6-cadc-4a18-9b53-6d5a54538d70", "comment": "Malware payload", "value": "5185198b453d01c1fff20d0e8abb157cf75714e0fba86c6c8170944acca9834f9d5652fd75c787db000788b4b278c3ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202476, "uuid": "aa9d80d9-48e9-4277-bcd1-342a8ed3c0f4", "value": "T1DBC28D966A867C44BDC94A3E4CBE2B1D6DF5C3D1224942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202476, "uuid": "6058d67d-6176-4259-9f68-fc54450761b4", "value": "768:U8vCB+25j6es8Rq9FYpMSUpi+20qUpi+20YQX:U8l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202476, "uuid": "f43613d8-66b2-43f8-ba50-30e1d9d85bb1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202476, "uuid": "30fbde6f-71c2-4b27-8e75-4e6466652143", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202476, "uuid": "972a0a6f-4fc5-434b-a66d-2d7a32fd9117", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490eef0d-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178896, "uuid": "0e9eb545-a8f1-4c6e-9b42-009a03b9672c", "comment": "Malware payload (CoinMiner)", "value": "6f4c9ca8045570a420776c98440d3c7e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178896, "uuid": "e4b77ba2-3366-4a0c-aefe-8d778706311e", "comment": "Malware payload (CoinMiner)", "value": "5c4a38c19214a0de28fe2aeddfb09068af897bc20fddbf66b8ee9b2d285fbd59", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178896, "uuid": "9b3c05d1-fd5d-453a-a0c8-337239124185", "comment": "Malware payload (CoinMiner)", "value": "092fd96ee382e9fe7f5b6e7a0b41fc59c02230e0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178896, "uuid": "6d59bf17-3f7a-471b-b584-ed1eb7aa237d", "comment": "Malware payload (CoinMiner)", "value": "a53c4161727a56d9741c8824471105c3de6d01fc31a46943f0ebf393a7cf554160a05f96fc0a8b5165ac88232d09e2e9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178896, "uuid": "dccb0068-7a19-43d3-9f33-776aa844d3f9", "value": "T142367C88E793E0F0E65308F0559BDAF761301A355053F6F2EB8A6B66B4363416F0936E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178896, "uuid": "45e832bd-1f7f-4dc8-a2e9-6853a6fa6281", "value": "98304:NXSXKhh9YG5bHVWarnzOHGynoEIvWd4+37Uu4kRHkKSXFfZQYPsOw:NXSXwxkboC4+b9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178896, "uuid": "50282af5-39f2-4406-b340-fd9112499b7c", "value": 5103196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178896, "uuid": "c6aa03e0-6ddd-4e00-b1a2-a07bd3fbfa56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178896, "uuid": "724f4b6e-a37d-4a7f-97aa-f91cc4af324a", "value": "bcba4234552933d2a50fbf5878e2e4155d94f251aba99345d1d9108ea6c8a6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03730185-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185222, "uuid": "9ac4f5cf-7496-4fe1-ba3d-5d083f11261f", "comment": "Malware payload (AgentTesla)", "value": "4a2b4db5b36d70afda7a13eb417cd841", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185222, "uuid": "5fc089ff-08af-4ed6-bf6d-7ea2ae0dedf5", "comment": "Malware payload (AgentTesla)", "value": "5c94db2cd8598015e2288d9a64d237fe2087187f5f2eb6f18aeeab480c371d97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185222, "uuid": "b42943bc-05f3-4a1f-b21b-2ad56f003a55", "comment": "Malware payload (AgentTesla)", "value": "e15c31f1116c1924b963817c4a6b40c20f14a143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185222, "uuid": "6c60795b-153c-4bd1-9671-4976000ae9a4", "comment": "Malware payload (AgentTesla)", "value": "70f9462e55defe4e9a136383652963bc0488a0da8dae2a25aa1d0491302769eb9e51ea45ab458cebe74c309639e3a034", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185222, "uuid": "23d3a550-f2dc-42c1-a4e7-35d8c60c214d", "value": "T1BF757B7E63F4728699752E408DD1E4566D4EB22D6EB0FDAEF8D25DD020430BBD0A2C36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185222, "uuid": "f3cbc1a0-8a7b-4ee1-99d7-8bcb9531ac37", "value": "384:k8KyoGJMPpL5P1i818OLoG48k8VMpCT5feloRvX:SMwTkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185222, "uuid": "0ab90428-c330-4dab-a703-1b5a062e4b0c", "value": 1682765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185222, "uuid": "76a9ae9b-c84e-42bd-93a7-1ba534ec1c19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185222, "uuid": "4307a4d0-8a62-45a9-af4f-2535cf4de118", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54015012-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185357, "uuid": "5ea8f438-6953-4ed4-9f79-a8d5f087f426", "comment": "Malware payload (Formbook)", "value": "335be7b72afee42069de67612e7ba54a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185357, "uuid": "4f5caef4-83f6-49b3-b05a-d659ee67ca16", "comment": "Malware payload (Formbook)", "value": "5d736a834c92c93db1b1636f84b92bd8eb5deb561e7d6517dc4eb603f37e7854", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185357, "uuid": "08d67490-4c33-4539-ad37-0d66c0e72571", "comment": "Malware payload (Formbook)", "value": "723ca914f040c3b2182df8cdc43a8268d3853f7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185357, "uuid": "e166efe2-63e1-4df6-8794-7b503679d2e4", "comment": "Malware payload (Formbook)", "value": "f2c1b57fd9e6b1ae94b39f233dafa4c0ccc811ce31d287179c16b4ea466459db94fa0b95f1de58b551c7514762bef3c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185357, "uuid": "5d4f959d-6188-4638-ace4-587e9cb2462c", "value": "T10EA5E1104F846FAE8BAC1A15D0BF161EF3E11B89546BBCCAEF637D059FAA70052131B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185357, "uuid": "dd14a581-11b8-4683-ac31-38f1d90c396c", "value": "24576:08YMeBsos/YeFRtM4ZS3cvsfRjqSYRNMF86bqyzwm4kz5LUHn6NhSDDPQu8:KHBsKmBZFSIhM2y5gYqPQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185357, "uuid": "236faaaa-64ce-4087-a69a-7ea4eb040395", "value": 2147818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185357, "uuid": "a8f249ee-6b6b-4c69-8381-528d6a44a1c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185357, "uuid": "3288f07e-8320-424f-a33d-5bdf9e72641d", "value": "DAKAR_GLOBAL_TRADING_PRODUCTS_REQUEST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bac57ad-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784245929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245929, "uuid": "ea33f1fa-07fa-4b51-82dd-db648250411c", "comment": "Malware payload", "value": "27e63e3faf9b8b93e26eb194b3133189", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245929, "uuid": "ec99ec46-df5d-4e75-accf-375469a5c9bc", "comment": "Malware payload", "value": "5d7cf1694cbd34d61441e99e8efca3d64561a4a84b49de920a77119045725303", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245929, "uuid": "f1df7f9c-0cff-4953-8ad8-32967004f7fb", "comment": "Malware payload", "value": "f3928d455615c75f63624be059ec855adcad920e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245929, "uuid": "158f8b3b-3446-4045-8fdd-eb039c78dba6", "comment": "Malware payload", "value": "2b8bbe9ef699e33595c6e3e875e803f0789e9ced9b715de5c1ee762794e8196b58e4a906fc5bd696206965d983acec58", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245929, "uuid": "c7ef9559-a114-4b23-8d0a-9aae90915ea4", "value": "T10CE63318A6E165EDE9F34138FFF08999E4A771168B32C9DB47A4A7A53E032D00D38717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245929, "uuid": "9fb45261-1972-46d0-9f77-3636ae8aafe6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245929, "uuid": "0bb724a7-90ca-4ea3-bfb5-5ba73b0c0708", "value": "393216:Ho1ZJxjqsMuB/utQrkXf2/nIXBoiXMCHWUjX+cuI3/PGTAI:HAJp1ZB2WrkXWnI+iXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784245929, "uuid": "f3a485bf-f08c-4cb5-840c-5a08d57c2b3a", "value": 14303111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784245929, "uuid": "5a1f1941-6520-493d-ba89-4ecdfd8a0166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245929, "uuid": "1d728f38-0e06-4429-ba3a-f7fc687ad970", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d56db0-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784228072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228072, "uuid": "635d0ede-e50b-443c-b037-fbb4f3d86b62", "comment": "Malware payload", "value": "532af24313a5e00a0d5ccbb4b4b597d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228072, "uuid": "62909146-627e-46fa-8753-6b922d73d05d", "comment": "Malware payload", "value": "5dd252db0cb173f310c010c77a9e8a0edc9054c2737229ef86a0a6f32107e0fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228072, "uuid": "d67e1b89-6f60-4b81-bc0a-32a89296519a", "comment": "Malware payload", "value": "1aac32ae7e7bc741d58641b86595f137a2451dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228072, "uuid": "6a3cb64f-b24d-4361-a05b-ee02e21a30ec", "comment": "Malware payload", "value": "6cce5ac092d3d871b3f706aecf4bb0021d8362df1907f5c614e7cca3e4ba8d23c1427bcb0b63b7125e07dba165a10f1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228072, "uuid": "ae128eb7-dde7-4a71-ba07-79ed1af9ed51", "value": "T16893E90AAF601EBBDC1BDD3705A9075235CCE60772643B757538C928BB4A54B8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228072, "uuid": "4e36c111-4694-46af-8168-eae61929b07a", "value": "1536:xH6Ap6ImNxOWXuNZ2A411NBuKeRa1Pohw8zOUgJVgpgG+UtWdh:76rxOWX4Z14POKe8uwVgiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228072, "uuid": "cc89b8d3-8da5-48fe-9044-400c8758f27f", "value": 89636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228072, "uuid": "d1bc2ed5-3117-4da9-a3b2-40db46a0df93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228072, "uuid": "6af32ee2-d354-4a62-8caa-5ffef74b2290", "value": "5zF4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9241879-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246166, "uuid": "6cfc81cb-b6b0-4d71-9cc2-bc2d1dd27213", "comment": "Malware payload (Mirai)", "value": "fd654e0d1383fd54736077605ffd04ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246166, "uuid": "fa029459-800b-403c-97b8-1ea3449ec2f0", "comment": "Malware payload (Mirai)", "value": "5ea3509f840f6cc8b36e4930c7f6514253c3be358c7f83683c021d51fe6a2b97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246166, "uuid": "be2bcdde-7c1c-41ef-bdbc-0ccf895a17fe", "comment": "Malware payload (Mirai)", "value": "199170845aaf06e9b608c5c3c20142f6d088abbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246166, "uuid": "84b0d5c0-b820-43e5-8516-b5f9c4e89f3b", "comment": "Malware payload (Mirai)", "value": "334d27ab79181b19c35d522f856f0bf6bebcefec67ea4f63184e8352fd37fc82bf5fb4be2661406084bf5a021df262e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246166, "uuid": "67fa11be-5053-4b2b-ba47-63614db6fe4b", "value": "T19623F12801B26E59B11F87F7686DF71B2B5430056621C5C632E0E071D7F3B3A1E2879A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246166, "uuid": "a35e8cfd-c6ff-41d6-b0fa-60f4ccdc69ec", "value": "768:mYcUTiSFnR+ZW54r03UK12jc8/xCrNhRQeccxdk05pHFFGxhUWVuA53488Inbcum:mYcUTiMnR+1rKm9gTRRcyplFGxn35yIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246166, "uuid": "c4860eaa-aafc-45ce-98bb-286b9f3b62be", "value": 49092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246166, "uuid": "d271fe99-c156-4162-9e94-0f80e8b6c513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246166, "uuid": "f6f6ab50-18de-4ca4-a446-c8dfa0e440cc", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a642d8b2-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228445, "uuid": "99b43b1c-47e2-4d27-8b90-61531177f43a", "comment": "Malware payload (Mirai)", "value": "d28529eb4c64ffa718dee417cccc4a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228445, "uuid": "25bacb04-e55b-40d5-b362-1713926c5917", "comment": "Malware payload (Mirai)", "value": "5f09945e511fa57006ac9ae6597a682b47b77bfcbc4028d8bd63749320157c8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228445, "uuid": "c94fb53b-c3de-48cc-94d2-b55e657cb659", "comment": "Malware payload (Mirai)", "value": "9076e087544ed4fa781bec353129c5be30094475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228445, "uuid": "170922a7-5032-4d74-811e-9ff1f7933b9f", "comment": "Malware payload (Mirai)", "value": "4f2f0357735f1d97cb0c62641a452c44fe4562a9483d88ba579d188d853f8cb1faf5b97ef2c10e4575d46cdbb32df0f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228445, "uuid": "e2b46149-e8f4-4913-a785-081456916155", "value": "T1ADA3098AB891A620C2C2167BFE1F014E33135BE8D3DE73569D285F6477CB96B0E36605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228445, "uuid": "f0dee489-e742-4088-b623-eb8162902730", "value": "3072:4H+glPDbJR2m3I1yUiApzLdQTeJxaJojTL0FztA2wnV:4H9PR2m3I3zxXxaqjTNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228445, "uuid": "2e84da52-d0e6-47fe-b4ec-1bf473438d7d", "value": 104796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228445, "uuid": "2882e83f-00ee-47b9-8eb7-6966e850abcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228445, "uuid": "c2c9d282-db44-4944-9902-98f31d24bb5a", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c23626-80d8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784180315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180315, "uuid": "6c9a5b2a-edd4-433b-8ae7-ddf654323d33", "comment": "Malware payload (Mirai)", "value": "3dfc2c74f24728ca4dc17265e3d37c4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180315, "uuid": "626cbaa3-47f0-4bc3-8c85-e61b0711fc19", "comment": "Malware payload (Mirai)", "value": "5f6658195d71abd120af8f0d800e4f89da4f61b7a09e5519d4c6875c0be6e8fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180315, "uuid": "c3efd5e5-edb9-4f30-bb9c-ef9032846656", "comment": "Malware payload (Mirai)", "value": "1f3096d2f49484f1353802ebca371c0dacf2cf94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180315, "uuid": "5cea4abf-9c98-4662-a995-0383a34dc6d8", "comment": "Malware payload (Mirai)", "value": "0e993abb9712c9aed14e681780daf1ade1e9290ee1b09d003ccccaaca06bef9fa7f9f730b9db3cd88b59ef5ce35d1ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180315, "uuid": "4670f90f-40c1-4f8c-8f2c-db8ad75c5fed", "value": "T14424D946BD519F23C6C311FBFB9F429C37266BA8D6EB3102DD246F6037865DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180315, "uuid": "15ebc0a9-69c5-431b-9900-3b49c4a15a3a", "value": "6144:oV/fU65qBCSWfIlTCMQXuA8nXCuKjNZK:oV3UGqBCglTCMQe9yuKjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784180315, "uuid": "07e6e084-5448-41da-af1e-f3078ec0fecd", "value": 209552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784180315, "uuid": "b1945743-93cc-4133-b82c-3ac0dec8649f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180315, "uuid": "e3a3c0fe-e823-4ef1-bfe5-75326c7aa68e", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c22a95-80d0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176844, "uuid": "17b5b31d-8527-40f3-be3a-fe85ddae72b9", "comment": "Malware payload (Mirai)", "value": "cd1e453c53c6e23fdca58bbf94db5614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176844, "uuid": "0075e4a7-7db4-490f-9335-2534971e7bc6", "comment": "Malware payload (Mirai)", "value": "6129513fc737fbb07a13cccd34409cb56ded124b63d3b6f6f58145f0464b3f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176844, "uuid": "e911b97c-5101-4a81-a1ca-66120e44328f", "comment": "Malware payload (Mirai)", "value": "ea766e1f7812107cf25669cdcc42fe56e3f3ec72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176844, "uuid": "223fe430-1bd9-48da-9565-ecab8526dc06", "comment": "Malware payload (Mirai)", "value": "fa405bfbc6aecd662d77862a0099517d755f1a89b6e69e71b97e35abc5ce780a3ae520a2be93a52a122c525dd6d8b533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176844, "uuid": "64b51a2b-1685-4234-9f72-62f0533632e6", "value": "T170040642E683CFB7E55310F101F787211A31E83A6D66C442E7B9BCF4AD61AD1A61A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176844, "uuid": "79114204-8a67-483f-bf53-e0887ffd0d01", "value": "3072:r1slPjGBZDif9UoNz5I3Alm6NiDFXt3sUJasmlIfPlp2O:CR0ZDiVDrlmh93FgnSff2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176844, "uuid": "3eeb2b30-cf6b-4796-a43d-d51ccac54f40", "value": 188956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176844, "uuid": "90d0a15c-0bf3-485b-bc1e-1faf199e3127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176844, "uuid": "f307b2ed-d46e-46cf-a68e-6d4c7fe2a03c", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca00af94-80e8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784187273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187273, "uuid": "10ea2948-26a2-4a41-9267-ac5d655ab6cb", "comment": "Malware payload", "value": "8160ee7047f4631863c1f5ed7ad117a6", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187273, "uuid": "fe15a629-8773-41df-9abf-8991002c1368", "comment": "Malware payload", "value": "613be7cfb4917b292678d5bccd4551b10d7bd210b5b6fab0a4d1a5dd537c0fc6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187273, "uuid": "2e7f1423-4b5b-4a22-98dc-6e1f5c314e8f", "comment": "Malware payload", "value": "70d4cbb89ba7783fb92b52d36935f78641ba0563", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187273, "uuid": "0cb65f52-74e8-4dd1-8b05-7686bb764a5d", "comment": "Malware payload", "value": "38d854f0e3ec2ad41ffdd8482099fe74ceb9ee50dea04416d2dfcd1edd56046d645623e3204cd42dc7104d2091e8f724", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187273, "uuid": "a4abe895-193f-4b7e-b3e9-904215d3ad9c", "value": "T1E4F0E1B0E1B9E040CDCBD6312C54AEA90231D94921D8E4FB7621717CFF8818B2DCC9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187273, "uuid": "7d924a8f-520b-4697-aa6f-2269b6a3a5a7", "value": "12:5jf82bI6c5K1/Kt7Ie36c6KpEf8y1OXAo4/DYJw4xoyf882blpaxMJ1:9fb7cSk7I6F6KOkm9v/DYJJxHv253", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187273, "uuid": "04c0fb7f-50b6-47b1-8171-ec89c8bbca74", "value": 633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187273, "uuid": "6f54bb20-dcab-4d49-be47-1c0fadc5f998", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187273, "uuid": "0d3baa14-7d3f-45ac-8fa8-fcd7073e11b0", "value": "613be7cfb4917b292678d5bccd4551b10d7bd210b5b6fab0a4d1a5dd537c0fc6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c442b5-80ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784160796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160796, "uuid": "d3ad1835-9a20-4b71-a681-f43ec3b3e591", "comment": "Malware payload (Mirai)", "value": "63ab625dea9a3feb81a25b2735b74d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160796, "uuid": "c221bac1-63f0-4549-9293-1013b3066d2d", "comment": "Malware payload (Mirai)", "value": "615dffa88641da5740583203114e92507d18b96ca510b9533fb154209b036988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160796, "uuid": "0fe5597b-110b-4e5f-8d49-e72fdb727214", "comment": "Malware payload (Mirai)", "value": "d6072683fc892fcb65446bdfbadc554d9f476525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160796, "uuid": "167af329-c03f-4b05-aa67-3dbe34835aef", "comment": "Malware payload (Mirai)", "value": "1a91f9d3e532180999e4a8b63cd74a34e62e7da34d1aa7c88804f1bfdf656b18c9e8a83c715234b9d61a822a5d468339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160796, "uuid": "43ceb092-dfed-47ac-a161-dcff24763d21", "value": "T17133F171A006B5BDD140C534FD2E8A53FB432DA5D1683A6F05A1CB9ADE03AE722E72C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160796, "uuid": "1799519a-5cc8-4728-9ea7-4bb6d0bec899", "value": "1536:bvVXlTrlg4AnNzW0EKU+m2eAKhMCaK1H5I+Nfi:7PZEnFZEKSMKZaK1ZpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160796, "uuid": "3efd041c-29fe-4079-87a3-f3822970315b", "value": 53416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160796, "uuid": "17e27ef3-5a4a-4d5c-9d24-22b0c53b5cbc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160796, "uuid": "7dcaf9c1-6a22-4bec-8d01-54180c1f0dfc", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d263b873-80ce-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784176120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176120, "uuid": "2331163b-e874-4ec1-8140-02edfdfabf7f", "comment": "Malware payload", "value": "d6cc8378a0da5ecee7c0b7b104c1f726", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176120, "uuid": "98407a27-777c-46a5-b5b1-4a1ff7224ad8", "comment": "Malware payload", "value": "620ed030d24f6fc14893221857d82fd671c293945e980a6cf90453b4164874a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176120, "uuid": "d79c893b-6137-4fc7-a74c-f6298e900095", "comment": "Malware payload", "value": "bde0b6a548482890640171cfbf36be338c756171", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176120, "uuid": "b0c16dc3-1caa-47e0-9fa5-b151ec68d194", "comment": "Malware payload", "value": "2ff0af60939a9a632df778a4318af2f34531474a76164391b5ef3cfb354a11213379875ca6c5803c6c71d471cf7bf3fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176120, "uuid": "81a50658-7293-4267-95e6-4b57512428ae", "value": "T19AD02B6040B27CA13BF52E14C1D8470E1170A7B1E5C67E7CD623C7F049100C0314DF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176120, "uuid": "886ee590-9b72-46eb-a523-d4871d1733a2", "value": "6:UqLqhR4yFcIsKLJMNIzXzGMN5LJMNQuDLJMN25FTEX3:UquhR/FFTXxYDjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176120, "uuid": "762d78a7-626c-4a8f-af62-33b928891a24", "value": 273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176120, "uuid": "c3eda4ac-4ddb-4ac5-9e44-64ca5c33ee80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176120, "uuid": "f1cf7d8c-cab3-478c-b03a-18fea1d3a8a8", "value": "301m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48f1500-8143-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784226402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226402, "uuid": "f1911a98-0367-4d9a-a386-949feec724be", "comment": "Malware payload (Mirai)", "value": "4f5319bb841be7c161a46928fac8067c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226402, "uuid": "8261b61b-9175-46e9-8d1b-7f7ae6447551", "comment": "Malware payload (Mirai)", "value": "63a7df36a93a1798d5b02a6709c9dfbc265efc258f67cc4fe82399ddfc69c7aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226402, "uuid": "3aae9aa5-1ffb-4c90-ab61-e6d4406f581c", "comment": "Malware payload (Mirai)", "value": "ba4e2213bdc834d07a45b1b369f2d178cd904cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226402, "uuid": "1332be6b-a84b-49eb-85b7-482321a2fcfc", "comment": "Malware payload (Mirai)", "value": "c468110611cc11e87949536c2e2a81fdb8bba3030234ee338e8b68c04bd7ba0f348f2348266ea70d6b87dd1df7181c1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226402, "uuid": "47bff26a-974c-4729-a728-c2f3200f7782", "value": "T1CB147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226402, "uuid": "19126271-bba8-468e-9afa-1fcd242b1005", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCREUKG:IcY5JpMByVs9jS7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226402, "uuid": "08180ef8-8145-4e1f-a8b4-06d868628b04", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226402, "uuid": "42a3dd18-fc2c-49f1-af6f-6bcd4d240bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226402, "uuid": "8c9c166a-dfca-4d16-8306-30691e3c45ed", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a86e60-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185231, "uuid": "b12f3fdc-15c4-4710-9d17-7f6adde366b5", "comment": "Malware payload (XWorm)", "value": "04f710575b8d978f4870d633667a861f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185231, "uuid": "37e7b233-09d3-49c8-b557-33a83098fb3b", "comment": "Malware payload (XWorm)", "value": "64285094d2a6f543433d9b2bbac04cc93be0bfeb0ba2fbafb8d2f239f64a347b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185231, "uuid": "e52e1dbf-c3d0-4f37-9172-31d62792deb9", "comment": "Malware payload (XWorm)", "value": "18049060a9799cdc57a513e2ee932e215c0cf50e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185231, "uuid": "c7ccff4c-bdab-433b-b43a-ce392341cb29", "comment": "Malware payload (XWorm)", "value": "b464ae91f96b41f5f48578d441b4c55acfb731a8102fa4a83cc80cc871eecc9578c3311807f211db19267ce2ac538fe7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185231, "uuid": "8262f145-11c2-4f3c-ae19-a106e0b85a1b", "value": "T1098597778FB40C81E5B07F7E8919D42DEAA0CC17AD43306A79B5CD50FB7AA920121E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185231, "uuid": "6c9216a5-7bc5-4fea-9cff-a2cd36dd7c08", "value": "96:M7ADCmfg11k6X1uNEGKQjVkJnFS1H1kyvlcd1LX1uu1kIMkNASgRa2/nnJCfnBZT:nCFglNEGfVtCmOgRLAXkRf9kOweAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185231, "uuid": "e88876e3-e40a-498e-86fc-a183f0fddd75", "value": 1765283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185231, "uuid": "4269d3d2-08f3-4201-8f7a-72d68086f619", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185231, "uuid": "b4268d60-895d-4120-aa66-7063d0e326be", "value": "shipping_doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cdecc7-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784228202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228202, "uuid": "0390f719-5567-494e-986c-86ef54edd90a", "comment": "Malware payload", "value": "820b513ae5601e4f9530948fcb44ddb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228202, "uuid": "541f4f5f-5bad-48c7-a1e3-c3294dcde11f", "comment": "Malware payload", "value": "64f6c70e65047b0bf410a6954eaa78a6c09a81945c21ff5c157674a066946607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228202, "uuid": "00e36ebc-8fec-4ab5-b2ab-765537815b0d", "comment": "Malware payload", "value": "6930a269a446dbdddeb3d9bbed347152d472c7d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228202, "uuid": "becd46cd-f9c7-4054-83c5-f4bb7845c6ba", "comment": "Malware payload", "value": "ed2a7a7ea1b8a6f0995e4f2d5e56c818080354c240fd1497b6d4d8f2875456d6d303342cc22b4702ccff2232a3fbbfc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228202, "uuid": "5ca752c6-f95c-4054-a900-289f6d5b2101", "value": "T1C4531955B9829F46C5D1227BFF1E834C772B13F8E3DA7213EA152F61378B52A4D2A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228202, "uuid": "afc2dc13-3ae5-4ef2-8020-913d3dc10b6f", "value": "1536:ZHrM9JJMFDgjzxwdKTeH6bHr1ghD3VNSSDwZ7+FFnngFA/Q:VQHaF6KseuL1ghD3nScCSFFnngF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228202, "uuid": "8c27f614-d78d-408b-bb79-086951d7bea9", "value": 63572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228202, "uuid": "0db75dce-f5a8-4df3-bb1c-5ca701788912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228202, "uuid": "6c606956-2a35-4367-a0ea-53c0adeaf5aa", "value": "E87z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74c5ea5-80dd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784182625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182625, "uuid": "e8552066-a087-4ed5-90e8-593d81f37dec", "comment": "Malware payload (Vidar)", "value": "c3583c597398d03fa00a450c2dba33c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182625, "uuid": "cbb501a8-84cf-4fb0-b9a1-e9465b8d29c1", "comment": "Malware payload (Vidar)", "value": "65557ee0fbbb4979833666f2f8265ec7f39a855ec286d1cd9bc9da6ac803a1ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182625, "uuid": "6fa89114-2ae4-4432-b76d-ec601b8ed742", "comment": "Malware payload (Vidar)", "value": "86cf4455dc10784c4f71d6d809af7c458e557759", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182625, "uuid": "c7c18da0-9ed8-4a79-8f37-aa96b67ce0a6", "comment": "Malware payload (Vidar)", "value": "211cac1ed57580a2d5e791a3473b088ffb57b58eec72c5a19a2fca9b7bc6829414521c8fe87cd60e701ae1a0dd599dcc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182625, "uuid": "4d4cb446-4813-4c83-be43-51dbc7d109e5", "value": "T1A4069D47BDD04CB6C4A993328DAA12427B7CBC1A4B3323D72EA07A762E727E15D35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182625, "uuid": "ac9674dc-2845-4178-99a2-708d12345d13", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182625, "uuid": "2132c211-e222-4523-a477-65204bb9bcf2", "value": "49152:DKzOzlQeRSTK23fDl31T8MhdKFdETkiwsS+EXf:DEtPDl3v3hEXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182625, "uuid": "738ed4ef-6075-482f-8a68-ceb3387cff76", "value": 3663480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182625, "uuid": "a764bbda-217b-4e12-ab4f-2cbb852d3a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182625, "uuid": "dd8880f1-8674-407a-af98-4370d555b532", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e1682b-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784185271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185271, "uuid": "1db6ac66-0676-441f-bc21-ca41616b71b1", "comment": "Malware payload (AsyncRAT)", "value": "c8204400ea6f8ab29861f0f91e5dc4d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185271, "uuid": "a789722e-933a-42e5-a194-5d5b979e8b13", "comment": "Malware payload (AsyncRAT)", "value": "65b8743fc32646c20d09b6a6a8e907a963b09d2de02fe5c886753833c6601ce6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185271, "uuid": "a6e0c419-d388-4a8e-976b-c889bbf7344f", "comment": "Malware payload (AsyncRAT)", "value": "f686845327965115398adf8611b765e94e363355", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185271, "uuid": "c6d2763c-d300-4830-b2ab-6fda5cf241b9", "comment": "Malware payload (AsyncRAT)", "value": "9a1fb78b1298ad269690d9e25c581de8707d4c4d43cacefeeba312a0659a980aef84804b6943f2f54e3bbdd110076bfe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185271, "uuid": "4a44a732-48fd-471f-a7f6-f9117e704cc2", "value": "T1D8242E40A6C0AC5493EB1F7B760FE0F9FC6E38D925A899078158F8D1B4B4646FCE2974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185271, "uuid": "a9b30910-7a4c-46e9-be03-0367409745dd", "value": "1536:5xTtqfy/kXXE1LQa0t0wxvdAiLlsbgGs7t6bX5ptT+bHtL575v87dK7qO2nVNyYh:5RH4Ui+kYs87Etn87dsqHjOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185271, "uuid": "5dd6d62e-d19f-45c8-968e-c5cf876df103", "value": 213846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185271, "uuid": "7e34d3f3-227d-42e6-99db-4333e6494990", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185271, "uuid": "c03c6bec-1987-4534-9623-4d4f82e6ff6e", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec94919-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212890, "uuid": "ee3965e5-089f-4a06-acd1-b485079f1981", "comment": "Malware payload (Mirai)", "value": "c69ef9f79d32bf57c8363496f024f051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212890, "uuid": "b3a2db25-1380-45e7-ad13-47fc07e59ac9", "comment": "Malware payload (Mirai)", "value": "6617d049b749fd636e830e61fb0224d5607a36bab87a66ae25ed435c31b912f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212890, "uuid": "c7235f99-4d16-458c-8d50-84e4142016e9", "comment": "Malware payload (Mirai)", "value": "003acad99d32f4060b620e474d787781ac8a4929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212890, "uuid": "5b6fed8c-c27a-440d-8221-8fa575400aa7", "comment": "Malware payload (Mirai)", "value": "3c8cfc754e85d105be78e15b138d00670d947ffc1609f3effd01a31a024e9a86416518def7197a3e764d64e80e279ff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212890, "uuid": "e6776aea-88a1-4dd4-9259-15c4ee47c311", "value": "T18AF2E12121DF3AE2C7F20834D27C0BE157736E3F51DB3476226007B5E9C515AAAB8A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212890, "uuid": "d9fed0e8-a120-4b8e-b31e-0b500b2518cd", "value": "768:c8kUDTbWxEjdLm8rmUw59ryHSk3goqvis+tUcHrZHs3UozC:c8kUDfIEU8SUAF5k3VicHrczC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212890, "uuid": "91ad6b7b-2910-4e4d-b1db-303d4549bb15", "value": 34692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212890, "uuid": "10c5f647-5f07-4f7c-9187-cb1f53ea5c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212890, "uuid": "081cf374-020d-4c10-9a1b-38175d3dac64", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0455c537-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784186082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186082, "uuid": "85576d6c-f26c-4310-887a-d94f23d82b7a", "comment": "Malware payload (Formbook)", "value": "7e1ec887d90ab19dc0dc904a5776183e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186082, "uuid": "2f917498-a3fc-4142-b247-4fb759f95589", "comment": "Malware payload (Formbook)", "value": "661d1021413c4bbc8d23d7969a38f2cc51deb7b41f4825e86f8066eece39eea9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186082, "uuid": "8caf4830-8567-49d7-96a5-152ce67a8501", "comment": "Malware payload (Formbook)", "value": "269bb8017ff20246371328b814c9527efe72e278", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186082, "uuid": "61d4ad2c-d48e-4f5f-b51d-77a187256e9d", "comment": "Malware payload (Formbook)", "value": "0d3a5ad435e01ff4666aa41dff1882897350acff26d19a69aa5a9bba079fbd0a9056d34603a9c853f5d0e8ff73325080", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186082, "uuid": "be961037-6810-4cce-95f3-03693a72b24d", "value": "T14DA5F2644BC42F7E8AAC1A14D17F1AAEF3E14A8504676CCAFF337D49AFA970051271B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186082, "uuid": "7bb9825f-2ecc-4f3e-a47e-69a9f4bc3b14", "value": "24576:GGzmpfdaHWUW3rfB0Vtjlos3C7XKShtYwlBd5PoLOhjUhddGOcWNmumM/ny/318d:Bo82N8hT3GAiBrphjUhVFcz9WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186082, "uuid": "a14da4a9-d890-44a7-aa87-5235757083e0", "value": 2152030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186082, "uuid": "294f5e73-d883-449f-aea0-3ffa75d6c309", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186082, "uuid": "02d69539-76c5-49df-8fb7-6286f3d32ae6", "value": "AWB No 81245134005.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc71abc9-8164-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784240615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784240615, "uuid": "4e9c241b-7157-48c1-813c-40d03ed6f055", "comment": "Malware payload", "value": "f7e5cf04558486e5e7d0f54ec102d061", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sicoobnet-menucooperado-com", "colour": "#F737AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784240615, "uuid": "7d3eee7b-c5cb-4b35-b308-d8c4f1b7701f", "comment": "Malware payload", "value": "668c3ee84885c653d4b9a87676e3e10f5888ecd72ddbdcf2373823032f4c58a7", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sicoobnet-menucooperado-com", "colour": "#F737AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784240615, "uuid": "4f34bd9a-8bbe-460d-b344-8bf4205b5f12", "comment": "Malware payload", "value": "b2e2062ef3315cbced347f5d83fe3c0eff5e4af6", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sicoobnet-menucooperado-com", "colour": "#F737AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784240615, "uuid": "0d157d67-25d0-4f46-b845-6be5b6cc3482", "comment": "Malware payload", "value": "eee6efeb8fc5981f657cf790b34300cbf88fea4cbecfd5ead73aef37b087b632e3ee1ca601594b5e0e6a4d31d24dae5f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sicoobnet-menucooperado-com", "colour": "#F737AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784240615, "uuid": "d6956954-76fb-40f4-b96b-289ab3532365", "value": "T1DA7733CC42A4E458EAF5EB3434F7E1C45DB3E922D726761C0457DC8A4ADEE26BE403A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784240615, "uuid": "ac5c7ce4-4eca-4005-9975-e09bdd7a09b8", "value": "0a274bd307be6658e9f8db2906d4022b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784240615, "uuid": "c267a9fc-71fd-4ea3-a17f-3161135b522e", "value": "393216:QpsDjLEMQEdhRhyFygSLFTWhawzHW/nJJCTXXy:QpmLldhR8FygEFThUW/nb6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784240615, "uuid": "fd144d60-a1c9-4465-8c83-94ddd9035e37", "value": 33080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784240615, "uuid": "15328174-5b65-4260-917d-101321b352eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784240615, "uuid": "295b8975-ed81-459c-ad03-9b0a296bd85d", "value": "avutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b065ffba-80b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784163608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163608, "uuid": "ced70bb8-9540-4ed9-b123-3c64887303a0", "comment": "Malware payload (GuLoader)", "value": "855a7d9da970dd7004a886c91bfda171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163608, "uuid": "aef1698a-0717-4c44-b7a2-f535a654fcc2", "comment": "Malware payload (GuLoader)", "value": "66a1be3919f3f23710ebc6d58daf04e5abd52490f4a95993cea670cfc2314809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163608, "uuid": "c05cef05-ef18-412f-bcdd-e4d6693fe9b6", "comment": "Malware payload (GuLoader)", "value": "d7547ce372b2c0a25439f77ad98e1ddc2d5f1eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163608, "uuid": "edb5a092-6e76-4d75-a091-1a565db62844", "comment": "Malware payload (GuLoader)", "value": "6a3dab73ec5c46f8ca423238bde3b48d5d78d599eea796704e18662e4d84e6737a5ec504e8b32968ce21359388dcc4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163608, "uuid": "e8208f67-534a-4190-84af-b96562b65248", "value": "T1FB9412962690D727C3761D76F954D6DDDBACAA10A2B49BA313F03A4FB832EC5440F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163608, "uuid": "ab5c9260-2054-4ac7-b3cd-6543ac1b3fc8", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163608, "uuid": "2041ada1-1a02-48eb-8268-d26ebe882627", "value": "6144:lXsKoG8pL7qzqAeYyEM5zVPZI9PZY630ExBGogd6MOjZaM9oQEfj7S/fNM/f6HxZ:lXuLsq/DIVv5cdDO1aM9VGe/m/UDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163608, "uuid": "f622ef39-255a-49a8-a3de-c96f45f7a088", "value": 428280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163608, "uuid": "2b6e1328-eae3-4f43-afc7-0595097dc330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163608, "uuid": "6769423d-ddde-474c-9b7f-0e5ddf064d64", "value": "rMODELO1112T2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181013f9-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234649, "uuid": "3f2d5196-361f-4389-8b17-008aed1599a2", "comment": "Malware payload (Mirai)", "value": "ab8106d71b3938534db6b1944cec1ab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234649, "uuid": "e80a6f54-52ab-4923-bfe6-06ec2fe69116", "comment": "Malware payload (Mirai)", "value": "684e755b7ea16c78a289a5978b6032f6175d1b4f21e0edb37024cda4ef5f6db3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234649, "uuid": "8d658b0c-18ac-4b51-bc30-8d8a4b0f46fb", "comment": "Malware payload (Mirai)", "value": "f9649aca97f506905bc486a655801de64c9efa74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234649, "uuid": "ff308e3e-210b-479a-a32e-09e8c801cfe5", "comment": "Malware payload (Mirai)", "value": "8fd739d445ace1c48f7029d9b9e4d44774a58e3f3b5c7614069959b5e047dd7a4bd39516e2d7b18cbd9e540ed6642e82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234649, "uuid": "4fbfa2ca-ca61-44ef-97f3-60255b152c50", "value": "T153B34BC4E243D0F9DC560534213AFB379A73E5BF212DDA43D3A49AB26C96AC1D40679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234649, "uuid": "b37b27fd-cd41-4024-a8aa-dd6b10ad4538", "value": "3072:1d5qGekwumbRajd24WUZTW2MNdfebx/S3HEdq:v5qGek6bRaj46TWXGJS3HEdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234649, "uuid": "6ce27472-d776-410a-94e7-4f8b4747680d", "value": 108148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234649, "uuid": "2d04a355-378f-4fa1-a81b-fba4e4856b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234649, "uuid": "a9fb7e21-f064-4388-a07e-dcf64d2b7378", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365f1e8d-8158-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784235129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235129, "uuid": "99719576-3db4-4725-bfb8-22829ac083b4", "comment": "Malware payload", "value": "477e61c9e15a88f76018db834f1253b9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235129, "uuid": "da623718-aa7e-42ef-b977-83cac6eb78ed", "comment": "Malware payload", "value": "68be590d06682b13e8cfde3321b65500c33cb09011d05436f52a88bcaa4fbdab", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235129, "uuid": "abb99690-bca5-41e5-9cce-0026ca42959c", "comment": "Malware payload", "value": "6e9cf23678a041a0a9bed9b03fcecec6b0812c69", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235129, "uuid": "19131a7b-b0b8-458f-b341-15708bc70aee", "comment": "Malware payload", "value": "f974d4b5d86ddc29e56e889b3edb08d514466a5b5cafe46d48a932a5f066a36959927ba46af93569b8670907705fa50e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235129, "uuid": "6c84950d-4093-476d-8051-89987cd81062", "value": "T13CE633487AE022FEEBE3803EECE11515E659B8724332C95F4B78D3969E231914D39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235129, "uuid": "3b2eb420-cedd-4f54-920d-0674ef2a757c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235129, "uuid": "286241c9-52f0-4703-9184-fcfcf116c7b4", "value": "196608:IMExGUFvvw0fNXeeLgOm2PrFDwXMCHGLLc54i1wN+MCPPIcu9KYK39sI3PPGTMr/:INGUW0fZ3bwXMCHWUjX4cuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784235129, "uuid": "b44b1736-0eee-4180-a877-5709be4487be", "value": 14248577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784235129, "uuid": "787c31a6-4321-4c5d-9a84-705cffb2e945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235129, "uuid": "8279d60d-c27b-4177-9574-58b43350a80e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c6a595-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1784227927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227927, "uuid": "0c387739-66f6-44d9-8bae-47e972e1d190", "comment": "Malware payload (DarkTortilla)", "value": "1f017ca7bcdae763c27483193017747a", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227927, "uuid": "c351616b-6979-463d-8912-3b82d33636ba", "comment": "Malware payload (DarkTortilla)", "value": "68c9207a1e4e703b897300fc6c21cf0472549b352d80a64259e21ed4fdfe63a4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227927, "uuid": "d8d57ec1-fadd-4319-8121-ea2d2adfbacf", "comment": "Malware payload (DarkTortilla)", "value": "54f998f02bb83c71a0746cd38ca8203ed9a90a3a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227927, "uuid": "767d935e-48b9-4436-a2a7-74c0fe587eec", "comment": "Malware payload (DarkTortilla)", "value": "4029d8374355e81075ba8421d484fd7950d278b044940675a6f0d59a27dcaef8c4ad52780bf09d840f45fe11355ca677", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227927, "uuid": "8cfd55dc-a110-412c-a25c-e2187d9acb92", "value": "T1BEC523720DC23758D96C0D34C06A19E473F18A4BA659D73F2EEE03E85E6378B5B16932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227927, "uuid": "9946bd1f-9d16-43dd-8f7a-698bba18a660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227927, "uuid": "8a78c97d-005a-493b-8c31-06dccae73571", "value": "49152:NFckZiri43iGdQv//NbCyhQnozoSN9+94KooHkARiab:NFciirX3RdMhbsSN9+DoBRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227927, "uuid": "63c2f544-9622-44ad-b048-78bc79df21ec", "value": 2509824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227927, "uuid": "63f2f864-7b8a-4702-bf6d-6ffc866147ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227927, "uuid": "74c979b4-3bec-43db-bb52-2a958f25a704", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9cc426-810e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784203410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203410, "uuid": "7ea5a243-13f4-4a7e-9913-dba7d21363e0", "comment": "Malware payload (Mirai)", "value": "e36e627a7f1d4abd40a8447af7d98506", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203410, "uuid": "6ad9060a-fe17-474f-85ec-c46546910667", "comment": "Malware payload (Mirai)", "value": "68e92d574e14e3a478884ba7624395b3f1a2eb7f9f88932c6b92e696008fe29e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203410, "uuid": "9415c53c-b0c9-4f40-b777-06586c3d389d", "comment": "Malware payload (Mirai)", "value": "7987079e935db139ed922dcc309fda9f913f533a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203410, "uuid": "fa21d7fa-7622-4ae4-bab2-656f7cef5614", "comment": "Malware payload (Mirai)", "value": "571963522a4efc1aa15ec5c2f31e289ba88593055ffde8eb419e0bf2c78ebf4ed1d00a2b62727f086c0e4d7c8f52ea9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203410, "uuid": "4331fe16-54c2-4143-837e-d1d5e2a2c3ef", "value": "T154C3F185BB6369D1C06242FDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203410, "uuid": "4be63239-088c-4756-bcd8-d12f5498319e", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnE:0OCDjXG9qTWywxlxTnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203410, "uuid": "a1244f8e-3b80-431c-8660-a222af184512", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203410, "uuid": "25310d6b-d678-436e-bdf5-6e9e91fe9d1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203410, "uuid": "773705fd-9ee1-4f0b-883a-f1749caf6133", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2344f6-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184918, "uuid": "323f699f-0bc7-46ab-8f41-56db0378ba22", "comment": "Malware payload", "value": "ad9429e373622b486589a4129697d2f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184918, "uuid": "cbdf993e-9eb5-48d3-b2bd-be921ce0ff91", "comment": "Malware payload", "value": "6a91f2274edb5396ca708a0ee14689cf3ff44a8c19b392ad192e4bb0dffa0a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184918, "uuid": "18beba32-4789-445d-a7b9-08910c732617", "comment": "Malware payload", "value": "4083d0bb11b12af8b725abdf9f64f2051fc05bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184918, "uuid": "1355641c-054a-481c-af2f-26d0d65a8d06", "comment": "Malware payload", "value": "b333a86bba7ab0b917dacd7d75159f1ad04b52a0be568395ed901d9762c2299a29cfe40e74a9a13d746f688eb874b6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184918, "uuid": "5e76c366-6ec5-4581-bdcc-88993ab45144", "value": "T13215120282E98437E86CA77058F70EDB0630BD126D7967A757C06D972CB3A84E97173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184918, "uuid": "246db1f1-cef5-4edb-b5a8-75559422ba21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184918, "uuid": "20fe240e-0bf1-479c-beb0-d38cec8829af", "value": "24576:cBhUSx4QP3ZFb72XPwIA1gqf/F+fgXadJ:cBhza4ZFb7anA1gyggXeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184918, "uuid": "d15ce57c-5f3b-4056-abce-488f65d26919", "value": 884483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184918, "uuid": "3e901484-bfb2-4f4d-81a1-ad814dfd9569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184918, "uuid": "27c5d419-6927-4b7f-b754-fa9323c5a7c2", "value": "hilton.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de8f059-813b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784222606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784222606, "uuid": "611ee368-2dc5-45f3-bbc5-c28786b7a652", "comment": "Malware payload (Mirai)", "value": "030ef95bdefb3c5c0a1f8016e010dad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784222606, "uuid": "8cdac7ed-40a0-4d08-abe8-46367c4adc58", "comment": "Malware payload (Mirai)", "value": "6af59b072f8d9103b9c50daf09d002c3557287f72df31902621fbe1fe32b6de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784222606, "uuid": "a15f90f1-90a1-471c-9996-06fab8b8ab6d", "comment": "Malware payload (Mirai)", "value": "d2120c218f31a70bdea8af046d35cc502f1f33ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784222606, "uuid": "d4cd48a5-5fb4-4767-b4a8-0cfc23526ca7", "comment": "Malware payload (Mirai)", "value": "7057930632c4dfae69559834d6ba5e5c3543039a07dbc3dd737b54f8cd653363d35d457d3ae0f0cab241cfb3cc08ad67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784222606, "uuid": "84e51430-4445-47aa-b1a4-3c37ae1ecfb2", "value": "T1B7E3D50AEF601EF7E86BCC3705B94B0A24CC655722A83BB57574D528BA4B54F0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784222606, "uuid": "dbaf1942-91c8-4883-9cd4-e5db1e072651", "value": "3072:O0hzn6/CgM90/uYD2D8U/WI41y07/hS5trYTtpnbR:JhWW922v/WI4wM/hS5t0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784222606, "uuid": "4e2290e1-feeb-4a03-9f40-4a1280963cdd", "value": 149868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784222606, "uuid": "02aff9c0-9358-4f0d-9df7-2c5a5d59268c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784222606, "uuid": "c3575394-e347-46a7-b412-94a0e9207592", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b81c48b-810b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784202093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202093, "uuid": "8d56617c-3799-42e1-ad16-ba1cd3fe7110", "comment": "Malware payload", "value": "0ef48ff27d3d493d11c953e2572a63fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202093, "uuid": "b18a9fc8-257d-4da4-8a53-edc879394d0f", "comment": "Malware payload", "value": "6af897100a59e2259c0cb2236b1b586521d6cc7019273122f11de7ee912e648a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202093, "uuid": "d3714d63-b720-47ab-93e4-f2e54afcbe71", "comment": "Malware payload", "value": "54799cf072dfb0732999833df9fbc9764a2a2808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202093, "uuid": "52f33415-7bb0-41a9-b902-d6f78b0b90c2", "comment": "Malware payload", "value": "546cb10c7ae39f1853d5a4ad2107bbd29f7eefc3b961099439fe318e1979cd6e780ec57b306b9df3d7804d1d0a361f24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202093, "uuid": "68d613f1-629c-4748-ab14-6676bc1e4969", "value": "T18FD63A63E8EB5694C4EE8570C772817BBA713C491B3823D74390F3246B36BD0AAB6745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202093, "uuid": "f10706f6-0131-4154-96e3-51266b2dea69", "value": "98304:3s/UITIuD5NfE41RKYq7QXSG42YaYD/EypZlqEQNWEZ:3V0IuU4WJ0iG4d9/GPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202093, "uuid": "e3ade6e1-17ea-4aaa-9161-ee6cdb643ca6", "value": 12894792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202093, "uuid": "f0950dd8-8e93-43ed-bdb9-19c95d4fbaed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202093, "uuid": "6828cbb7-56ec-4a1b-8a50-6b640ff5e373", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635ca105-813e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784224038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224038, "uuid": "d9841e0f-65c6-41f3-b07c-99e76c326eba", "comment": "Malware payload (Mirai)", "value": "b0d99d31fc96de521e14c302b495aac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224038, "uuid": "b8d56bb4-35ee-4504-8b35-c2493ab4ea16", "comment": "Malware payload (Mirai)", "value": "6b1ca6ea2ca6e455b56bcfc9e34a977a97db61751eafe91a256e92adff3563ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224038, "uuid": "55910896-2a79-452a-8430-08e6b648202c", "comment": "Malware payload (Mirai)", "value": "8b44c818c27d12fbed37b44877b024468b2c19e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224038, "uuid": "c1af1589-16aa-4bf9-a2ac-f5fa9a0aa806", "comment": "Malware payload (Mirai)", "value": "99a9dab45461514c59fd5ca5378ef0e86371f002ae970e05ff390ef2205d2a5c968aa7c33c728bb0db058715e93a4ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224038, "uuid": "52880f8d-79b5-4f37-9acd-e1b179ba36be", "value": "T19FD3B021E4006DD1EC2129F578BA96B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224038, "uuid": "7216a154-afb1-4ca7-b502-49b5684a2f7a", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xB:PiySSGp+PMmT7zMplf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224038, "uuid": "015d09df-e569-44ab-be55-324898e03009", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224038, "uuid": "5009217e-f2ec-4249-8d5a-899104eed178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224038, "uuid": "3b3639c7-41f7-4e18-95ce-5866fb271277", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ebc8a0-810a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784201626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201626, "uuid": "80b99638-eeb1-43a8-8a9b-4ce9d6cb6f3d", "comment": "Malware payload (Vidar)", "value": "0fc339a37e6d284e638cf0fb412da54f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201626, "uuid": "9c129729-7c0b-4953-bfb8-700d87096190", "comment": "Malware payload (Vidar)", "value": "6b2436670aa26b8f98c55c833fd48b969852df0ee648e4d5d256ac3c8b6ccf66", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201626, "uuid": "ef6877a7-9c40-44ff-b76c-cafc29c3ebfe", "comment": "Malware payload (Vidar)", "value": "d9c55600ddd89181cde2846dcc77cf929fbd1dc0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201626, "uuid": "1e3e7c36-17b1-491d-a11d-442ca01da487", "comment": "Malware payload (Vidar)", "value": "b6d7952fd03a7cfbf2ae8c008954f721d29ed80923a11851e2ac665b8e461c2f54412735349528e9f338fc1c3732bf79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201626, "uuid": "bfabe980-4cb1-4cf7-a0a0-386c64ee7b91", "value": "T162267B07FE6508FAD0A9D73188764242BB74BC4D4B3223E72E40A6782F367D19E79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201626, "uuid": "d112f1a0-2a99-4612-98d3-6614a55c54d0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201626, "uuid": "ab5e8d1f-fe72-48fa-8047-ef18e1b858f1", "value": "49152:vMAwc0xPLMxt7kneONczktILKjRCbzlTA+02Db7nlA/6gQ1cywwcls8ejIubdxge:vWQ+klTAEjG6WxFX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784201626, "uuid": "2cff7132-eac6-4f74-a544-d587ba18ea7f", "value": 4469088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784201626, "uuid": "d82e904c-13bb-4aac-a28e-06494a8661e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201626, "uuid": "f39ce812-822e-4349-80b3-1af656e01eec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfb1dcc-80b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784163631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163631, "uuid": "5533af21-cd79-4dd9-9857-c0a0e3859aef", "comment": "Malware payload", "value": "a00732bf12114e48b243856ec330d6ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163631, "uuid": "409d6059-b004-426f-b8fa-7ae73e38866e", "comment": "Malware payload", "value": "6b2ccc31a86aba2dc917bda60e4baaaaa918292e4c322b3af08c6f4e99604348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163631, "uuid": "52a1045b-35c3-4819-997f-e146e5914961", "comment": "Malware payload", "value": "192f86c081311be78825b27223033aba2196bf2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163631, "uuid": "9809bc5f-6350-4b85-bf42-df706f3127a3", "comment": "Malware payload", "value": "766be59da883bcb8c5b97ef2f03a38d7d354a061070539322a9cd7a0640e6f24d2242e950ad63783b281b5dae970c7ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163631, "uuid": "806e5e58-ef13-4234-93f5-c61dbf4644dd", "value": "T1E3A67C73945224D8E1A9C9B4D1141652BDBC3C8B5738A3C7BAC471F65BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163631, "uuid": "3c685058-26a2-4166-b1cd-522305eea3be", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163631, "uuid": "14c91961-2251-40f7-9981-4d7c02156b85", "value": 9830400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163631, "uuid": "9830b913-8ce3-4e31-bd62-a207fad1b9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163631, "uuid": "de7a6cf2-a127-4104-99c0-dadcfd8fa109", "value": "6b2ccc31a86aba2dc917bda60e4baaaaa918292e4c322b3af08c6f4e99604348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd04c2b8-8144-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784226872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226872, "uuid": "4f0be0ea-5870-4edd-abef-428bfed98dfa", "comment": "Malware payload (Mirai)", "value": "1779fe0438158ffef276179efa36b452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226872, "uuid": "aeb05563-e9c7-470e-a9a8-f8a89953edd8", "comment": "Malware payload (Mirai)", "value": "6b3951e7d2d767f29a2b97227f308393ef6dc94e09cb434758b78e389b9ab6b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226872, "uuid": "51deb9e4-041d-402f-8837-a2512e8d9f68", "comment": "Malware payload (Mirai)", "value": "8a964175a76e6ee6a993aaccdc68b54030e9c676", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226872, "uuid": "2074ad1d-d0b3-4dd8-8879-69cd40a0494b", "comment": "Malware payload (Mirai)", "value": "7fc3945ddb1d876af43c2717b8f237f3310e61fc013efcd62bc5b0acfd43b289364e2255d30678a11fa46ee3153aaf82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226872, "uuid": "b6221bfb-2c52-4f43-9c68-4a991ed295ae", "value": "T11F6301CB6DA02B66C0DCA1B5707815DACD39DD8BE353869C97E1A7A60B3853610C8B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226872, "uuid": "b75a7f12-ce7c-4be8-8645-6935546db254", "value": "1536:6axZLmYKVDNSl2y08yumeJyGYVmIMGMuNu:6axZLmYKX+t08jmeJhYTjNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226872, "uuid": "b1791e59-c5f6-4889-90ae-5ea87424794f", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226872, "uuid": "51fc877a-50f1-40d9-8341-c2c30d3c1d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226872, "uuid": "6c0f6371-3160-4e17-810f-e917e86532bb", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e727d7-8146-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227610, "uuid": "479abbda-d577-473f-9239-77570c3a1955", "comment": "Malware payload (Mirai)", "value": "3daa084242bc3b2cc05c57f0e74fafc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227610, "uuid": "4a8d7eff-710e-4769-ade7-c088f94c51fc", "comment": "Malware payload (Mirai)", "value": "6b5e91eb19e0f80778580db5eb53867bf19fbbda97adf88fe2185a2b177348ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227610, "uuid": "d6dc4787-eec9-47ee-a1bb-ae2ac628a41a", "comment": "Malware payload (Mirai)", "value": "00d307e1d8e53ec988fb41631cf321ed79a366d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227610, "uuid": "898dac0b-0459-4252-bad7-c949602ff397", "comment": "Malware payload (Mirai)", "value": "4fde858e0c05fec2a44c9ece5ba7de213f72a0d6aa7f7cd25caa2408c5ee3c1d0c6d38a716f05b5dfdab68b96d529f3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227610, "uuid": "1a8a7273-010e-47b7-8573-5a1288fcce04", "value": "T1B6B31A59F8D19A22C6C616BBFA1F42CD372663A8E3DF3117CE156B20378752B0E6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227610, "uuid": "74249ac7-99fb-4a1c-9583-17abbc5f837a", "value": "3072:qpsZqaPX785R91r50yKj0pQZ3wJJPoM42nb92:qpUqaPr8zb50H0qtwnoMd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227610, "uuid": "5fc21081-c085-4f8f-b0a4-801cb212604e", "value": 109360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227610, "uuid": "86f0f39f-90b7-49cb-90ce-afb32d11eeda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227610, "uuid": "ad7ec800-b1a5-4036-9b88-aee3b7852681", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76932b99-80da-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784181120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181120, "uuid": "b453a51e-0dd6-40ba-a97c-5d98de647f11", "comment": "Malware payload (Efimer)", "value": "e49b2e329cb908c56c54a10a8501326b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181120, "uuid": "fb520fed-343d-43a3-a3d0-24fdf6a98df1", "comment": "Malware payload (Efimer)", "value": "6bf54a8dee6ec116eed8831c65af0192c4c6dcc593506bbb4cc4285392b29ee9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181120, "uuid": "4b86acb0-59a8-47fe-a885-5186798af322", "comment": "Malware payload (Efimer)", "value": "040072a6c7f277a537c87311251a5d9527a1a354", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181120, "uuid": "91956877-964e-4a19-bd35-f0decec8d44c", "comment": "Malware payload (Efimer)", "value": "067c3f52208ec54685d21b5f903f00f6bd91474de345076a82409834d6fae27d4ba5c14b5b54a0bdfa096409ca66d500", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181120, "uuid": "3ee5d2c5-3cf2-4fcb-aa07-46f5b85c4cfe", "value": "T171E6330473D012EDEA72913CAE704596E6A974F40B71D4DF47984BB1AE472D28E3E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181120, "uuid": "f61c3560-df31-45a4-b2b8-580eb2c65413", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181120, "uuid": "7ec1b998-c253-4991-b7ba-f470eea99406", "value": "393216:G5UnPcnp1t/NC7shChKqke9IfXMCHWUjX8cuI3/PGTAI:G5WGrcshCCrfXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784181120, "uuid": "1d5f0a98-31de-456a-a2f0-9e830d38486b", "value": 14335200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784181120, "uuid": "1452a9a4-292f-422b-97be-e6e79dce0299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181120, "uuid": "a11f2ff7-5f1f-4b1d-8667-1b4c8bccc8c9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cbaccd-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212786, "uuid": "cf1ebaa9-8991-49c3-ba32-37048caa8933", "comment": "Malware payload (Mirai)", "value": "f790b0e18163ff70d3651034cbf53b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212786, "uuid": "60bf5ab8-633b-4352-97d7-dbeab5482a1e", "comment": "Malware payload (Mirai)", "value": "6c25e48f7785d58008700299cfd43b95e1c0dabc4ba8aed6ff03b7b835df73d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212786, "uuid": "0fe11dc2-eaad-4bc0-871c-f6b6f030b957", "comment": "Malware payload (Mirai)", "value": "aa47b214d5c5c0b4dca26ab25686669474628b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212786, "uuid": "7a5f003e-0193-4dcc-924b-d845ebe29e58", "comment": "Malware payload (Mirai)", "value": "30b47db2087fc4012c9f23103cf55dbb8111e2a3c20674bb83774f4b9cef7e83e136c4aeb32af8da9f250be23db1bbd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212786, "uuid": "4deb8a94-8f34-4b55-9a4a-d8e6c5ab14f2", "value": "T115F2E1581B260596F20159F217ED4B932EC80FA38E42EDA86EC5D65B8ED71383C93684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212786, "uuid": "e77277fe-7b09-410d-935d-5e8c0024e140", "value": "768:tlWqYyhCU4f6ToIIaa1phsV2J3jdau1OudfKuhxJgGlzDpbuR1JQ2:2q+jf6THI3YV2J0uzPtVJue2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212786, "uuid": "93e83c42-3e86-422b-ba86-d4e7ea650223", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212786, "uuid": "24776432-4643-4e1c-b2ae-2401e50fe29c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212786, "uuid": "5bfb1317-5186-4d0a-88a3-e1fd8d09b28b", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cc1472-810a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784201621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201621, "uuid": "1100acd9-4b8c-4bf0-8905-01f838c9a12e", "comment": "Malware payload (Mirai)", "value": "a41c7139dfd1027a17b3de36966ede0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201621, "uuid": "73da1cac-132d-4fa1-a84a-279393e29a59", "comment": "Malware payload (Mirai)", "value": "6c9cbc48efff9b01a2c9713f8f31594a3dc33dbfe6c61b713be90a854c82c867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201621, "uuid": "d93413ef-046f-480f-b51d-af572c7e92c9", "comment": "Malware payload (Mirai)", "value": "2ff4aec4d4dad2caed225b1c247816e557ec04df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201621, "uuid": "c0fbbfe4-a11f-4f1a-b58c-7e9d60f6f771", "comment": "Malware payload (Mirai)", "value": "67b055d212810de88390dbc27570aacea0f0499e0cac02ff3ad08168f0ed384e4d34fb058677e2cca5ba989990d759d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201621, "uuid": "6467f56b-6b0f-4286-9aa5-77c8affde204", "value": "T1BAD35C0A79D270FCC687D170926E9F61E63A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201621, "uuid": "29b6b381-151e-44ff-b1fa-4006f357f5db", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQZ:yIRfe3xvvSrlvZZ7UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784201621, "uuid": "b92c3eb8-8976-479f-af25-1c1a8fd58bab", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784201621, "uuid": "1a92ae1d-f1f6-447e-b1d3-fda4e553ce45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201621, "uuid": "c9716329-a13c-42b2-aa08-e69379caf298", "value": "d878272de0ba7e8dec60071a0f43c6ee534d1b43fdc48cb1c7de7f4ca247f9a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1448d0c7-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228200, "uuid": "77e363c1-6ef2-4615-9acc-6d439a9bea6a", "comment": "Malware payload (Mirai)", "value": "501d19737d95f31c850b563796e91a54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228200, "uuid": "96074849-ab6d-4468-b60d-8307fdd3ec76", "comment": "Malware payload (Mirai)", "value": "6ce208711331d8f2e30d4d785acd650c69333ff28b1628bc4188e032ba19d699", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228200, "uuid": "f5d2efe9-ba69-42b4-a16f-675dc5c61f96", "comment": "Malware payload (Mirai)", "value": "d29896a009cec7bdd3428d4404f2298354f644db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228200, "uuid": "53d12f9d-93d7-4d6c-a304-15ece948a8b5", "comment": "Malware payload (Mirai)", "value": "3a22f079c1d0b410aa11f6ad4b04741750847d8cb35c3ce83896942e6e057b2833e6500f52d73194cbc22dc1f15ac417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228200, "uuid": "9ad129dc-9bf7-4436-a5dd-52e6921d55e9", "value": "T18EB32A59B8929A23C6C616BBFA1F42CD372623A8E3DF3117CE159F20378751B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228200, "uuid": "26df2d3b-902c-4681-b117-1736b4a92cab", "value": "3072:AbVw3adn72EcDBG5gKjLEv93JUGPT7nbM:Aba3ad72dQ5NLqpJvTHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228200, "uuid": "bac14fc5-797f-4084-8f26-64f9d4a39878", "value": 112904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228200, "uuid": "3566b24b-18d6-4180-84fb-77be62166923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228200, "uuid": "f61da97e-d6e4-405a-be93-e31d38781887", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df44758-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212888, "uuid": "07c63e12-bec8-4f71-ba93-e244c72b1d32", "comment": "Malware payload (Mirai)", "value": "577855784fea280290a6ce02d0fc1286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212888, "uuid": "344ba12a-1898-4747-95bd-768aad08d0e6", "comment": "Malware payload (Mirai)", "value": "6e9216d14d4293b11b8a514340f48aa8f2ef57dbab7d1b8de44511ed2dd146f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212888, "uuid": "505ac502-b01b-44c0-b9e1-95843146b5b1", "comment": "Malware payload (Mirai)", "value": "32161bd12fb1e441d707f26eb1574ecd251b6060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212888, "uuid": "f4a59a56-8af9-42ef-8f64-4149a69107aa", "comment": "Malware payload (Mirai)", "value": "a6cca28c0377657e80ca5702d54257e81b334750278711be26c2d0eb43e332951288dab6233c073e8f22cf438101f5ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212888, "uuid": "7cea0215-bf0d-445c-8009-6c8e0d1e652f", "value": "T1AC7329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212888, "uuid": "7ac2d212-d675-441e-94b1-e9d172a62382", "value": "1536:z3OL3wr34Qu3EhvOy0sxomQ2FH4ZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxomX4cp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212888, "uuid": "b380033b-9aee-4e85-a830-a58480710525", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212888, "uuid": "e4add701-7061-4623-ae66-6465e4d06b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212888, "uuid": "aaa01a22-afb4-42a7-a148-982fa29eac3e", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba92c20-8145-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227112, "uuid": "fa1c3030-daa6-480f-a7fd-5f8cb3229b52", "comment": "Malware payload (Mirai)", "value": "bcde37387be78ed0ef8665d58f88049e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227112, "uuid": "29ca2388-b529-45ea-93e9-347cecbd776f", "comment": "Malware payload (Mirai)", "value": "6ef17e1b01243b8ea1c981fc8e07b6d5ebcdf1e1d88c84c11803f649ee48235d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227112, "uuid": "a176d77c-5eb6-4b7a-bfa3-a7c7e4313642", "comment": "Malware payload (Mirai)", "value": "56fd77730a782860e306e4569a48510ffbfaf4da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227112, "uuid": "238085f9-6e39-4e5b-9439-5f93e191997e", "comment": "Malware payload (Mirai)", "value": "d5c7eb70c843436b66b696a160baf688b79b47bebf74f1a0ecb57ac7a4375191662efb41addc173ebb5ba665db4827a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227112, "uuid": "53effe5e-debe-4131-93f9-ea7571668e9a", "value": "T1CED38EA89E0E6D83D2C2E37DAC550F73313678B44269C3B61E0092DDE99EDD59CE1523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227112, "uuid": "23a92721-6d36-4be5-b9e5-e2b15f0b3c8d", "value": "3072:udof3SkBeMa3FPa/268CinPKH/5gAqjMXKhRFQo:uirBbaVa8CIPg52jKK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227112, "uuid": "9c4b5268-f9d4-4039-8707-bf3a89e1ed82", "value": 133024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227112, "uuid": "9aced8f4-2628-478a-a1e8-f641c5ae8aea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227112, "uuid": "b961ad6e-f71b-4491-bc1d-62400f0757e8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea06769-80ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784161457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161457, "uuid": "9beecfb7-6201-4275-ab54-14fd0aabd94e", "comment": "Malware payload", "value": "39d0ae50e3220750fc7ef4e99a8dfc5f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161457, "uuid": "61cdc418-4219-4fb2-9232-91925ba1b13f", "comment": "Malware payload", "value": "6f1daa323ecda925f11f3eea0dc4839057dfff2317f5fa1bfc6176c62b951deb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161457, "uuid": "d786a7af-3a2a-4830-b557-2107b5f2efac", "comment": "Malware payload", "value": "58c0c06a59a298176cdb302f97091ef3ed736154", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161457, "uuid": "2a22b7a3-1b6a-4466-bc35-6176fd571a20", "comment": "Malware payload", "value": "ff700cbd30589d6107895c00256612fc054358de445a2203ba762a7ee92b10cdd7fcb94f52f0355511f868fd825ceb96", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161457, "uuid": "c634ae6c-04ac-49b8-8dce-72d0a312bd2d", "value": "T1C04114BBB4B28E30335DC4B9B486294CB7579A6F44266E74B087743C36BC364B178265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161457, "uuid": "6f1df0c0-9bde-4fc2-9ea6-222bd775a977", "value": "48:vkwvpihneZZn1oBydX0P21j/EmfthmmzEvJGU6+gtIIqNTMTCki:vkwYheZZK8gujnFhmmzIl6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784161457, "uuid": "ef5bb99c-61dd-4b7b-b381-91a5a11c044a", "value": 2322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784161457, "uuid": "5d9abe43-3a58-4bec-be1c-86f64791c88c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161457, "uuid": "b8ee49c9-d902-4517-a962-7d25630f759b", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad539bd4-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186366, "uuid": "8fd90421-563d-42b4-a254-6ebf09a051b5", "comment": "Malware payload", "value": "8f031deaa9265927d033689eb52226d2", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186366, "uuid": "6d846390-4f6d-4ba7-8afd-7367775420a6", "comment": "Malware payload", "value": "6fbc7cb0657d196bdaa354d89676c76bb1b0c16aec64be21a82bf957280c3d42", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186366, "uuid": "fb36c839-62d9-4aaa-980c-8d591973685c", "comment": "Malware payload", "value": "519e05a88d0bb90710db0fae545206849148ec09", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186366, "uuid": "b9ad8095-0f6e-454f-b911-a98d13331eb7", "comment": "Malware payload", "value": "9b8ca32f1f88f2460622c7fd6bb96adfae1477609e268a22e6c8a221a2ae26d4512eae90d6fb3f0552c0b9ee1c67dd8f", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186366, "uuid": "05b4ed79-201c-4918-bb60-6f1f5d3ff388", "value": "T1A465E11556943AE9DD3349FC819E04BA7F6BFA6317C202EF3AB841E64B116D0483ED1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186366, "uuid": "f138725d-2be1-454b-9110-d39c4c28e906", "value": "24576:O1ib43SN/pHXeOeGoEtqScjv+ju237qAj:k3UHR5oEtq7gq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186366, "uuid": "d4f75f87-2148-4909-a065-1cd3d0277ce8", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186366, "uuid": "4925c0b8-b71d-48eb-8f1b-8f6cdce74407", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186366, "uuid": "5c51d07c-a5fa-4295-b2bc-e26bca898b61", "value": "6fbc7cb0657d196bdaa354d89676c76bb1b0c16aec64be21a82bf957280c3d42.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2720af93-810a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784201603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201603, "uuid": "43208e7a-7186-4bb2-834b-e8ab8aa2275f", "comment": "Malware payload", "value": "ce8d47c7e4af3ade884d495b931aa60b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201603, "uuid": "37472d2f-ebda-4e77-8bc3-65ee9c318da7", "comment": "Malware payload", "value": "70e142270dd8f86ab3c485716d5376989566623407aa03a896bbc5830e91d10a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201603, "uuid": "25c1c187-ffa0-4161-a175-0dae6ef6e1d7", "comment": "Malware payload", "value": "f35468191e108d20e39ae1a17b7ede5fbf819a1f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201603, "uuid": "66f6d8ed-da51-411c-9421-a57aa0b75811", "comment": "Malware payload", "value": "fe2431fce43a49eafd82ab3951ce0fa9a9932b55563b5dd00952e05c855c061bce17c78fa2565a2a6fe66971b575c366", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201603, "uuid": "27b41d14-21df-409a-b038-89e2865e25d2", "value": "T1DFE3293A665279F8F4915A3FBB9A5729EE5EFA2107A6F46F02D0913F00930355F33A40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201603, "uuid": "567f9e35-2f00-45ef-9d63-8d9ce56e89cd", "value": "59667224ee0313970348dd1811a42053", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201603, "uuid": "41ef4cd0-0c8d-4382-8308-17fc6996d7e5", "value": "3072:bktBcMEgsIONcpPOsVPh6RXQN8HLf+24xskUK:IEIlpLJh6RXQN8HLf+24xsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784201603, "uuid": "3fb81041-adfb-4dab-9734-b5555d5330f5", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784201603, "uuid": "89e93a31-dde4-4b52-b79b-4c530e7dad36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201603, "uuid": "1158418f-d5be-4ce1-a61f-3e2878c96312", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b73c127-80cf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176296, "uuid": "52eeabf3-b443-44d7-8634-a4702125a986", "comment": "Malware payload (Mirai)", "value": "4dc7bf1db1d02513249a0144c24f3177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176296, "uuid": "e11b147d-b207-4a8b-ba48-9afa9da13178", "comment": "Malware payload (Mirai)", "value": "71263bc49df6862e52ffc1c5f096d95055eeb9417db7743bda62b9eeaa425d4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176296, "uuid": "6210d912-93c7-4b98-9b09-450ae027c119", "comment": "Malware payload (Mirai)", "value": "744f9d12e1879713983092c93dcc483563cc093a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176296, "uuid": "ff1f4311-85bc-41d9-a108-1be9ad16a6c8", "comment": "Malware payload (Mirai)", "value": "9af5dd2a3b59e3f142a7870f5dcdace270d4b18a361d415077ab4821477ecf94d34d51c84c89dafa4bdc4752dd1d4dbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176296, "uuid": "0834c9c5-116c-4f90-b14a-23a0a8b8bef6", "value": "T186F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176296, "uuid": "d06d8549-b828-485c-8f10-06c43f288dce", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH4fam:9FJMgWPZr8IaCWReS1WpPed7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176296, "uuid": "b086db5a-a2cc-4b9b-996d-15813902e54f", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176296, "uuid": "6d729f80-74b8-492d-b63d-fa4770f0cdee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176296, "uuid": "7d36ff4b-930a-4a0e-9905-820052925918", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936e6fa2-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185463, "uuid": "3762507c-6852-4074-863b-2a09ef7a45a1", "comment": "Malware payload (Formbook)", "value": "4633da21c13d4730e94ef1532eb34c80", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185463, "uuid": "3824f976-c961-4d30-94a7-0115de258195", "comment": "Malware payload (Formbook)", "value": "71cf474e49c9735824b7c86c9dba1a2e51a9666622ca5340d82be9a505f54575", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185463, "uuid": "0fa8885e-c30a-4b3e-aa66-ca6921b54510", "comment": "Malware payload (Formbook)", "value": "019c7662be2a7113b77d8edec625f441e21e8ba3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185463, "uuid": "2cadd5d2-e515-4f98-bb43-44ecd004b7a9", "comment": "Malware payload (Formbook)", "value": "8cab420f88911f3eeff5bf33b796eb06649b245d92ec0cf2c9fd6798c87ec4badac7e8ca8b95a3dafb338fe25b2a4b6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185463, "uuid": "d5537470-423b-46cd-b1d4-13465126550b", "value": "T11BE53A4283289871A92DD72CD13AEFA8164D601364C9EF5D38FE1328B755F07A74DAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185463, "uuid": "d714fb1b-8236-4cd1-bad9-9b4d2de07c4f", "value": "98304:ZUpF0kIm964C5PMt/tKH8waAiMYseFqQ4FZ0g/oDPnyG9tdo:Zrm96J5PMyraiYseFqT0gAFDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185463, "uuid": "4e8bb3fb-f3f0-4b75-b883-0d61fbd211cc", "value": 3228113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185463, "uuid": "b5d92d53-02d8-4f6a-9d5e-7337df4ca39f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185463, "uuid": "a9ec28a9-c9a2-4ebd-b8a9-287a01bb86f7", "value": "ORDER_NO_2389.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d92dddb-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784184890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184890, "uuid": "107897d2-befe-4177-8b54-4cf342af53ec", "comment": "Malware payload (PhantomStealer)", "value": "6faff1122aee1529d2af1473bcb06586", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184890, "uuid": "032960e7-b2ef-4534-b53f-90e0df0bc350", "comment": "Malware payload (PhantomStealer)", "value": "7206fdafd58d5ae2981c18eb3aede45e8cbaa8c37378c79e9f4598bc6adc06e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184890, "uuid": "258572c5-46ee-4450-a27e-0db229f07a16", "comment": "Malware payload (PhantomStealer)", "value": "1045f1425aeb1d40f48d4e8e6be9b14461bc7fc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184890, "uuid": "952485fd-d7f5-4fe3-9883-882316af995a", "comment": "Malware payload (PhantomStealer)", "value": "1595da80dbe928ad7b089960034e67002b845f6e87e80430240a2dd47e9917732ea2c5e956f2b8778c79f7a2860b0a1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184890, "uuid": "e07976c1-fe3e-422c-95e2-eef22afc7beb", "value": "T1F06596EC0259EFA4916D0F4DDF92853AAF6B4D5C49B7188E701B61C95AC3F3829B0E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184890, "uuid": "39c03d29-22eb-4b09-ae3b-e9e6a7fa5926", "value": "384:TN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1SN1t:KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184890, "uuid": "0f9aea10-49cf-44cf-b0ee-6f853ec3bd7f", "value": 1532199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184890, "uuid": "a55f1572-43d1-4bfd-b509-d94aa467af54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184890, "uuid": "4f7dd013-5f4c-47d9-8daf-d07db3158f49", "value": "ATPI_Annual_Dinner.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa58192-80c3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1784171311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171311, "uuid": "6b3dbce8-ab81-482d-9571-5c1f78359340", "comment": "Malware payload (Joker)", "value": "a4878822e858617daeeac73a5d9f9629", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171311, "uuid": "d6342b99-e5e2-4d33-866d-ac7056276c5f", "comment": "Malware payload (Joker)", "value": "721038816079e39f95b41461f20ccbf77af20bd22b8a6c71da228bdfa9675413", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171311, "uuid": "939dce6c-2529-4714-9f73-dfe172c82984", "comment": "Malware payload (Joker)", "value": "d82cfbbcd997fca26216ce829bd39c0141a81ec7", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784171311, "uuid": "87762f27-b059-4f96-86aa-dab992026909", "comment": "Malware payload (Joker)", "value": "7772c364ecbf2f71f887e9b7a21c67812cfd228de6bc7251675670d9eadc1ef91b3437b49061cf338bf2e874443f366a", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784171311, "uuid": "705083c0-b4a2-425e-8c2a-fb4144dbf3f6", "value": "T1DD57F14AF61CD52BD9E5B0BC8D8B17A3B5667D110A10C18B3821B30DF9B37D49B26BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784171311, "uuid": "61899626-3e8f-4755-b7c4-790c821621ae", "value": "786432:YZY9dYVrRX3FCDZK3bIDoVR3bcxEki+nJcFv4H:Ycd0VX3aZKrI0XgGk4WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784171311, "uuid": "1384c0e4-6fd7-4556-ba40-48a4a3fedd61", "value": 27705804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784171311, "uuid": "fcfed79c-0e5c-465f-a7b6-d4e6f7325f55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784171311, "uuid": "855097ce-e2b2-4e5f-b986-a149bd68dc08", "value": "com.messaging.textmessage.messages.sms_29.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150cf260-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228201, "uuid": "c5a1bf8f-a986-4ee8-842a-35a83b194064", "comment": "Malware payload (Mirai)", "value": "ad2d7613a901c9c5ff221d0baea56474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228201, "uuid": "0beb0977-5375-4f67-b761-beff9f8a5a07", "comment": "Malware payload (Mirai)", "value": "72f52e76b802b3308f3b1e48ce03788ab7758b47c37e97029df01e5496ab50b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228201, "uuid": "006be4e2-b617-452b-987c-99c7d26d3e39", "comment": "Malware payload (Mirai)", "value": "e7e6723344495e23bfb757304f4a80bcc670a533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228201, "uuid": "902e4f56-e90c-4d44-b6c1-bf4f21d90012", "comment": "Malware payload (Mirai)", "value": "d2406c288b46bebfd29da47ac77fd3359b17ca12b4e0ce1f8305e886878d74b48c28162c8ccf8c0a83c70e278e15b9d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228201, "uuid": "3c7103d6-2941-455b-b8aa-97a94a271e19", "value": "T1FB43F1E6B323D7F0C535683B12565390FC932CA9A217882B61AE71BB8939ED17605F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228201, "uuid": "70612b7c-09b8-436b-ac78-04a88ecc5cc3", "value": "1536:WEjD24P74kNBIYz4fRDYVyX/kjnGSCz/lJ8rMSR8y1ItoB:WA243Yjf9YVkkKSCz/lfo8yYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228201, "uuid": "a69ca3f3-6acc-4064-a0da-4a9587f9f039", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228201, "uuid": "aef5c218-dba6-4311-8616-78b81240f3a2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228201, "uuid": "6511649e-ff9a-434f-a909-802b9a5a6519", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c447291-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185344, "uuid": "9454f0d6-b35e-4570-89a5-d25d73b8c258", "comment": "Malware payload (PhantomStealer)", "value": "ec0f91704f15516602363bc202c2543e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185344, "uuid": "4551f106-1db3-4fae-898b-5c2ab67b027e", "comment": "Malware payload (PhantomStealer)", "value": "7308e802f08cc076a067c89a207e17851c7282879077eb2fdbdf171cf45f1067", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185344, "uuid": "d8890a36-2677-4dd9-88e7-97e313d09df4", "comment": "Malware payload (PhantomStealer)", "value": "062f42b1e2201fe4c18374032018f43e8d5ef8a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185344, "uuid": "ccc65c82-8c96-425e-b23b-66fdf6c1ab59", "comment": "Malware payload (PhantomStealer)", "value": "19a2c7c688a5440f3c690e815ce11a41f72cd60245f4d18b254b5f8c6ef2a91e68989cc893dc137fb4233fa29577c22c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185344, "uuid": "1c91b6df-60a2-4ca9-8080-fd2447be874b", "value": "T16EB5F1145FC85FBA8AAC1618D07E1A6EF3E10A8540677CCEEF737D495FAAB0091271B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185344, "uuid": "688d3f27-bfdf-4423-a984-fb02fa3d5090", "value": "24576:2AuOnC2YDm6+WGedPXZiIg23dAJ+xWOaUZ6+xFDKBY/72iaYgmnbPU9S4ENj/fEg:ODWedPJ7Yc/fDfzHgpS4EZL+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185344, "uuid": "a914fff8-2400-4b44-872e-1d7acf30d578", "value": 2416608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185344, "uuid": "a4847b2c-b5d8-48a1-8b7b-c37e34b8415a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185344, "uuid": "5ef21fba-9f1f-4754-9640-4e932023dec0", "value": "POHGQ98765456700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168d6d01-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228204, "uuid": "eb3d6ff9-804a-4a1e-83ed-62c8d0b9b675", "comment": "Malware payload (Mirai)", "value": "7032d4c865837873356b36f03f3ab470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228204, "uuid": "f2700f32-2e47-4819-be90-99308046621c", "comment": "Malware payload (Mirai)", "value": "73cd8b7eb7f532d248c05863e9d9e8379aaf970291c6300cb9c8c474e8377850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228204, "uuid": "da825f42-0e83-4362-b1e5-c37501e70f28", "comment": "Malware payload (Mirai)", "value": "abe0422a86a96282268a5eae89b0359b3c2294d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228204, "uuid": "8b3dd886-00f4-459c-aaa3-7e5bbb9d5b3b", "comment": "Malware payload (Mirai)", "value": "e9ba072af3300a6fc59764b7adf5f2d6f8178060726621418b3e1d7b7760af3d02fabf3a439205343017bce2a564c3dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228204, "uuid": "3d717e41-b047-44f7-85d7-660a2cb1c7c2", "value": "T1C473081AB9419F15D4D526BAFF1E528933535BBCE3EE7113EE142B2427CA91B0F3A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228204, "uuid": "64d30851-a364-495c-80b7-d9d8acab9b4d", "value": "1536:+MnGjXUvslet+HiOCC2+OYDLVZr0fA0XIN+He1lr4Nl7Xirksv03ghU:ogvSMUjOQvr0fA0XIwHe1MpsvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228204, "uuid": "fd953f0c-b211-4582-9883-9a11799e417e", "value": 75464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228204, "uuid": "7d3a0930-404d-4441-8830-014ddb5ac36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228204, "uuid": "566beada-e73b-4bf2-9b32-1aefc98a597c", "value": "Kumc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19791217-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178816, "uuid": "5f256a63-0994-4b45-9bc1-0e5a9b439cfe", "comment": "Malware payload (CoinMiner)", "value": "7473280095dddef1ed6fd6e9f6aee036", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178816, "uuid": "b03f263a-2c65-4269-9be5-01d1b673adbb", "comment": "Malware payload (CoinMiner)", "value": "74ed8d57566e1b44f1594555727813c93f8850b5d7bd7f10a707d519b4ff95da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178816, "uuid": "e3017ca0-e995-4fdf-bd30-70b999501385", "comment": "Malware payload (CoinMiner)", "value": "6d86fa81baf5e6cc6e1bd3e724f65a436bd96ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178816, "uuid": "12d1398e-9cda-46c3-a980-d5a9f8dbf841", "comment": "Malware payload (CoinMiner)", "value": "ee8c2edcb652612133b6ebddcedc11167a830e0b5215b358f82e855bf09e6a37c2ca4c074f5c2dbc04fe018ed88810b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178816, "uuid": "d04dc6f6-08d4-49a1-9972-4762631b9768", "value": "T10E6533BF1885F18FEB1BEA840593DA8038F24B591984F15A199F18D123C933CFB67E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178816, "uuid": "1440339e-f3fe-41cd-a6a4-39223959bbb6", "value": "24576:/04IaMfWmVcJRJO3j+wwbQu3Q/t0Ji5v8urcWjSD0ldD:fxmVcJRJO3jPO3Ql0kzTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178816, "uuid": "bf6951ee-8bdc-4c25-a779-ad6a2e79bb9a", "value": 1436384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178816, "uuid": "6292054e-3ebd-4d50-8542-8a17f2c909e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178816, "uuid": "3241cb96-c7e0-4e78-97d0-774183f6480f", "value": "74ed8d57566e1b44f1594555727813c93f8850b5d7bd7f10a707d519b4ff95da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a4fc20-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246157, "uuid": "ab47acb2-f302-4560-8701-cb0174698135", "comment": "Malware payload (Mirai)", "value": "1aaaf52af5ae21176bacec187d5ec5db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246157, "uuid": "cfa0a6b6-dc62-4daa-bb61-b928b7e6fa74", "comment": "Malware payload (Mirai)", "value": "75226ce6759ba3b83b867d9529fd9361b8886ae1c27b3ffa479a9a8e48d79926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246157, "uuid": "593c36be-c285-438a-bfde-6c394780a2c6", "comment": "Malware payload (Mirai)", "value": "649e7cb0010b8b386295def9b196aa7907690bfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246157, "uuid": "74f8cfed-883d-4cf4-af77-b364b6863275", "comment": "Malware payload (Mirai)", "value": "b851fbfdb6f51501b6ae6b7241ead30ccf7f5d4c1fcabf5a2e40eb5095b41eac781ed144e6dc2e71cfbfbabfe034fb1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246157, "uuid": "6c6de7e4-c263-4352-9052-9dd4dbce43c9", "value": "T1DB936BC1E653E8F5ED1705751137E33B4B37F139102DD697DBA8AA32BCA2600D5262AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246157, "uuid": "14ff3810-58b5-400e-bd37-e7cf774f1f32", "value": "1536:Lh+jn2+ifI/EIzRBIepUGzX+VCW+XpElUx02V79KTiI3nPKxCdg71G+dkChCO:9+jn2tA/EIzPIepUG6VCPulo79AiI3Pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246157, "uuid": "66c43b84-e8e1-4f75-9b51-1823812d2f0f", "value": 91860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246157, "uuid": "65434b00-1649-4411-b203-aead3f9aaf7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246157, "uuid": "bf582c2f-a3a5-4ad2-adff-14965a7fb832", "value": "nerv.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d58bff-813f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784224305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224305, "uuid": "7de7272d-17c2-4eab-b20c-ca8a6ef8350a", "comment": "Malware payload (Mirai)", "value": "b469f87b9f520fc45f0b7c02ebe11ab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224305, "uuid": "c5e97387-93c1-44cf-824d-cc92f0a80a5f", "comment": "Malware payload (Mirai)", "value": "7568806c133ef58881d0c70f823c7e97c47f250b15dd520b67f6bb01169128ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224305, "uuid": "309a6496-425c-49b4-ab58-f94777e8e408", "comment": "Malware payload (Mirai)", "value": "6cf9a7b2386f7a819c84c8ae21d2bcc4a878cd0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224305, "uuid": "834e7f83-1e33-4294-a639-422dd8cac491", "comment": "Malware payload (Mirai)", "value": "ae6973ced9b5ed7929fc680b6c109269550d3a52f96863c3def33fbcaafea60a974e74ce0c7917bba088693d95b3febc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224305, "uuid": "9c3fc3b3-cb86-4664-af7e-bc667c32308f", "value": "T15C933AC4B881A621C7C22677FE5F018D376697E8D2EA3203DD281FA4778A85B0D37756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224305, "uuid": "f550927e-42f4-464a-8000-af6d15eb2fdd", "value": "1536:aUWOUAbyt5enX7rbIBClWrqPmGVLlHrjECl+gUOpN1UrFBDmsVPxekmIwnE:aUWOUAet5enrnIEoqP/LlHrACl+jOSxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224305, "uuid": "82ef9179-09c5-4d06-bba2-f014af0d378d", "value": 91980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224305, "uuid": "36cb8120-ea0f-4974-9dca-b36d655b1573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224305, "uuid": "51b11850-b8be-4e73-971b-a17875cfd56b", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c08d036-80da-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784180995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180995, "uuid": "402bf75b-7781-4091-b63d-88dc31cc8c6a", "comment": "Malware payload (Mirai)", "value": "30aa1c51b8d7604847b45e45a5dab7c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180995, "uuid": "6256d296-fbd7-47af-93fa-82ccd5accbd5", "comment": "Malware payload (Mirai)", "value": "772e05b18201537becb5332698cb6b96ff11e8f0d5243d68659bc89c752fd36d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180995, "uuid": "b7bfdb1e-83c5-4155-ad54-9d0aba35440c", "comment": "Malware payload (Mirai)", "value": "a0c9b859dff2793a505e87e86efc8587733f6567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180995, "uuid": "8f543a91-4163-412f-bdfd-3ca7f2dfacb9", "comment": "Malware payload (Mirai)", "value": "fd38ca0decb3ff627c3af0aff089f23d361299a00eed02e50747febfe9757d3c0c97746d2312c8b8494014689a72aff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180995, "uuid": "0f7127f3-0689-4a4c-8c64-f3b78638f420", "value": "T1FB04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180995, "uuid": "3cbe1ed6-ec34-4e55-bfad-413bec90a68a", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wkUXS:7eJpJUVD1A8n0YNgEJi5ali", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784180995, "uuid": "1bf832ce-224b-4e8f-8b74-36f724d8c689", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784180995, "uuid": "4d824319-b49b-4b02-9bd1-bba1d0ca5589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180995, "uuid": "701770c9-0eb6-449b-8232-6080e9bce8a9", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c53d36-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185407, "uuid": "c99bfe54-3e30-492e-a7ff-57838d0e8aa0", "comment": "Malware payload (Formbook)", "value": "c311f0a7a9c2058feb712bd54739c226", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185407, "uuid": "45a98f82-7307-4488-893e-3825f526044e", "comment": "Malware payload (Formbook)", "value": "77a6361d328f91e143871a29dc990ed903d7c0d3669673f3aab4664c375ecbb2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185407, "uuid": "245f4e87-6345-4c8e-9509-cbca8c895cd2", "comment": "Malware payload (Formbook)", "value": "b1068a0aeda5af3fd99de7e995d1c1136ebd79ed", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185407, "uuid": "3829c42f-e2e5-4a95-b052-d0cd01da0dc6", "comment": "Malware payload (Formbook)", "value": "8661f698ff5944656418938b538584b86629148eab231cadfbbbc2155f31c2297517836d44e616b907344baa07630cea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185407, "uuid": "042e605f-9225-4d02-9079-40b386f1c4bb", "value": "T1B4345A70E9A4027E0F475B9DFCA65A61C9BDC609852640F0F6DE470D60079ECE3FE2A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185407, "uuid": "26ca4cfa-e355-4378-b2cf-cb554e401079", "value": "6144:NWcUZQw9uaHMzB7mnmFJ81L6d0f+wV8rsVuzbqpSn49v:M/F9CzBemcLk0f+wV8k4w6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185407, "uuid": "dc495652-53e2-4ae2-93a8-6997d6554f5b", "value": 240938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185407, "uuid": "c36fe249-e2e6-4e96-bafb-4e6e9fc8dc51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185407, "uuid": "ae2d2810-0cd7-41c5-955c-0d5bbc53f64a", "value": "bizalmas_adat_2026.07.14 - 5971.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed513cf-80ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784161484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161484, "uuid": "ac9ccd4a-aebf-4b03-b00e-83c744bc5f2e", "comment": "Malware payload (Mirai)", "value": "9ca441406c590855be373850655b09ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161484, "uuid": "05ba81f5-68a6-44f5-9271-73d5925a44cc", "comment": "Malware payload (Mirai)", "value": "780e56445f2e5521791c8802b93afa0c8efa4b44d528b1a18e8ed0a1c5e2858e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161484, "uuid": "f9e7086a-aeec-44eb-89cf-5000d917ed86", "comment": "Malware payload (Mirai)", "value": "b1dd71cbbc9c28cc23fffdc1526a7b9c8271807d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161484, "uuid": "825b01d3-70be-4b0a-960b-831c56eea406", "comment": "Malware payload (Mirai)", "value": "0bca042361712178e2f28b038473da9bd8e53a0ebeee3857ccb2d0a9e4dec88829ad0d86cb8c0d41706b21b461ff2d6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161484, "uuid": "c8749625-8855-4ec1-b033-02678995f990", "value": "T195C329A9F880DE52C6D1267AF75E118C33231778D3DE7109CE249E3467EB95E0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161484, "uuid": "257c4b68-906a-4b3d-a450-c42d13c00c60", "value": "3072:3KkAGfJqpUqVL45zcQrT25YcYEEU1aK2x2SPpkh+ip8RNaY7A2f1Dl:3K80qrGYcYEEU1aKM2eCh+/r0295", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784161484, "uuid": "852488d6-eff2-4c7e-8452-326502cb6e43", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784161484, "uuid": "5d5a3c3d-48fb-4f25-8168-df6641e7ab6c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161484, "uuid": "11b01a6d-051c-440c-b88a-a374c21ac1bd", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984a9bb0-815e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237870, "uuid": "40387e4e-393c-494b-b1f2-5941b717c17f", "comment": "Malware payload (Mirai)", "value": "c2c9c2f9b80106db6c94cf104568e7f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237870, "uuid": "a7a2f117-1dad-43a0-b93d-2884f6d849a6", "comment": "Malware payload (Mirai)", "value": "7840ecce0491838b7958d720a86dcd67e2c4d1b2517a13ba6d93505a91c9447c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237870, "uuid": "c5334726-71f2-4a61-a3da-57e9f73327fe", "comment": "Malware payload (Mirai)", "value": "9c2204cbba340ef70ac7c2813856c56d11e5c8a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237870, "uuid": "b2b2dd00-62ba-403f-9b5c-5e3e97e45070", "comment": "Malware payload (Mirai)", "value": "ed42676e8ef76ac3c9a405dfa7710211e1fc66d0c721bced3e30cbbc0bdfb9ff957436f67f6808ed8d7f7b05ed865bb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237870, "uuid": "3b44483c-1a3e-4e3f-9b88-581001126efa", "value": "T142245C46EA814E23C4D7177AB6AF114A333297A4D3DB730699286FB03B8679F0D63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237870, "uuid": "dd86cd0e-1fa5-4e6b-b4a6-ef63e9b0e031", "value": "6144:GUiB0UfyVEaak87zNos2thrCGFTHdGLavM/912s:GUiyUqVEaak87zNos2Drnblk/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237870, "uuid": "87b99853-7fc4-42a9-9b56-4adafc686352", "value": 210526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237870, "uuid": "6724c793-ea97-49ec-a68d-318603c0cd43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237870, "uuid": "d1b9fe78-97d3-48ec-9899-2bc6a033a9f0", "value": "SecuriteInfo.com.Linux.Mirai.9816.25803.16345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7c577e-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228568, "uuid": "083cf86e-38e3-41c2-9f15-e2dcf469233d", "comment": "Malware payload (Mirai)", "value": "bb9607d1fb3df698ceb858f4b2f7d396", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228568, "uuid": "7245a0af-3de8-437c-bf17-dfdb4563d345", "comment": "Malware payload (Mirai)", "value": "7876405202505fd15034fdd1577f0e21d7b5d2c0b793ebdde4c9eef0817d4386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228568, "uuid": "f9711022-5344-47ae-926f-5c91a7535c86", "comment": "Malware payload (Mirai)", "value": "b5b2f3fa75431e402a47e9318579776161701ee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228568, "uuid": "ab8d4810-1e9f-4b77-a07d-6e9a75808fb5", "comment": "Malware payload (Mirai)", "value": "e7acd2e4faca3b5499bc95fa7ee138c00ff5c5dcc38853729a2fa1911bf32806aef003d7d3e76270c3df61f7dfbeaf00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228568, "uuid": "fbe2c945-ba2b-44f4-9b1b-78769580bef0", "value": "T1FA04194F7B21CF21D369C53045B38B9756A922522AE1848AF35CDE083E6434D792FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228568, "uuid": "0c45ad2c-71ab-4fd4-9886-34107552b1f3", "value": "3072:kfj5NOBZsC4OrwmuUgHrcnwWPcoTyQvEuTkTVM1Dejr:kr5MBZsC4ewhUgH4nwUSc7gV6or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228568, "uuid": "30714299-0ea0-433d-9501-cf3cb5e87289", "value": 185096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228568, "uuid": "0096dfc6-6840-41f5-815c-02ced09ec61b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228568, "uuid": "cb2e85b2-30c5-4266-b24c-1cea1a3af563", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3821ed1f-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184881, "uuid": "52ca001c-8762-45ee-92ea-1224360411bc", "comment": "Malware payload", "value": "60efa74b894ca64dbb57cb20495aa834", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184881, "uuid": "4906cbc1-827b-46a4-8639-a8861e52f40f", "comment": "Malware payload", "value": "7997bfe7ec26d2ed24ab7fa1fb2a3542762876910d33284273f76e20928f1d72", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184881, "uuid": "3e77b6e9-57c2-47c2-8501-ae20c89c45bc", "comment": "Malware payload", "value": "8f6485ca31d5464bf443ecd03560deb24a12934b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184881, "uuid": "cd160e2f-1226-48d0-9d8a-ffcc34cc3bfb", "comment": "Malware payload", "value": "e339cb3bd57b91add6f79dbdae8946377d58fc42dc90eb5972d590019c9aa54e68d80fb89565edcd08d8ee6e467c754e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184881, "uuid": "143a1afb-4a61-45bf-9b20-822d3d7f9638", "value": "T1DAC539B629D1DA05D6781432CE7B955C0CE02EDBDE84A9173E1FF30F377812162D8A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184881, "uuid": "a0cddeaa-1015-45d7-aa3b-b8c7db83280f", "value": "6144:w/uBKyYPGn/84e15Xg1lIkGuDQMi2cSa2AnlPpyj3iaM1YdOOtup19IJVNABDEQo:Bu8dM1Y5tYDQo49fiZXZ849f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184881, "uuid": "61b53d5a-4d4f-46ff-b45b-cba4a5e2deaa", "value": 2744832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184881, "uuid": "9b8d8a93-a9a7-4199-8972-b5af0a272a19", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184881, "uuid": "b58a2de7-a246-47c9-a0e0-bf7bd7b88cbf", "value": "Solicitud de apertura de par\u00e1metros.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c153bac-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212858, "uuid": "0d27b398-7863-480d-bb0b-9cd78c300147", "comment": "Malware payload (Mirai)", "value": "7a7e6f4a286ab5bb7a064329d1128f39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212858, "uuid": "8ae36448-288b-4a32-874d-433747cdbc18", "comment": "Malware payload (Mirai)", "value": "7ab35d18e1b0719182e80d7cda25de917d4f65fcd27733ca09c4e32818786831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212858, "uuid": "4479f3f6-53a2-47c0-8124-73a1b953b1d0", "comment": "Malware payload (Mirai)", "value": "2920676c333ea9ec43e0eac782a4bc7a1f062ed7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212858, "uuid": "d3e4d16b-7ead-495d-b4c0-9e840263d103", "comment": "Malware payload (Mirai)", "value": "b83d91be5096b8498bfd73ab349f9fff3e4d19dc6e534b104eaf194aded1162db9c94aab42954efc4c9fbc33be7db5c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212858, "uuid": "94851f76-c0d4-4506-8b06-9806499c3611", "value": "T179437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C769D83BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212858, "uuid": "0a1b2453-429a-478d-9e0d-01bd2119f8df", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7icBDb+JSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2WtO+gz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212858, "uuid": "ecc5c909-9d12-4fff-b15f-68568a1fd8ce", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212858, "uuid": "04f4cc87-8143-4836-aefc-776d847e6ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212858, "uuid": "a5168373-6f62-4e07-8f70-32f3f92c7695", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6058c54b-80bb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784167768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167768, "uuid": "17d053bf-2016-4af7-9345-0204242070ed", "comment": "Malware payload (Vidar)", "value": "6fd0105fcffe0aedce225fea31e73f73", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167768, "uuid": "00960751-0d14-4bc7-9e8d-b25123dcaa38", "comment": "Malware payload (Vidar)", "value": "7bce64f71e61af03a0cf9efc56e81c4113e6541f252c368603fa43974523081b", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167768, "uuid": "d96da8cb-7ec9-4240-88c4-6653e0c4d61a", "comment": "Malware payload (Vidar)", "value": "fcf25271e7a9e7c286dc37d164a584b6b04fdeee", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167768, "uuid": "5b8f9cc0-d258-4940-86d0-e3b76b656b6d", "comment": "Malware payload (Vidar)", "value": "66b2bce19c0d67b0bc3e783c3b297a7d88e61ee727374e4b52433f2d0e7aedd72f5d96f1285356e60f92b22145d4faf7", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167768, "uuid": "bc52758b-b93b-4da6-b91d-0e78b5c68abe", "value": "T113B5398ED49203B5F792FB73521AD6625DF6390280328A75CF497D365F06F24A028EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167768, "uuid": "a9a409c4-c5e5-422a-9cdf-25f65fe4fe3c", "value": "24576:WPzswvn78eG6l8xmM90RwfDCrK4Ylyx/Imf/deBsIA/PPMjjKtygLWSU8hyT8eCi:kAPVQMbiKkzfVgsPVUTTF6ZoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784167768, "uuid": "841260fd-223a-4606-aaa9-3704e244e9a2", "value": 2345472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784167768, "uuid": "d2d0eea3-d3ab-4fba-ba5d-20e6204cce63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167768, "uuid": "034a0740-bbdc-4061-bfc5-5920bc440062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108296e6-810b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784201994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201994, "uuid": "1ad9ca5b-bd7b-4e64-bc3d-61fe3094a040", "comment": "Malware payload", "value": "44050af428e7b541b10ce9e8e52b0c65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201994, "uuid": "c5bfc754-b028-4120-a7b3-84bda49910a2", "comment": "Malware payload", "value": "7c5b267f1ff4c748dacf52574bd8fe7efa5a5c3c0dc87d1afaadae79db12b078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201994, "uuid": "9995db23-cd49-4c13-b5b2-80f5519f9616", "comment": "Malware payload", "value": "7e68165db1d1a8be988c0dc18f7e6151d4d6c866", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201994, "uuid": "81e2af54-18c8-4740-afb5-c515c29dc291", "comment": "Malware payload", "value": "6a63fa2854e9d9e1acf5c5ed6986fc7f867dcacbf127522d84af6a41e7743c3eb82fd1e4d1da78b097b0e62dc6bb601b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201994, "uuid": "71c84311-b168-4808-a791-4b2445270d65", "value": "T1D60633C5B718C1D284134DBBC8E4BDFF4A04BBC9943041E96068AF796A3C6296DF8EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201994, "uuid": "d15fcebf-6001-4254-b22d-4340a227dea7", "value": "98304:lNmXygLrhylpVSo+QPlSQbCYRylv4GNKI0c7Ooye:lwpXo+8DbNRyl3KIh/ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784201994, "uuid": "df8bc51e-09f3-4b39-b154-31c08d2ebd76", "value": 3903916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784201994, "uuid": "45893eaa-a4c9-4cf6-bdc3-5d56ba2ddcd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201994, "uuid": "971fe188-2404-4885-b9cb-bf4b4c828548", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ea85d8-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234623, "uuid": "e903afb4-8416-41cf-8852-5861403c3fc1", "comment": "Malware payload (Mirai)", "value": "261724fe840a7e2ae7dbe0282a41e699", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234623, "uuid": "3af3638d-e8b2-4afd-b554-873ba3d306b6", "comment": "Malware payload (Mirai)", "value": "7ce01d102d934198094da8abfbdf34a1f081c4335b0a42bba4dc75a577e703f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234623, "uuid": "790f937f-873b-4eb2-905e-bfccac03fffe", "comment": "Malware payload (Mirai)", "value": "aa39517b94bf4f0f168403267a085098b0973d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234623, "uuid": "52623409-d7c1-414e-9a8f-724cf353238f", "comment": "Malware payload (Mirai)", "value": "5eea2684a99b18860deb421db7e5a6303ef3023d2709f1f7ffbcdbd20eff835754b0273243b20a1ddcec73424937842f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234623, "uuid": "d79a075e-d611-4b44-bd0f-28a74f04e512", "value": "T170245D46EA814E23C4D7177AB6AF114A333297E4D3DB730689286FB43B8679F0D63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234623, "uuid": "5dd296cd-14df-46d2-9085-18cc223c726f", "value": "6144:OUG5MUfCF0Car0Tj94KKNVrCq8bHDbALavM/9os:OUGyUaF0Car0Tj94KKvrj4bjk/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234623, "uuid": "17918ed1-d680-4609-9790-045a20230a85", "value": 210534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234623, "uuid": "77778857-3fa1-42f6-ad26-22969ab9c6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234623, "uuid": "41316ff6-3b5f-464b-bc59-6b5a5c962772", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376d5c5a-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228259, "uuid": "3d4f619f-9cd8-439e-b57c-e87d7b7cbe6d", "comment": "Malware payload (Mirai)", "value": "a986c118a3458caa4ae91cab7a1a075b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228259, "uuid": "1c8d5eef-0c45-4ae4-86d4-c7ef8457dd52", "comment": "Malware payload (Mirai)", "value": "7d490da8d7979a9f2c24f239fa2121df8ae63b7b0f3fda75328460836730853c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228259, "uuid": "67ad8f39-8772-46b6-9767-acfed8ca4927", "comment": "Malware payload (Mirai)", "value": "3d2fdb9dc5eae175ba61b03ed678844abf59d512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228259, "uuid": "af808d16-976e-4f9f-9dd0-8c86ad0ecbfe", "comment": "Malware payload (Mirai)", "value": "ee07f9e38ba425e844304ded68e2b10cd7a97380549b0f0e087975b84018a9e1d364aed7fb1cae3d417dfeb633ca0a4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228259, "uuid": "33eecad9-1f36-424d-a12f-2829b95c1283", "value": "T133C33A06746158FCC15BC474C77FE837EA31B46D13343A6F2B84AA312E22E755B0AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228259, "uuid": "6a97c661-9ef2-4e07-8785-ac82af68ae34", "value": "1536:ZYijLFe1Wc+2eH/GPZhxKp2a/NPUDBeVkNdbZ7eC/xVObLozRpG44Iorx5y:Z5jA1Wc+NfGxYBV+FbVoKRpG4m7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228259, "uuid": "3ee3203c-edd5-4d5c-83e5-abd8c6ebe9a9", "value": 124792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228259, "uuid": "2f214396-1432-49a6-b87a-3bcc2eb760c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228259, "uuid": "485326f4-30c3-4423-9808-75bc583b1013", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de6c09b-80db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1784181562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181562, "uuid": "c943e468-e686-4315-a305-4d7b83f62763", "comment": "Malware payload (RustyStealer)", "value": "267bcd9a4a1f961c04ff80c95d22565f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181562, "uuid": "9f4fca81-11d6-44c0-a2c4-c683fd9b9fbe", "comment": "Malware payload (RustyStealer)", "value": "7d6e03b04c5c7c6e4ef43262f1ae3a673139ff93808ea62a38384207ebb25449", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181562, "uuid": "733fc3d4-8913-4598-8d40-8d0826897c3d", "comment": "Malware payload (RustyStealer)", "value": "31b798a1d3e9a39a60cd0fd48cb0093bb71ebe8b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181562, "uuid": "c2589176-95b0-4c1b-bc58-353feddd2669", "comment": "Malware payload (RustyStealer)", "value": "acd42ad6ce2bb1b7af1f8b9f2fff77fad266fdf2cb1464638c1093c11d17e400f3fe7b16d65bf95eda19001f94235319", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181562, "uuid": "dbd852ee-72f8-4b7c-9d13-a0cabdd97b54", "value": "T1D3D7F2398932BCD4C75C3B00A7641C6E21DD594AA3F38E28D6152CBA3E72765EF758C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181562, "uuid": "b6167d6b-2520-4c90-8443-207ee4840fea", "value": "6aaf61e365e3789434a7b99893c15e74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181562, "uuid": "fd25d619-42b0-4c41-9173-b6bab69b9738", "value": "49152:WNr6wR+LbkOVseGUirz2A7/V4DUYaEOj6L716FLdfVn6UViK1F9RcyBKrmOygx51:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784181562, "uuid": "e232f476-ab72-434f-a34b-8c9a7469ae07", "value": 58715648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784181562, "uuid": "ea6b551d-804e-415f-8421-4831d7fd077d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181562, "uuid": "cfadb7ed-114d-4db3-97b6-187a2522ee4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb22d46-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208434, "uuid": "7d97d536-1484-4ed5-bc08-1d7e110e87e1", "comment": "Malware payload (VeilStealer)", "value": "d0b9a7237d435da44acdf3f159b2211c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208434, "uuid": "8b5ef962-31e4-4063-9fc6-be677d0510aa", "comment": "Malware payload (VeilStealer)", "value": "7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208434, "uuid": "93ccd9a5-94e6-4dab-b149-d03d68338cb2", "comment": "Malware payload (VeilStealer)", "value": "05b771a0ec063a2b04d4befc87f13b71ea08a3f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208434, "uuid": "33378293-db69-418e-b188-cb1cb548c5f8", "comment": "Malware payload (VeilStealer)", "value": "3580ca77433884d476edf1feadec941925394a24d9de88f801ed3d65391a61a9616dcf85fab0d5e8e67cec6ba86f779e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208434, "uuid": "9fe9ddcf-75a2-4fdc-a980-c0f343341c59", "value": "T1A0D63947EDA606E8C0AED535CA2695537B713C995B3023D31B90FA243F36BE06EB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208434, "uuid": "1ed2e8cb-d874-4b36-bde5-32fb253feba7", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208434, "uuid": "c746a95e-3d98-4251-b82e-d2725007734c", "value": "98304:jv8U1r5wAZxZo7TLCizQ47syzUMx7Agf2y4malGgGvjQjw50GE:7r9wWxZ0TLC8spGbMmy9rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208434, "uuid": "92ba7573-a244-45e7-a897-26eb02ade7e2", "value": 13835264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208434, "uuid": "2488d23e-68f1-47dd-960b-7f06145c6128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208434, "uuid": "2b7297cf-d336-4423-aafb-a759f859be6e", "value": "7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33df580f-811b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784208925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208925, "uuid": "7706e173-1a85-4517-b24b-efb0bbf58b08", "comment": "Malware payload (RemcosRAT)", "value": "6497fadf53f16529a9833256bfef4e5a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208925, "uuid": "7ada1d51-8e7e-47bf-b2e4-2a83c8641241", "comment": "Malware payload (RemcosRAT)", "value": "7df9619f4ebfbfae75755efb99f044815ecfb17a8077fe90b300da86fc9e49e7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208925, "uuid": "01adae80-e45d-4ead-acec-63ab94b517f1", "comment": "Malware payload (RemcosRAT)", "value": "b0164153e0d3c576c7944794705a0f82f70b695b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208925, "uuid": "69fa6719-cc3e-4a41-aa5e-8c92920906f2", "comment": "Malware payload (RemcosRAT)", "value": "e7b16578a0c687b115da08ea696be0627423bf90c12d2d7b28a26a039767aaa452f49c7552577590d060a2fdb717f207", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208925, "uuid": "8d2aedb9-b6f3-4e4f-b762-2fbe3e59cfe8", "value": "T181052311F9E5AC2FC12364745DDE8484514CECC28E8FF65BBB51BB0F18316B5A9C4A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208925, "uuid": "4f01cd70-7700-41f0-9baf-e6fc737dce69", "value": "12288:TAPXRC5Ih55TEYnU+qQjScrYA53J3U7HaPYq0VpAL0t03OPT+WX4RZL:TA/EyHSccAlJ+HaSVO0yXWX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208925, "uuid": "639dde7d-2bc1-4b82-b950-2db7cf99ab2f", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208925, "uuid": "d1bd8562-dc27-44b2-9109-32554d882a2e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208925, "uuid": "39a23157-dadf-4cae-91f7-b865fc6c11ea", "value": "SecuriteInfo.com.X97M.DownLoader.2343.5736.12919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff0f27d-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227978, "uuid": "9d96015a-6aed-49d2-812b-bdf98099daf0", "comment": "Malware payload (Mirai)", "value": "65c4cb04cbd331be05edad530c243156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227978, "uuid": "9eda330e-ffb5-4365-b179-1beb39fe40a3", "comment": "Malware payload (Mirai)", "value": "7e70543845da91146d34b2b8646067722941cd2514c8aef96fbb856437c90cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227978, "uuid": "e635d2cd-51af-4201-a345-7326a39b0fb4", "comment": "Malware payload (Mirai)", "value": "a8dbb131a7c6103be65c5cf92120216b8f80cbee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227978, "uuid": "36836593-2673-44ff-abf3-5d4585710f89", "comment": "Malware payload (Mirai)", "value": "a59e2a64ae714999fc8677096f0aae9f76b513bcacaf0efaea9ed0844055a651073a1a669cd0df2161e30a291592b816", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227978, "uuid": "a9692c9f-e370-4acf-a633-cbeabcf5183c", "value": "T18AC329A9F880DE52C6D1267AF75E514C33231378D3DE710ACE209E3467EBD5A0E7A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227978, "uuid": "cf55835f-9cda-44e9-8c86-a4fbc9133d03", "value": "3072:aY45kbyt+I9M6lKBx9RokeVElcYEEUrH7pCx2a0hfrmFT72Uk8W+2f1DlF:aYj5sEs+lcYEEUrH7pI2Z9rmFztx295F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227978, "uuid": "e8d9a658-3ae9-4d1d-b4f3-64613881ffed", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227978, "uuid": "a149103a-3ab7-4931-87d5-2038452d875b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227978, "uuid": "c1591524-2221-4f32-8942-a6e93f4ba1f3", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456dfe40-8145-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784226994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226994, "uuid": "1ae280f6-d688-4da9-b57a-131b0f9f04b9", "comment": "Malware payload (Mirai)", "value": "fddbfe06528c7b3ea11b717ef5317510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226994, "uuid": "fc0a7606-7b56-4902-ac2b-26d6df865764", "comment": "Malware payload (Mirai)", "value": "7e775f5f07ebdb8c3e24edb92d12493cc075e301213ff0e63e97edd65594d984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226994, "uuid": "ca04d6f5-d640-45c3-81e0-695d546ae282", "comment": "Malware payload (Mirai)", "value": "ecdd333487e45830a80830cfbc6b2c9783f612bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784226994, "uuid": "4fe2953f-e0e6-424f-b26f-9255faef463e", "comment": "Malware payload (Mirai)", "value": "1dc43a1e30e3a1fe25bfb3dd75b282124c41991411876d0c065158ddf2b508f58b237d6de1488e1ced229aa1d8e002c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226994, "uuid": "19926b84-18b5-45ac-a395-104de60c41fb", "value": "T1CED3185AF8819F21D5D626BEFA5F518D331327A8E3EE7112DD205B2433CA92B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226994, "uuid": "8cd4527e-540a-47a8-a0f3-69f256b96dd3", "value": "3072:L/ak4zLZDje0mTM9RZ3tKjB00SMzaN4U85PgldtXlojKxNgnbr:L/akELZDje0mA9Ej15zaN4U85Pwd3ouc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784226994, "uuid": "9bc066b2-243d-4b4c-b291-8ff3ca6cadde", "value": 132984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784226994, "uuid": "d95acf99-d785-4bf8-b9b1-cecfcf305f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784226994, "uuid": "bf68390d-bfb5-43c5-9631-9f1bf108448e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aec10a6-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179221, "uuid": "db0ae82f-bab7-46d1-9bab-d4b4f67388a0", "comment": "Malware payload (Mirai)", "value": "bd058818a0bad3888db4b2afef7fc666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179221, "uuid": "079edad0-20e4-4c9c-a266-90e909286b82", "comment": "Malware payload (Mirai)", "value": "7eb251bd880a262d433b5b804f8a603c6359e026d568baf65580fa77f99773bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179221, "uuid": "8c0c1cd4-08d0-4064-88a8-98d16ba7f29b", "comment": "Malware payload (Mirai)", "value": "68ee942c31de837e5950fee40e4b2ee2041555d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179221, "uuid": "b3ae0648-e375-4c9a-a390-66744615a8f4", "comment": "Malware payload (Mirai)", "value": "b5b85d23af2bf8b3afef60033e572bbec2c60f9cf81572f6d447531e7936580b6f2e76a318b3f5915c9b57437571e1fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179221, "uuid": "91133b1f-dc53-49f9-9100-5f87f1d70da6", "value": "T1AA5302522DBCEC27CAD3D4390B7841B58AC859B49493901F43CDBDF44906D68AAAC987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179221, "uuid": "ff064a45-65de-4d74-a5fb-fd13eae62345", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/R7EsAQZ:IaHJgMo8FwOA4zUFGUO3Uhn7+QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179221, "uuid": "e0868e57-a2f2-4f94-b66b-dd6fae21bb23", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179221, "uuid": "72ec1e66-f509-4e46-9eb2-4e04ee763e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179221, "uuid": "1172b380-cc16-47c3-a879-81779a160381", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc273c8b-80e8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784187277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187277, "uuid": "8c74e9a0-0703-4f4a-8a3a-1641c15c2c76", "comment": "Malware payload", "value": "3ddac85823f09daec535473e4b90a84f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187277, "uuid": "fb93ece3-a540-4ece-a2ed-d0c1f65a927c", "comment": "Malware payload", "value": "7f293125197fd3fd25eb74ae27da564a32dc2b8b0ac4ec9d522a630c528f35a9", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187277, "uuid": "3d01f598-872c-41f8-a15b-2bc9f13a7dfb", "comment": "Malware payload", "value": "bb117baab43309e6e3b1c6dcd68be7ec8ca1a811", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187277, "uuid": "5ec0b341-1866-4dce-a088-f3a24bb46d39", "comment": "Malware payload", "value": "df0069e1c0615288f59de1eba385a8c4ec9128c4f83f6ba57d636e2315ac5b124e2698826128242a095f7600eda45a1a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187277, "uuid": "1a1edb21-e72c-436a-b611-c466d29f16ab", "value": "T119F041E852C1CF85EDE3AD7870B15E810204CAF2EF49E1ABA94B34A03B175C1684B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187277, "uuid": "b1971993-1761-4214-84bd-16e55456a644", "value": "12:5jy2O/Kt2NG01/zNks/0vcaDypfb6vBVEh83rzh3mK/kPy1Oiz0TTeJpHoy2O/K9:9WKt2NG01/zNeEfb6vB6hu0K/ImGGHJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187277, "uuid": "0c5b08c4-fc77-473d-b869-1fb1f48196bb", "value": 637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187277, "uuid": "f0105ce1-de5e-428b-9256-e853c26be3e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187277, "uuid": "d69e3b4a-610b-4e2c-98fb-f004036b41c8", "value": "7f293125197fd3fd25eb74ae27da564a32dc2b8b0ac4ec9d522a630c528f35a9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed79cb4a-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234577, "uuid": "49b48372-89bc-4111-827b-fd8797b63cff", "comment": "Malware payload (Mirai)", "value": "f75a593e3d29d2881eebc0d989a7bea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234577, "uuid": "64795e81-add3-412f-ad57-803ec24f0bf9", "comment": "Malware payload (Mirai)", "value": "7f3884c8c97af4c04330581225e8678fe75a419fcb86921ebbf54a86dda9fee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234577, "uuid": "40161827-2ed2-4d50-92fc-43bef3c52dff", "comment": "Malware payload (Mirai)", "value": "7311e89fd4c183cd024c4d2fd824a84ba8e203fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234577, "uuid": "c54c6fc6-a5c5-40c1-891f-20a9760208bf", "comment": "Malware payload (Mirai)", "value": "b980757ea32537a2c92ad87cce423d9c42079dbd8847cb7ad14187f215d08e1bf9e8952185806a8b29b7906ba1fe0862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234577, "uuid": "a69d7f4a-d99b-4df8-870d-23e4139951a9", "value": "T12223E057B2414E0ADFEDEFB85E899BC462C06B2DAB43C0E13A99FF325D4272219449C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234577, "uuid": "405771fa-2d2b-46ad-a586-71c8d7840819", "value": "768:NmN2/Pfyla8GcqL8fScAkO7SuxHOAihS52pdGwQye3AnZS6bR3PCYA9KgC4uVcq1:NTyla8G/LKS5tdtOAR4xDZS61fCt9K7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234577, "uuid": "ec24d624-80dd-4fd9-ace0-f3a0693b888c", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234577, "uuid": "176ec4bd-b77f-4c78-9800-6dbc840f4c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234577, "uuid": "aad5c64c-ec2f-4f73-8343-8d4a7a02c0b9", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54e97c8-80b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784163616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163616, "uuid": "a61f89df-5b62-42f8-a653-0336de062d4a", "comment": "Malware payload", "value": "6a482f07d13df47f05dc2e1c3e64b391", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163616, "uuid": "56dd208e-569b-40d8-873c-9b021feb457d", "comment": "Malware payload", "value": "80bd353bb391fcabeeec55d17be1dcb5a1d571f64062b4da6f844ef87e526c28", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163616, "uuid": "f4bd02a3-1608-44c6-8d4b-67031ca9b59f", "comment": "Malware payload", "value": "79f76a7354b585b47ddacfea810bff0f68ad5fb6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163616, "uuid": "4fe46ce1-5060-48b0-8c10-607ba2fdc5d3", "comment": "Malware payload", "value": "a70924848bf84ec56bc9086d96481a49e4a24f9556c01bac6e2236b871cba6b459900c90143264d61b4d12940aed6a02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163616, "uuid": "b4130c9d-d736-4ed8-a97b-54c462a3ff17", "value": "T193C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163616, "uuid": "a6ef3d88-bae0-4700-a691-1ec1c7409989", "value": "768:W8vCB+25j6es8RN9FYpMSUpi+20qUpi+20YQX:W8l25J7d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163616, "uuid": "ac7d94a9-9c3f-4b01-a7e1-8b5d570f8741", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163616, "uuid": "d1d8fd1e-df12-4db4-a758-adc0653e5576", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163616, "uuid": "fa41b03c-a576-4d88-a2c1-af983f6c2e12", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8b5274-80e8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784187282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187282, "uuid": "5feea7bb-d222-4d8b-95a2-f38f90c07667", "comment": "Malware payload", "value": "336d861178e3bde015c91c1e87a59059", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187282, "uuid": "b191779e-120f-4eaf-a12a-03606a5e31ad", "comment": "Malware payload", "value": "81254cfb6f4eee19aed87a2a5d526654455e911cee51665739d572f698dc97f5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187282, "uuid": "cb882390-6e10-4c46-ac2a-907db3b2493d", "comment": "Malware payload", "value": "4184e883c605936cb964c8ec6ca30fc20a38c110", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187282, "uuid": "cd88d4e2-4d68-4881-9911-bbfdbb20e085", "comment": "Malware payload", "value": "fbcbca63a2d54b929a0ce19899a6e942ab0971a500976cdd5774b1333bc8fad092a6a63e9ea6cf7e3394a0a515ab85d5", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187282, "uuid": "7c904fbf-923b-472b-aaea-1eb73963849a", "value": "T155112B301BCB5A00F3F54B35BC3EB3012975BC0C8D314ADD928519AC0C26A109C35F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187282, "uuid": "ec96555f-1aea-4216-b68e-a180c9c312e2", "value": "6:4xtisdS2ndS2nHolHKlFcnlj+SEEgykQLPfBMlpIoF6SaU/k1ARokJxt:8oUXx4QkCikQLhMbHFMf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187282, "uuid": "f785a658-8f7f-4d7c-8553-61095b171e75", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187282, "uuid": "1f306057-096c-44b6-b518-4bb4aac3a24f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187282, "uuid": "07040c7d-76c6-4a25-a13c-792d9a92ac20", "value": "81254cfb6f4eee19aed87a2a5d526654455e911cee51665739d572f698dc97f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30f97c7-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186376, "uuid": "28d5b0f7-4f8d-4a6b-93d8-c80667386432", "comment": "Malware payload", "value": "810c4e07ed5bfa25faa6a91630c8be77", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186376, "uuid": "92517f60-52b8-469d-b565-16f223919b5e", "comment": "Malware payload", "value": "816f2cafbbe6f658444c953852c72024260e1dfb6a30168c5bd31830264c55b1", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186376, "uuid": "c222c738-8359-4768-9bb2-988447778f16", "comment": "Malware payload", "value": "2ec1eeea941ad82f92e2aa5ddc1c910027beff18", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186376, "uuid": "fef99e09-0d21-4d48-be4a-d6d3806fa8c1", "comment": "Malware payload", "value": "659b16fe18b52eeb6dc346e4278dbba4d1402c449ef0d8d4f2aeb2a9bdb602593d29c53171342222b23ba3cb2bd27dbf", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186376, "uuid": "48383bdd-15ef-47c5-9c9f-2336b78282d3", "value": "T14E65D050E7521CF9E937D6FDD09E54DE6259A5A3138407EB32B8C1F00B20AE0593EA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186376, "uuid": "839d4a37-1663-4b55-b533-55ee2a2038ee", "value": "24576:H1ib43JxRAAs7kHbtjGnpfNGQrU16uoXhodv/8N:J3JxRfbIpfNGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186376, "uuid": "ec583b50-343d-470c-8bde-53ac83df90b3", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186376, "uuid": "48529a79-65ed-4084-9860-d216416de739", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186376, "uuid": "a197491e-105b-46d8-894c-1457baf7d62e", "value": "816f2cafbbe6f658444c953852c72024260e1dfb6a30168c5bd31830264c55b1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6c393a-810e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784203412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203412, "uuid": "4fe703b6-8f20-45be-922c-2ebbbde785e7", "comment": "Malware payload", "value": "f60cb76b0f996a700f512d136f1d1365", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203412, "uuid": "326cbe8f-6310-4df0-a671-d7f38b8f3bc9", "comment": "Malware payload", "value": "81ce89f53a1c6a41ab950ba8017a4d75b8a20ceef1ef76443f75957e4686d6ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203412, "uuid": "1784cebb-459b-45e4-831e-bf8ad349c50d", "comment": "Malware payload", "value": "d59688d554f0246182d6a335c9079c2beb93d081", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203412, "uuid": "26d7d42b-8b58-46ca-9a1f-e08369fd84e4", "comment": "Malware payload", "value": "1a72be531591df372e14078166e0477a8b69a5a338419e79d1d7f18308133311a775ebcb970e75b8169d2523bb4e2c77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203412, "uuid": "bcc965f5-d73e-4338-ba08-d3223a62bbe4", "value": "T1F5236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCA3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203412, "uuid": "1fccf22c-dd02-47de-8d45-e5b736cb0b9e", "value": "768:ur9NyXsZztCW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:YHusZecr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203412, "uuid": "afaa432f-68d4-481f-9f80-1dc4c44d2f9f", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203412, "uuid": "335d6a7e-246a-441a-9044-ee44cf13022e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203412, "uuid": "554514d6-53a8-466d-b5fc-9beeec153cc9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741ce938-80b0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784163077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163077, "uuid": "a7de41e2-5a21-41fc-a210-0364fd98df09", "comment": "Malware payload", "value": "232f3d2fdb0448d4f0552c34002d7cab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163077, "uuid": "f1bcb04a-fac8-4999-bd19-f2ac05fcffcb", "comment": "Malware payload", "value": "8277d9cdcdd6d214ea747c4e3c36f2ee26bbef746273de07a7836335685f8ba8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163077, "uuid": "e7efc922-dadc-498e-af64-0967e9ee6eb9", "comment": "Malware payload", "value": "41d337d029da6eb08add720270cdbb36b58a3ad3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163077, "uuid": "82adf9d0-20a9-44eb-ae8f-1dbbcd6277f2", "comment": "Malware payload", "value": "bf5742309bcb2cfc0eb7078f1c7e30f7e6b7812556175f7a5fccbc05dd8d5af3d91b0e5fc5a8fe04de1290d4c345df4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163077, "uuid": "16eea3d0-7001-4926-8b29-7c75c4407127", "value": "T120236C6516857C14AE98C4375C7E2F0CB9AD43E6314492EE7FCA3CF28C4A6ADA20875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163077, "uuid": "6686c33b-1211-47d9-8ca4-acf5a99e61d8", "value": "768:v99NyXsZztCN9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:lHusZDcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163077, "uuid": "5e4c8c5a-412c-48f2-aac1-542aed65d8ee", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163077, "uuid": "0d92711a-4461-49b2-a78c-111abd64a857", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163077, "uuid": "50a045f6-a241-44d8-b83c-c1bab9c52472", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e074e71b-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246152, "uuid": "8c953781-d33f-4568-abe7-38ebbb1c9beb", "comment": "Malware payload (Mirai)", "value": "d6667239f85bd6acaa46f9e9645610cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246152, "uuid": "b8f65527-4d47-4cc2-8f14-401bb450da0a", "comment": "Malware payload (Mirai)", "value": "835e224f2cc0d30c2bf23e403aa557bc94daa2000860b38a32762f75c65cabd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246152, "uuid": "6951c1c9-d953-4300-a61a-948960f3a919", "comment": "Malware payload (Mirai)", "value": "f590ac9b12fbef6f147f84a6985b44f9530a45a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246152, "uuid": "4d3d73aa-6a40-4ff7-b625-ca95ae8d52f4", "comment": "Malware payload (Mirai)", "value": "704aa1195d62ccd9761c8c63dbb1e5032c80f2356d9f37f65543a54cb4b8506bdb17bc11e10faf6a5f40596f8dd56fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246152, "uuid": "36a7ac0f-0114-416d-9df8-36e9aa058821", "value": "T19DA329C1F68B84F9D54B48704066F33FCF32E5268071C9AEDF99AF26DA37641921629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246152, "uuid": "85d81cb7-b4a7-4408-90c0-1fcbc38b8e7f", "value": "3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3s6GNCoUKcnsEW+QuYCeRh:ZTFPbQ0yhOEckEUI6A12ZHTz1emn0jIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246152, "uuid": "f97a8626-ee99-4cc1-af3c-1798f538af8a", "value": 99508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246152, "uuid": "43054092-877c-4bfc-8aa6-f5f7780369b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246152, "uuid": "27b510c5-3729-4dc6-99d9-3493b098c741", "value": "nerv.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e88f187-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234659, "uuid": "748137cd-0612-481e-82f4-32d3ecac4f44", "comment": "Malware payload (Mirai)", "value": "76b4bc2cc2e2085e99d135f253ab8b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234659, "uuid": "0b564a00-46a6-4824-91b2-be29c2237400", "comment": "Malware payload (Mirai)", "value": "8370b38009d897a6f7eaf73b97f33688539623e93bbf89d86aef4834ccdd002c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234659, "uuid": "950deec3-9921-407a-aaf3-05239ad5d3f7", "comment": "Malware payload (Mirai)", "value": "075eaf574cda582ff6ede1c92982b19c57649293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234659, "uuid": "4efbe222-70cf-4d50-bfd1-4b12c7edbae4", "comment": "Malware payload (Mirai)", "value": "855036d350b884ffaef922fcb2dc655a4be4c360ac8731b972422561d851b346817fb104c732fcbc34218fad22f985bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234659, "uuid": "abcebd5f-dce4-4335-924d-6cef24a6a5e4", "value": "T1D3C32BC0F98B81F6C40B88309066F73FDB7194A95123DA9DEF959F76DA73582912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234659, "uuid": "7135529f-4302-4271-8b88-7ef499b590c3", "value": "3072:65jlzYNVoZXRgn4c30tItERjnDhpg6sWrhK8HE:aYNVoZhkD3OItYzDLw8HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234659, "uuid": "d01707af-2779-40a3-8bfa-2b390327c243", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234659, "uuid": "3f1f97ba-6fa7-401b-b2cf-70cc90068c64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234659, "uuid": "1a4ec9b5-dfa8-46f2-8dc9-a4828b628b18", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9902f61-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784185501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185501, "uuid": "ce262938-ca26-4552-8e77-6d4d8c1bc8e1", "comment": "Malware payload (RemcosRAT)", "value": "6d736c32770ad414f99c9d83382ff876", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185501, "uuid": "1b59acca-a426-4d09-bc16-295ee3bce261", "comment": "Malware payload (RemcosRAT)", "value": "839368bea44ee877cf7956a2229fd42b4457a1acd1170820b276669139e5ae3e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185501, "uuid": "62e5a8da-1b2a-4db9-a9bd-ac789ec472ec", "comment": "Malware payload (RemcosRAT)", "value": "fce7bbf8b3b7e08479267234ab0fa4af82c797e0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185501, "uuid": "3843b18b-c9ea-4eb6-b9d3-6e16af11fbcb", "comment": "Malware payload (RemcosRAT)", "value": "c6bf6ca3055743297e5234a80e835fa95753789b4e8fa0512c64e56614061dc7db0de70df6ada2a21d91ac2f706072a3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185501, "uuid": "24e99dd4-9f6c-4347-ad26-1cd97716cdce", "value": "T1403543B1855A5F02EDF6B481FDEA3F0F51BE03834B9E596B54ACB441905CA203B9CEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185501, "uuid": "c643035d-a4d9-44af-a3f7-3a7320b8bcba", "value": "384:eOG9p0Ue45TiRljroVYE3X6NDs4xjlsOIO1:cpgsrXC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185501, "uuid": "b758a0bc-df88-478a-bdd5-dbf563dd4252", "value": 1146796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185501, "uuid": "d605505d-0844-4bdc-9d27-45614e990b82", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185501, "uuid": "0a04edc6-ea85-4a4c-9408-a90c3de7f94e", "value": "1368377721.AWB.HKG.HKC.WZ0.20260714.154627.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14b649e-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225135, "uuid": "646cdb68-6fad-45a6-a73e-8b77738286d6", "comment": "Malware payload (Mirai)", "value": "2bcf18d066ad87b01a6743d2f238b6bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225135, "uuid": "ecf7ef57-a13e-49fe-b9b1-d9cc360e261a", "comment": "Malware payload (Mirai)", "value": "83e4b2808ebd2858f522562a89dcbe24fa1d8be4f1b314ac60017775660c3547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225135, "uuid": "432032a8-274c-493d-b5be-4873ed3c125c", "comment": "Malware payload (Mirai)", "value": "1174538a3eb0a3146060dd356ce04a5f68959b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225135, "uuid": "a66213f2-d004-4cb8-ba02-27d043a7a65a", "comment": "Malware payload (Mirai)", "value": "47997316d405da8ebdf804fb6d556d074ff09d72432b360cfbe12113cb5aa0831e05bb1838dcfb3d0ea852fa56c761b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225135, "uuid": "eb995bc7-f439-4d01-b2bf-b023aeccc34f", "value": "T1C8C37CC2B10D3DADD5D33E7CC20657176E1C9A529C83910250B6FA072AB76E71E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225135, "uuid": "fe8d9c43-4e3f-4eed-b947-77e98750988e", "value": "3072:gXeDSCK7kEw9PR+GDURoEcrNJdFov7baM0NQLLjyob:RDSfwRHcHcrfQv7b0NQXvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225135, "uuid": "3e5f4fd4-fdc9-4624-89a4-adac6b16b961", "value": 125260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225135, "uuid": "868f0732-54b8-4a6c-9e42-f5ce3bc9a0f7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225135, "uuid": "89c0e62a-8af9-466b-8035-f96cce2ac7fb", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eacb55-80e9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784187607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187607, "uuid": "cc26f4dd-1477-4dd5-93ae-70287d6d718b", "comment": "Malware payload (AsyncRAT)", "value": "a3777d40cba67aa88d5ccd9b876af0ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187607, "uuid": "da34563c-3c96-4914-b136-145985357826", "comment": "Malware payload (AsyncRAT)", "value": "846ccf956dabc8c403a9532fe3788cbb89191139091751cd0da782844b6db4d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187607, "uuid": "e3162267-4cf1-432e-af1a-89425a2d52f7", "comment": "Malware payload (AsyncRAT)", "value": "5f687ba006d1dff8a7dce07895ff512c457c01c6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187607, "uuid": "460e9935-be32-44d6-92b1-5965cf7cc1ff", "comment": "Malware payload (AsyncRAT)", "value": "7ecc270e182109b408e1f40778a85d4d99e365959b0f97debd477d4c73cb654d69c47aecdc06f9b0e610a29891af494d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187607, "uuid": "cb946952-f6db-49da-b8d0-501e978b60e8", "value": "T1F17413FACBC633EB814521F3352AF5B599922F422401576B32DC44B937FD5A07B2624A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187607, "uuid": "8ded3930-69bc-4142-bcd4-916b0835e9ce", "value": "6144:xhlARV+VatiD8lBs7OzwH8TnM2r83y23hDhRUmN8tw4n3bKRSXO6GOF6vlddBu:IwUtiAlmawH8jt23hDhf+rXXOHFpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187607, "uuid": "426bf182-9f06-4fbb-ab9c-f86159b7af53", "value": 350113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187607, "uuid": "4225e3a5-91b1-4da7-8f7b-6d4cb2532fb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187607, "uuid": "7a66962a-3d45-4726-a40c-0edaf019aa19", "value": "securedstub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4884b4-8113-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784205420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205420, "uuid": "10e2fa5b-b4b2-44ee-9bf2-7b303cb592a8", "comment": "Malware payload (Mirai)", "value": "cf8d910f56abf40b45f9a6a2ae79bd6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205420, "uuid": "fc96b782-a792-4355-9ed6-30d25648c9bc", "comment": "Malware payload (Mirai)", "value": "8489c844b63d8bd37a2361a0b17cf4eaab5b7dc70c9af72a6c8489c7fe108ba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205420, "uuid": "88e88e46-56f4-4b7a-9bb2-02c1c64b6763", "comment": "Malware payload (Mirai)", "value": "a00bca49734a96c7354947e0886b3573e73d8acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205420, "uuid": "d3f7c03d-32b8-438a-a67c-bc826343c7e2", "comment": "Malware payload (Mirai)", "value": "ab11066e1d3a3589e017f185ff2aa6898bf83b2eb9105a4fbb66262e18fb2109d64030d2cefd85278e7a303de073d3a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205420, "uuid": "d59cebf5-433f-4162-9786-bed0de0f6ec0", "value": "T136D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205420, "uuid": "f8cb5417-ff34-438d-a773-a96ca958408e", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zh6:xOFgpOEoVv3MXL5NhGOh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205420, "uuid": "1ce7737c-4594-4cdf-9837-ce14867e90b0", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205420, "uuid": "e2fee161-495e-4f57-affc-938542bf23c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205420, "uuid": "a2df89a8-31c1-48e7-bb38-9b000ba7a2aa", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb6ab32-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184887, "uuid": "d1b22a20-8d38-454d-a127-ee07240559a8", "comment": "Malware payload", "value": "e2236f317e4ac64b4250bcd5913d6f52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184887, "uuid": "26aa2b0e-3140-458e-8a14-d0ee81a66323", "comment": "Malware payload", "value": "869e06a2d1c681254d13c3efdc780fdf8f9e9014e568b645223cf667b52c5b63", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184887, "uuid": "340eee19-b5e9-49fe-8d51-46d5d8ddf3da", "comment": "Malware payload", "value": "b252b32f5ee766d113343a3688c79fa87968ac8c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184887, "uuid": "ad8cf044-8e6e-4e7a-b65d-00d8478a4c06", "comment": "Malware payload", "value": "cd685b2fb75dee24b6c56f050fb3ee1cad7694ad41a33affaa2c3a58aa1da6af681bac42ce78593df85f6f2c72ebb79d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184887, "uuid": "93ca548d-4e12-4d08-8919-54b3692cd8d0", "value": "T18085E512F602C22FC69041321C67EBF923787D15CD1996AB756EB31E3EBB318DA86351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184887, "uuid": "b70a8b44-1ecf-43e5-9c56-ab1780252865", "value": "24576:CNwi/4ZJ3Mxi6mwq9UMatk6Xrt6ELSLXCLw95t/6YUxyGq1hTAGKMPh61hZUhOhN:pY4ZJ3M9q9UMaGeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184887, "uuid": "b3a78d80-4bc3-406f-96c6-bb0cd6f8abf7", "value": 1786368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184887, "uuid": "63db4aa4-a001-4fc5-af63-f849e8c43b0f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184887, "uuid": "9162663f-acd3-4186-8f95-b2c4e56957d0", "value": "PRI0023_02305_Letter_advising_proceedings_have_been_sent_to_court.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8082f4b-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784185954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185954, "uuid": "0c670bbd-7cc7-4465-b40d-6f418cb0fce4", "comment": "Malware payload", "value": "3bd7b0599726ddbda52294ed37f12990", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185954, "uuid": "e442e456-7dea-4bc9-8038-8d65396456b4", "comment": "Malware payload", "value": "86e837c12b23dd81bb10462d35daf5ed98cab10cb0c032df65acf76d92d3297e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185954, "uuid": "1cf0bdcb-aada-4cde-b2b3-d07cb645fd0e", "comment": "Malware payload", "value": "5127926ad5a2a81d295c0c8e3d035c22930e0de0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185954, "uuid": "747cf0b1-6051-485a-ba23-c51e9feec514", "comment": "Malware payload", "value": "69db1989d0f7b6c1148eac2d51561fa3b5a4602b1768f880ec28da8ffd8d29dd9f9cde6c7ceae75f3a8939ccf73f0e25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185954, "uuid": "b25ec69e-f24a-466e-a1e0-81fd96d4a33f", "value": "T153C28D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D4B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185954, "uuid": "14d44c37-1dd5-4c32-a726-d9127845b74b", "value": "768:18vCB+25j6es8RR79FYpMSUpi+20qUpi+20YQX:18l25JRNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185954, "uuid": "17e52b49-4f4f-45fc-94d1-8760f6d57187", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185954, "uuid": "75e297b2-6dc5-4bde-b4cf-a4f8ec8a989a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185954, "uuid": "7a1aa254-7498-49cf-9de7-d09439a5ffd5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9199a8-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186450, "uuid": "5a04e06c-4548-4066-b532-ef640a6f500e", "comment": "Malware payload", "value": "81d0eb84d19d5cbf9a02e27a7bf05c67", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186450, "uuid": "19b2e011-af85-4b44-9247-04195058f9c2", "comment": "Malware payload", "value": "8711ad12e93cecd296f29963de191eef3647b3f31943b51e929b6d73dba98df5", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186450, "uuid": "cd249cc9-3952-4cc0-9bb5-210464e985b9", "comment": "Malware payload", "value": "2cab1f89d9c87f9d22c6848bfa91d11989e43b60", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186450, "uuid": "5991705a-362e-40c5-913f-03e44804298e", "comment": "Malware payload", "value": "1a66ccacee869e81bced4de1620172427e9d769bfc2ab0dba9976335967f20564a195a2ddce21e5e7e92b09a59c6a45d", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186450, "uuid": "4aa992d7-ca0d-4216-8c3a-d817e043ae76", "value": "T18805E168E12A18FADE135EFCD58F5CE6491AAA530AC1402133F947E1EA103745C9FE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186450, "uuid": "546ae45d-c7b8-4d0c-bc23-a0a023723306", "value": "220eacec969cc2e4a149c16a44e0e0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186450, "uuid": "4f14f80a-7c14-4f98-ac86-5a77ab46efe9", "value": "24576:HtLUIaZy/SDnzDuYulqsndPn3OSOqYlPuRzhIgCxZZ1:BUIaNDPfulHP3OVlOIgCxL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186450, "uuid": "b4c2a56a-b1be-4bcc-a98d-4a1839d706c4", "value": 827132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186450, "uuid": "f05a2ad4-36cd-458f-8948-e7da2a2a5fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186450, "uuid": "edc7f44c-96c3-469b-9e2c-1ca34ef01163", "value": "netutils (2).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec59f012-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784185183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185183, "uuid": "3f47f30c-5d1a-4355-ac09-73bca9eb99d9", "comment": "Malware payload (PureLogsStealer)", "value": "18c4d52042380909947b52212e55260f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185183, "uuid": "cf30b9c4-c9ee-4258-a32b-7ce08f679504", "comment": "Malware payload (PureLogsStealer)", "value": "873285553ff9bd98ff57d48bcf9e9846e74f926a657b47009e31194d3430bf5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185183, "uuid": "c535bc8b-48c1-4dee-bb3a-be9ba7fa616b", "comment": "Malware payload (PureLogsStealer)", "value": "af138b85773f3ce224dab3a12f17a5fa779bc7f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185183, "uuid": "6d91819d-0ba1-49a4-aa95-9f62277ab0fc", "comment": "Malware payload (PureLogsStealer)", "value": "53fadfcf40b2ba1d436b21cba7db84cd01f5d81fe0a1f3069d4a2c0a51ad11371d458fad8f8721d7d039e3bf6f07c601", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185183, "uuid": "69a596d2-5341-41b7-8e0f-481dc2073faa", "value": "T111A54C2997C004492773631BFFC595EF685E6AA323EBAE2C51B50FCE035354A59F8328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185183, "uuid": "d4825424-8a95-4b9d-ab0c-27411c30eebd", "value": "12288:zumWUcPtEtRwMs6qaPxk1K9oSkjBzCTEosPuGeKNfJuOK:z3pw6VTr0/vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185183, "uuid": "65693359-87d2-46a0-9771-aa493d2b10ec", "value": 2149736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185183, "uuid": "04f08b82-f290-4988-b902-0ec9d2e794c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185183, "uuid": "f5c1950f-7d9a-446d-bf07-dd316fbacdaa", "value": "output_1ys7kf35.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db758c7-814c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784230041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230041, "uuid": "69ce4456-84d8-40b3-b6e2-8d9d8a6973b5", "comment": "Malware payload (Mirai)", "value": "3a1e90e51b611c32e1ddc20bc0e85ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230041, "uuid": "5bdfb2b3-39b8-4e2b-83fc-5071f58f69ec", "comment": "Malware payload (Mirai)", "value": "873683d14ca42f34d8b0cb76d2e5e9bdb305d1b4ea767177f37e4a579087c3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230041, "uuid": "a186a69f-3475-41f1-81fc-9c8a0c96e676", "comment": "Malware payload (Mirai)", "value": "b16efb6e59809a959a71e4d13122a712ea4fd58d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230041, "uuid": "d44fd8c2-b9cb-4f8a-a791-0cfea6978ffd", "comment": "Malware payload (Mirai)", "value": "6bd2a338e71b80a9c56f4f5ca1fe55c0d121c5a7a973473784564d52e787c2be75108987a5c11dd880eecc75e881ca06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230041, "uuid": "b68d887b-41d9-40ef-8273-f0c2194a435b", "value": "T11DC3290ABF620FFBE85FDD3706A91B49248C950A11E97F767A34C418F68B14F09E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230041, "uuid": "10ea5fa5-e81f-41c2-8d5c-c2c3cc9e2338", "value": "1536:6SRmf6Nv4NkuO6gAB+/spp3o8/ECwnJJN2adAFLMyRM5jpAAE1AIwAPtHr:6SRm6wdpp3ExdAFLMyRMNcw+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784230041, "uuid": "780f09f4-08b2-44c0-905c-0554f21d780b", "value": 118480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784230041, "uuid": "2ce6366c-f413-4132-880a-db76c55b7b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230041, "uuid": "ade3eded-c637-4bcb-a1f4-0c32e5790c14", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1af6636-80c9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784173918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784173918, "uuid": "b5d7487f-a5d0-4220-a815-62ef28902c87", "comment": "Malware payload (Efimer)", "value": "1df12e0a34f3ab3f60753b198b2ef14a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784173918, "uuid": "7794bdd3-0284-41e7-9115-81fa468e738d", "comment": "Malware payload (Efimer)", "value": "878b62fe2e800854eb3bf28e9fe3281a8b166684379a8c4bce24c18e79666242", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784173918, "uuid": "5072e5bc-e086-4287-91f5-6253807cc3df", "comment": "Malware payload (Efimer)", "value": "694b935f765648e19c27db4179fd9a175536a448", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784173918, "uuid": "7778bbea-9691-4187-9b2f-cf978d67f5b5", "comment": "Malware payload (Efimer)", "value": "343194df35339a666bcf45f11ce57e940d31976017f988acd5ef05d4f33a6725e802c6310c99c03880ed77880848b3bc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784173918, "uuid": "d4bfb2d4-aa1b-4300-8be6-225bf70d004a", "value": "T10CE6332C94C951AEEBB3413CBEE0C24AE50A78761774C8DF0B485366AE671F58D3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784173918, "uuid": "9d1acffe-22e4-4eb6-98a7-32075d6dc97b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784173918, "uuid": "cfb70987-b800-4657-836d-22211b3aeb81", "value": "393216:2AoTLiB1SCLEznYj9t/mQXMCHWUjXrcuI3/PGTAI:2dLosQEznU9RXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784173918, "uuid": "00ec7570-e041-4ac9-acb1-a13d0c470d28", "value": 14319237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784173918, "uuid": "0df78264-c6e7-4f89-bd30-f26ab270c3b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784173918, "uuid": "df8b66b0-fd98-4521-ab13-6d6f44afd1ce", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37deaff5-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212798, "uuid": "1d49a9e1-7e50-482d-ae93-c4cb308d490a", "comment": "Malware payload (Mirai)", "value": "f2e62b8d36b938dbdbe85e07083d0320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212798, "uuid": "6d66f9c1-ad3c-48ac-b968-6482ef8de58b", "comment": "Malware payload (Mirai)", "value": "88d42a3d34b22b7ee069e9074d1ee5423b43cc8488561e93398532ab39f5b850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212798, "uuid": "dba8bf5b-f65e-46d5-9ea3-6e979471d8e1", "comment": "Malware payload (Mirai)", "value": "21e361861360a19a215f2afab3dcd53c5b704896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212798, "uuid": "6d29e4d1-c9cc-4f9c-adb4-ee0da1809dc8", "comment": "Malware payload (Mirai)", "value": "5175918f62708cfb911086090440c9992d53fe9bd514979117e492b1c34e456ca9c059ca69570ed23042761c6ec0da9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212798, "uuid": "62c331dd-623e-4511-ad7c-6447e2321580", "value": "T160F2F1365211CBF1CB3840B1F8A9C047A9D1A36CE427B4E6E6409798DF67D8B69F90C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212798, "uuid": "bffd3381-bb9a-47ca-8d17-3541e77a61fb", "value": "768:EKiQ47RQHFOahiUclVghi6PqA8ttISfcOn2MF9q3UEL6W:mx7dahglVgh5Gtt0CALf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212798, "uuid": "fe6403ec-a302-4f82-87e7-fd9d2dfc8244", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212798, "uuid": "aa7a31ca-00bc-4ce4-a77c-5ceb9541374b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212798, "uuid": "0e11271d-f584-4977-9ccc-94a016e8f050", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71f29d4-8148-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228446, "uuid": "23d2a4ec-dd07-4e26-a9ad-e10860899aa8", "comment": "Malware payload (Mirai)", "value": "30a25687825912f7365334a9a416d446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228446, "uuid": "fcb82911-41d6-4b5e-a3fa-068e2a2479c9", "comment": "Malware payload (Mirai)", "value": "88e1502ed2877d30ec4d998d9675261c60221b0819410a3be25949e3c6263f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228446, "uuid": "6947ad9c-deab-4bb7-b273-6c96027925a4", "comment": "Malware payload (Mirai)", "value": "154319f5d85ce07cb02ff4f6b65cd846f4574821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228446, "uuid": "d0e62f7a-0880-4050-b325-7341bb6cd08e", "comment": "Malware payload (Mirai)", "value": "3879cb034c167c0f44c93000657a0c585534bfc4fb9f3902cf1eb585ca42fadb8187f63dec9570d4bfebd25af4ff7d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228446, "uuid": "e5d733ee-8c3b-4d46-a6e7-5af2cfb3dfd4", "value": "T1418312FF9DB50FAAE8E513791A12CF43FCA113CE5A6C5F8681609C9C0D68A64C871A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228446, "uuid": "61f67921-df3e-4b6c-90b3-84e4e1b4ed72", "value": "1536:Ir+Ux4vcszg67RDNqe4ljUtbzj32w2WGo9QOPjQc03g/NSHFtnWb0eQjipy:gnavcszgiRb4pUpjNGCZbQc0wMtnW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228446, "uuid": "eed9daf9-f899-4f70-b9ee-52a115533e21", "value": 81708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228446, "uuid": "bce62cd8-f4f2-4a75-bd11-5e952440449f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228446, "uuid": "ed6c4985-1035-434a-a70e-f6643a13e464", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282f2c4c-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234676, "uuid": "53b1019d-038c-48af-a509-0308dd43e7d3", "comment": "Malware payload (Mirai)", "value": "1f316a02f6aba575a00c1a248ad2425f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234676, "uuid": "017cd68b-a17a-4b30-a813-4e50e6e66ae9", "comment": "Malware payload (Mirai)", "value": "88f044a3aaf930525efad1ae6cc5052b737a79c7ef14042e03969fcc39030b0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234676, "uuid": "5a52eb7c-8c12-492c-98d4-d0645bb3d034", "comment": "Malware payload (Mirai)", "value": "1f963d22925aebfb4ee8ba0a2fcdad80318d736a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234676, "uuid": "62556512-d50f-43c0-8624-08fcd3c1301e", "comment": "Malware payload (Mirai)", "value": "6111e131dc73bf39c406ffd79e413bd9c2ce8bc573265a1815696c070f7fb074daf687a3bfd7f13683f5c643db942ece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234676, "uuid": "d43d80fb-72d0-440d-8cf8-4defd531f5b3", "value": "T1A2E3D80E7E258F7CF795823447F79E1A965833C637E1C585D1ACEA012E2068E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234676, "uuid": "41b353d4-b2dd-4f42-9eb3-afd7d6c2382d", "value": "3072:JYdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elp0BT7XP3nh1otDPrK7mF87mYtbQ:+dK+SE7ktsNOT8wR41M7qlkoKrMh8XQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234676, "uuid": "713b386b-47a4-4295-af95-84bbf16f10f7", "value": 153388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234676, "uuid": "d44ebae0-506e-4805-af73-981831bd0b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234676, "uuid": "dbfc3534-319b-4693-ac0e-d43de9dfb0e3", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f5f3b4-80ce-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176118, "uuid": "c9efda6b-7822-42fd-b246-85fd6c104c66", "comment": "Malware payload (Mirai)", "value": "c7f991fc931c39d82f0dd9cfd9407dd3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176118, "uuid": "11f44b64-e592-48a4-b963-5303e182a692", "comment": "Malware payload (Mirai)", "value": "8af2a43024cbee3b82015d4dc64247500bbda19a3f09807277f32a5fbacde702", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176118, "uuid": "1ef0fcc4-7733-4e97-bbf0-0b3631ebe2f9", "comment": "Malware payload (Mirai)", "value": "23b0f8eeb603aa7a231b128c40dd4d68fb273da1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176118, "uuid": "63160bda-6acc-4db5-8320-8af91ed01349", "comment": "Malware payload (Mirai)", "value": "9da356aecb1eb11f85fd5ce1d04743da4f63d2194f07f5d7e74d4166174b9356db5a4468feb4e430f2b6eb39356e46a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176118, "uuid": "fdc1c938-18d1-4aa2-8443-cf263b9661da", "value": "T1DC110AC9321839E731CE8E0A34610C11BADAE094DBB20AA4588D5C6B94DCB5A771BF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176118, "uuid": "50f6be16-476e-4e26-9e02-8f5c8c0e7eb4", "value": "12:qXsXTqyqHXsXTqwXsXTqf3XsXTqfXsXTqqXsXTqFXsXTqEXXsXTqqqHXsXTqey+s:qcnqHcbc8cAcBcgcVXcdqHcxy+NcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176118, "uuid": "2e2e8cf0-69a0-4d61-9ded-098af8d969d0", "value": 960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176118, "uuid": "9e6df301-9c7e-4001-9e6b-5c5c65c09990", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176118, "uuid": "7a96aafd-8d46-4e5d-b4b6-9810cfa6f8b4", "value": "wget_gpon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4b3748-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1784185207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185207, "uuid": "08fcf965-d28c-475e-b6af-e3a525d3f46e", "comment": "Malware payload (SiriusRAT)", "value": "8c317d4b2ac8fb8e8ba732dbf454a65f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185207, "uuid": "9612de60-95bd-403b-9161-4e578b24d6d3", "comment": "Malware payload (SiriusRAT)", "value": "8b6d4a7fa08aa0698393495fc84368c275fd145616eedb9b6e458bbf4eda0531", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185207, "uuid": "80693031-1554-4f07-8cc8-e9b7b54bcc43", "comment": "Malware payload (SiriusRAT)", "value": "ef27b1301bc9131d60ef95db429fa1109153ca9a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185207, "uuid": "79dd5968-a751-4d78-84c0-7768c593f0f7", "comment": "Malware payload (SiriusRAT)", "value": "df738538b34217d96681cd0dffe30341629e7bdcfe83e9928b7f2324b1d17ef0b3e6ed0ce37222d72bee2ba94939233c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185207, "uuid": "af10b35e-183a-4271-876c-0347432a2b9d", "value": "T17385186CE56A22121837E3B0BFC15D76F12B2EB6722A552341C8074B4F5AF493DC973A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185207, "uuid": "9738374e-5793-4983-a373-849601a6a119", "value": "6144:/bbrGaWeSpBxhPtPWDOHcHXa5J9KXvR9MLx5e/y1AvOeejOcZddMVRxPzkRBTwLi:/bbrGa56xJterzMFAveqydGdzkRFnDlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185207, "uuid": "52e5e216-c9d8-434f-90fc-1674ed068c85", "value": 1872076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185207, "uuid": "6ef2d4f1-de50-4c61-9be8-8cd4cb5dcb86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185207, "uuid": "c02d79ee-f475-46f2-8c85-55a8e7484630", "value": "TELEX RELEASE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b0f222-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784163838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163838, "uuid": "de558d8b-6b77-4054-8dc9-14add5433504", "comment": "Malware payload", "value": "70c6c97d699a63a2e556b92d30a86dcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163838, "uuid": "868539db-b692-4b6c-ab5d-cf84d5e92f8f", "comment": "Malware payload", "value": "8c0f9343f5eeb0393a7d633cbb5fb819d531e35225496815cff8462e90db864b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163838, "uuid": "0d97615c-30ca-4dcb-a6b5-be92330a3cff", "comment": "Malware payload", "value": "1211e9425a96698908374a6120a8294821afb57b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163838, "uuid": "2389164c-d2bb-49a4-b45f-a538fa3a87af", "comment": "Malware payload", "value": "dc4d77a42aa915ab8e476a2f7c592bb84857a96520e830e145818d828ae1f53f73c35b4274af89705ad0c9174bd4572c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163838, "uuid": "f1806b4c-db3b-494f-898d-5a93503057c0", "value": "T11A1533FE9CC65782F1D6D6F22C70ED07588879BECA799C29BE2059F94D3C03052116AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163838, "uuid": "a92cfe0f-743a-4a91-b292-ac9008be748d", "value": "12288:fOzD20ewxavZGuJqqX9lNtsKvoZiL9KjmmkswHorrDPnuY30LcDkAKUUy4el4F93:GNxMZxqObN+KKjmmkZIDPuYkQoA8zyhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163838, "uuid": "7d7442f8-8b2b-4fe4-a4b2-4bd603cfa8ba", "value": 885484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163838, "uuid": "5f90d11c-56fd-42ac-a0b7-976de8ef34b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163838, "uuid": "1a412ff1-6ee2-42b6-9756-077f43bd0417", "value": "vartmp_1c18d769_085aa012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68954cd6-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WSHRAT)", "timestamp": 1784185392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185392, "uuid": "e92086c1-59ae-4832-aba4-c6b532866eb8", "comment": "Malware payload (WSHRAT)", "value": "8b2bab2a311fb6a725363e5c42188394", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185392, "uuid": "22f085af-280b-4b50-912f-df01d12a8806", "comment": "Malware payload (WSHRAT)", "value": "8d9cb645739b4b6bb291dcc4c539e63fd5b674ebf89bc939b1d03c5e02931cdb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185392, "uuid": "e1b372f2-3a0f-46c5-98df-58ac6586b526", "comment": "Malware payload (WSHRAT)", "value": "3d5d0a8ba024d969c61cdea6bdcbc8cf8db5a84e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185392, "uuid": "06825344-b5f1-4853-b079-3368ec830dad", "comment": "Malware payload (WSHRAT)", "value": "fd3c9da67ad8f24843bda99356a71866eabde0e73ba610be7a6da1be0af6c70554ca00222aacdb77af3796c6d29e886c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185392, "uuid": "ac390f9d-7ee7-4616-b8eb-fe3232627162", "value": "T11F640B846DFD22C70360F10F6FA1B33FC5BB6025B8A14DBB44866B9B9119D625A237DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185392, "uuid": "1bcbacb2-b002-4361-a8eb-693038246658", "value": "1536:Zv4wu5h3VB4/HjheQzoJuQfKt3T3fVrC83e3G3aQD8wRJo5O+VPCWYN58Ypu3BgW:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185392, "uuid": "aaae2a7e-3faf-4063-b364-f2f1f4510b78", "value": 313037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185392, "uuid": "d1a72bc6-c26c-4ac6-95d9-3c9896e8e7e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185392, "uuid": "c4a1ba2d-2af4-473f-af7c-e5e6070f0d5c", "value": "oke.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3850846c-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784163836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163836, "uuid": "fe2fc93d-fa48-4f1f-a88b-561e3c75f9de", "comment": "Malware payload (CoinMiner)", "value": "530d0a4764964139bac25ff852a904bf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "sshbruteforce", "colour": "#33737B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163836, "uuid": "f7ff3ca9-6e5b-4322-833c-ec731481d395", "comment": "Malware payload (CoinMiner)", "value": "8f225e59f3b892c7ed440db4c913491f825ccd64792cb759b55563c1b1310ece", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "sshbruteforce", "colour": "#33737B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163836, "uuid": "97f7793b-2e15-4569-bf62-7dc1d33f935a", "comment": "Malware payload (CoinMiner)", "value": "ce87865d5edb9c1545ac5dcea7017a96788e7b28", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "sshbruteforce", "colour": "#33737B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163836, "uuid": "03ea1c70-30cb-4508-bb32-f4af6be4868f", "comment": "Malware payload (CoinMiner)", "value": "055bfa0d0314e0b8ef854a2590e9013544a0bfb391b24beea8ce1615e85033e03637e434d708eb6be6fd74eff76603b0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "sshbruteforce", "colour": "#33737B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163836, "uuid": "0e21372a-a5cb-46c6-ad67-01fa668ac5cd", "value": "T116E533C7D0BBDAE7E49ACB5AE2757B181E8442324CD35F10D6C9F52939FB868130225B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163836, "uuid": "a16c2dfc-6a4f-4ca0-afea-1bfed96f2b4f", "value": "49152:A/lHojpUZD9iooMBte8aD4my+6Aldo9uq0JjBbyi9eTDH88L/VJNTOOfcVQEn:A2jpwD9tZeV81wly9uq0399eTDVNbTXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163836, "uuid": "2daa8e0d-5fc1-4844-99f3-be48689a0b54", "value": 3144840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163836, "uuid": "f8ab39de-7af4-4a22-a865-95cbb4e93a41", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163836, "uuid": "539833b2-0f40-4a09-8321-a6f902a838be", "value": "kuak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d21f477-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784245905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245905, "uuid": "24c8afb5-7ba4-4842-babd-c8fb8c3c3181", "comment": "Malware payload (Mirai)", "value": "4535e89776b3803c6570acb0afdc83ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245905, "uuid": "882ba5b3-f1af-49e3-a006-dfc94039e9ae", "comment": "Malware payload (Mirai)", "value": "8f8343033b9e1dc3f62527ab0f24ce3d774dc7ea3d54f2d5bc4805bb9360319c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245905, "uuid": "e487fe6e-39bc-44a5-819a-2101f031ee3c", "comment": "Malware payload (Mirai)", "value": "d4f370776180d3161a031dda2cb27a4e77d8c0e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245905, "uuid": "7a1cc9d7-beb7-4c23-b107-ccb98d898840", "comment": "Malware payload (Mirai)", "value": "56753ac006d9c642239747fcab298c2a3b727e93e2c298d485b728c26684a42ea2479042af198369e6cc623ea386098b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245905, "uuid": "f6f35e9c-0440-4775-b0b6-cea032b6e5de", "value": "T13F466C06B5A315AEC09AC430876FC6136D35F85496327D7B3A849E342EF6E245F2EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245905, "uuid": "e51a3163-e1e1-46f5-83ad-b16d031645cb", "value": "98304:PCQboyVgQegbdTD1W0+48y9+5wN96duTZt4iptZJ2Y3Wy0879syuFM4WxMHww6:ZXpH96fiT2Y3Wz87CyiM4WxMHww6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784245905, "uuid": "2014dabf-b8f5-44e4-bdff-45c5520d06a3", "value": 5854080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784245905, "uuid": "317730ad-674c-40e5-8b24-69b690014756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245905, "uuid": "8a894d52-6258-4718-9b52-504d7c57fc82", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c478889b-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784185546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185546, "uuid": "2c395032-8dc0-4055-8aa4-06184fdb6642", "comment": "Malware payload", "value": "d133ffc4569672bfe8e7171b2bc05031", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185546, "uuid": "defc1c1c-d783-4bfe-822a-deed9bd0248f", "comment": "Malware payload", "value": "901f3f3add362204fe7c09fd521a0d9eee914389a50789702b24c327297a7205", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185546, "uuid": "33490437-3ef2-4024-9f3c-0cc7f999f131", "comment": "Malware payload", "value": "1e5c702393f10eef969361f53c6f6b4319f7d61e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185546, "uuid": "eb4f4bd5-40de-4d59-8df6-129742be57a9", "comment": "Malware payload", "value": "422f3e8110c5112e9495df2c29863cc626a51c56867e3d6487f1ebe203b164bfac2df05a296f3c4eaf54b610661ca2e0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185546, "uuid": "803a8144-140a-4f3e-871a-a986f72f6d95", "value": "T158D1671368E710C9E06B47750FD8F5FF4A7AE4171A2EB5F62100D745CB30BC88A629B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185546, "uuid": "a720a575-865b-454e-be8b-2d04355af2a8", "value": "192:8hPpcCRKmc2a+2d6eHxfk8fOwUjrvYt5icy82:EPpcCRtc2aHd6eHpk8fOwsw5icyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185546, "uuid": "1a37f995-caef-49e0-b7eb-e8dbd26fd28b", "value": 6425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185546, "uuid": "252b7d93-b155-4241-a4ec-d799016ba5ad", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185546, "uuid": "3aa89d2c-9e21-4a56-9de8-a10f42dd197f", "value": "IMG-145388.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91993457-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784246019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246019, "uuid": "2ef91c80-469b-43aa-83cc-e21177e5b847", "comment": "Malware payload", "value": "6317f11b50b4ee274c61c9cc72e67ba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246019, "uuid": "29991249-0d19-4cae-9841-5af5f59c923a", "comment": "Malware payload", "value": "9082d1bbe9998076cbc823607eb229b2990fc9c0ef41225966761086583d2388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246019, "uuid": "5c2d58aa-39f2-4699-ba19-51cf9f2cbb54", "comment": "Malware payload", "value": "9cbe1ed7a1cd96949c9e9ffff81a750cb56d6d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246019, "uuid": "491341a5-20cf-4238-a8c1-942da20d4c65", "comment": "Malware payload", "value": "32fc407ed3783139e483750a9d20716606aadd60850ca164fd7b9e942bf778bc9db4bed958bed2fe717dbefce45d04df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246019, "uuid": "1f8da21f-8bc2-4650-8e75-f7a50d5b3860", "value": "T19C43F11029012BEFD5E50C37B42B430597E64ABADA3675B06C306F79BBC665BB4B048F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246019, "uuid": "2141787a-c408-439e-a95f-1e1f6067b2e9", "value": "768:hmKBnBAqA+iXd1iqgAfSplB1cB0IEYIQh/2hH1uk2R2bRLdhgQy723U03wf1f:MBRZXd83A0lYIQh/2hH1u7RIrM/fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246019, "uuid": "6a3201ae-abcd-4ad9-9ea0-6d308092b39c", "value": 55164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246019, "uuid": "5534afad-78eb-4b0d-965d-2f7bb293d923", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246019, "uuid": "7842705d-aa45-49ac-a474-7af3861a8312", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617c4ed0-811c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784209431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209431, "uuid": "d9cb445f-fb30-4cc5-81ed-2ee2af8d59bd", "comment": "Malware payload", "value": "58d2ee6715655cc1a189e417c4275d99", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209431, "uuid": "28143ba7-6ff7-473a-b74a-d9250c56321b", "comment": "Malware payload", "value": "909098efca77d6cc2a3b8aadca6fd233262a985040447f06a27acd168ed411f1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209431, "uuid": "703a809c-5dfe-4a8f-ace1-ceebe040592c", "comment": "Malware payload", "value": "45fd5e57db256b9a921c2321c391e4324d1725ad", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784209431, "uuid": "20b19b18-f2d4-4aa6-962b-7c588e592599", "comment": "Malware payload", "value": "95627fbe8c2200fb253ae15ab98d03c5b77a17bb44d6b568f5d536431c450e6efa93f819d781263fc6a4d90dd794296f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209431, "uuid": "81a35b0f-fea0-4243-827b-7d6ef5eea71e", "value": "T176A6339079CA77F2C083CBB16003A6AE713D7FD47E228E0A7A5936454D3271F997A346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209431, "uuid": "ffcc7c19-831b-4c2a-b79e-ef292ac667bb", "value": "196608:0JeyvPhN43p2OHX0g5+3rJw3GErehaiTXfRF6+Acc4NagVOts6Dy81wpnTZp:k/vpNQp3XSzE7if+Xsa10f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784209431, "uuid": "9d5b1256-99bf-4103-8e81-6a86230b7fe1", "value": 10051584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784209431, "uuid": "32f352eb-978f-451a-a5b9-944092b0e22f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784209431, "uuid": "45c1d5a6-3efa-4a23-bb74-b789455ef470", "value": "appinstall.8835004.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf89c677-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186396, "uuid": "2bda09fa-fe88-4f1d-a234-e69226801bdf", "comment": "Malware payload", "value": "3088d1b4cba78de68c6f1d51928131b8", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186396, "uuid": "035493ee-530a-40fa-896d-a9963a67ce3c", "comment": "Malware payload", "value": "909dfd9cc8f2bd21b623a9bee5e335259c37dd76e1a8f2d5c6ad4ba3096df917", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186396, "uuid": "c6c2eb42-1b79-4bc5-a072-dbe0fd13c8c5", "comment": "Malware payload", "value": "56798b782f9024cb504291c782d49997f8e1a46d", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186396, "uuid": "8c03963b-b224-4859-aa80-4bd77f36e24e", "comment": "Malware payload", "value": "5aa80716c572a4e2b5cfde7b9cdfca59708d0eca988684898d2ac1a92cb584769555674a5b5897e084590ded71d3c23b", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186396, "uuid": "09086f0a-33df-42f1-b5c1-05f38288ee5b", "value": "T11D25E039E6951D78E92F0AF8104F49995A5BF2620F4300DF36FD81E58F2C3E0593AE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186396, "uuid": "792edcb6-6cf9-44a1-bd2e-52ad6bb93cac", "value": "12288:ea1ib43VXr2mKvNSn0KMVRRgqPZOukep2FP8FZgFEHYNnwpP5w:T1ib43V7fKLKODOuDQ/nO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186396, "uuid": "5512eabf-7c30-406c-a6ae-a3d249687c1d", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186396, "uuid": "25970729-32c8-4193-b995-dd299923da0d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186396, "uuid": "65285f9e-3132-46a3-a0f7-192f486bc11e", "value": "909dfd9cc8f2bd21b623a9bee5e335259c37dd76e1a8f2d5c6ad4ba3096df917.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffa3b4f-810c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202718, "uuid": "3dd78fcb-5a40-4398-8ff6-dba25fd404d5", "comment": "Malware payload (Mirai)", "value": "5fd97c98736806afcefa6d3858372a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202718, "uuid": "1507322d-05e5-4017-a6bf-671602bff4f1", "comment": "Malware payload (Mirai)", "value": "92661022cb30df9ef25cb6856260de142cf8569d91260137cf19102fe1c51138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202718, "uuid": "68b0ecf5-09c9-4c35-80bc-9c3470ba8c9f", "comment": "Malware payload (Mirai)", "value": "22f90a4e76efd96bef17c80f474fcfa756807752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202718, "uuid": "ddedb8cd-6b1d-4e27-aa15-ed450498eb92", "comment": "Malware payload (Mirai)", "value": "5bca1c39d3cea4928f7f4a1117f4829c620c9e6a33a9cbf89a712afaf80604f13d9dbace34e376b85372c86ff99e362d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202718, "uuid": "0baebd5f-3a98-4aa3-ad72-d0a7de5631d7", "value": "T106146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202718, "uuid": "88787929-1a88-453e-8b2f-589569fbe0cb", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtR:BZAyFzQSdS7IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202718, "uuid": "40be9b36-b542-4484-b286-bfb7dabfa894", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202718, "uuid": "a33430b0-7868-4f57-8a94-462bc4b327b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202718, "uuid": "a5869d3d-1902-4344-b732-0caeaf1e83eb", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bc40c0-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185434, "uuid": "d5f50fdc-2c6c-46ab-8af1-45279fbcf6f6", "comment": "Malware payload (PhantomStealer)", "value": "e454932f7a00399bd9c048d7c8e5be11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185434, "uuid": "fc216dd3-b3aa-465c-ab27-1720c47ea922", "comment": "Malware payload (PhantomStealer)", "value": "930559003ecb388df5d555904a64e4468ada377a1e5355126361894a435df5b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185434, "uuid": "7a9c89fc-b0f4-44f5-9392-94c3fdad104a", "comment": "Malware payload (PhantomStealer)", "value": "1968a8bd3e469107d544f7a865b05fe1950c9ed7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185434, "uuid": "1b0fa065-6c47-4ddc-888f-fbea0deeaf72", "comment": "Malware payload (PhantomStealer)", "value": "8e78bf816fd72d2c9b9a7d4ca8dae780009e666bea996a5c23f8b3d59a1fb6bfb5de9772a2413a5f35154d0a66ac7a12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185434, "uuid": "49733689-c31d-4672-a253-9b50f9d1c6b5", "value": "T1A8A53C4EA3E180118B67C211D29D1464F87E0617FA453FA4A49CCAE8FB16E6D8CB7D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185434, "uuid": "00a4cb6d-ef43-4451-9d67-a7f86d6c8847", "value": "96:9NcUl4h/7CXSZoEm9srF7F5hz8KyQ0kflEpX1PKQPQtpS4JUQS:AUlKDCiiEmmnNyQbf+jCQItplJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185434, "uuid": "b3118bbe-acc5-471f-be71-35acf6956fdb", "value": 2175650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185434, "uuid": "6558f640-1c4a-433b-a4a5-3079abce89e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185434, "uuid": "4db82167-bf02-4aba-a70b-d88f12815e01", "value": "REF PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88ef682-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234596, "uuid": "153ea919-58b2-49dc-93bb-4a80cdf2fbe1", "comment": "Malware payload (Mirai)", "value": "18bf589984f54050820822de81f86087", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234596, "uuid": "777a4b12-a08d-42dc-a50d-b90d3ab9cecd", "comment": "Malware payload (Mirai)", "value": "93d5d6729dc0f5a37aef6763ad24ec250df1a7c91600441920ae30fabc9af85c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234596, "uuid": "7e445930-035d-4075-8cdb-1124cd01ab72", "comment": "Malware payload (Mirai)", "value": "2cd6fe46b488e67563c98ee1e81609252249fa50", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234596, "uuid": "225651c2-84c0-48b0-bee2-7072d8f0e7e3", "comment": "Malware payload (Mirai)", "value": "31773d8287755956414db995fbca5a42ad4a72fbda64e867f74875c23d9e3a0614d22b6ac63f7c8c743ffb80f4607f11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234596, "uuid": "f279d773-8dce-4fe2-9281-2241b1117b4f", "value": "T17F517EC7110507312E66DDE6BBBB486931D0E1AE64C7FE6BA8D8B8E8428DD087C42653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234596, "uuid": "6e719c31-c563-491e-80bb-7fe2a0ae4acf", "value": "24:ItSTfsS3+3IhOESxW3SexASoZPsSwySxTnxTGF7JSsQsGASoQLSTnTNINksSicri:irNEJ3GQ4KTxTGFlz+LLJgr8dTdVNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234596, "uuid": "80ededee-8214-4363-b016-869768d6f23d", "value": 2759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234596, "uuid": "f5fa5b5f-2d02-4744-828f-fbba67c702f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234596, "uuid": "a90764be-bf7c-4b28-a96c-e1b2d7940ebb", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104d4d29-80d8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784180089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180089, "uuid": "ce09ff80-d6b6-49a6-bcb8-7d3e9de70942", "comment": "Malware payload (Mirai)", "value": "e5fddd8203cc98c8cab6e507e5e45007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180089, "uuid": "57f81f1c-925b-48f1-9b26-6d9329f699c0", "comment": "Malware payload (Mirai)", "value": "9419673e73679c8e7899685ac7ed014e13067b351f838ded38592613dc7d2314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180089, "uuid": "1381826f-410d-48b5-8402-7c9ecf8414e3", "comment": "Malware payload (Mirai)", "value": "4a117bb9681d5b81cd9b8f13e887c0115230416c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180089, "uuid": "38de232f-f3e3-4479-930b-c530d8bbd0ae", "comment": "Malware payload (Mirai)", "value": "67441c0116a964da2325a65089639e709288462efe9fa9f3c8edb5a05986e7e920b2b9949b90748ef283ec5cf3865b50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180089, "uuid": "09f12353-f003-4c10-94f1-2da8513b5c22", "value": "T1A614D946BD518F23C5C311FAFB9F429C3B266BA9D6EB3102DD157FA037864DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180089, "uuid": "cc9ac6cd-9957-4f42-abfc-6ca43d79d19d", "value": "6144:T55EY52ktW35eTnV0FdsduHOnYlVjY8K:l5EY2ktGeTnV0FKaplVjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784180089, "uuid": "7989f4e7-8dc9-4a87-8f7d-4e87b8b221b9", "value": 205456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784180089, "uuid": "72ee03b4-2ead-41c5-b006-e96f1d8a8357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180089, "uuid": "93768ce5-7cc6-4689-b43f-1b25811c8979", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b64103-8136-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784220842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220842, "uuid": "f6e69461-174c-48f7-9ea6-38480c365fd4", "comment": "Malware payload", "value": "651b3ed3ce85ce402a2c19c48fab9c8d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220842, "uuid": "e1ca0c86-81ca-45cf-bd95-2d44ae34efd3", "comment": "Malware payload", "value": "945d7a6eb3ef9631612b4728312d65e7dae4fdb73dcab2e7d0c6313dbf38e350", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220842, "uuid": "ec1a0457-b8f3-44cc-88f8-efb763dca6dc", "comment": "Malware payload", "value": "afb53e856d88ab770d36f21b146d40cc6b59d695", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220842, "uuid": "a2e1e3b2-b6e3-4747-842b-a12f162492d6", "comment": "Malware payload", "value": "23c80d315cb687248ad4be4228d494cf3e1f8f91872c3bf3620b59598af881f0be243579b7a9be8088de2f91033e9d22", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220842, "uuid": "f7e2df7f-ed76-4fd3-9b4c-6bd66858c7dc", "value": "T11A66014AF7489A6BC8F7423249354A6212075CAA8F83EB937D44733C19B79C54F5AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220842, "uuid": "3ad62f02-fefc-4bbf-a0d3-dfdef5ea0a79", "value": "98304:/CW80y4hcqr5MqBTptEJl5o/1Wj3D34u1ABbp4TzT+9MiCDVCt3kD83zTVb2pfSh:aWX5t7k8943D34u1Aqf+9CDOe7Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220842, "uuid": "548d3843-076d-45e9-9b68-03d33c02461d", "value": 7014172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220842, "uuid": "c0f1518a-7db1-4542-bef0-9259b306198b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220842, "uuid": "6fa6f6db-961e-4201-b163-a7463c53bde9", "value": "org.sol.tools.lite.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65677499-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784224900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224900, "uuid": "4dd5631e-7cde-494a-82cb-50fb2f759ff2", "comment": "Malware payload (Mirai)", "value": "77d001a65f6f313f12b074d8fb33c142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224900, "uuid": "f4681f5e-06f1-4ea1-9947-3685331da0cd", "comment": "Malware payload (Mirai)", "value": "94a0d43d06b5823ac41cb0e4904b3df757c8a059c1f562ab129913314c9456fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224900, "uuid": "00ae3300-1bcf-481e-89dd-50159db71d03", "comment": "Malware payload (Mirai)", "value": "8370df38e199bb965267d8006d82256bb66391b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224900, "uuid": "fd09c71f-dbf5-45d0-a07e-86b4bc9c5c83", "comment": "Malware payload (Mirai)", "value": "adc450ec6956038aaf1b9258e03a3e48e3f447db2e0589e3228e7fa2bf2abe963706128835217501a96ad3752caaf6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224900, "uuid": "b5f61063-5bf7-463a-907f-fd6c87f7174d", "value": "T17C33F196F96AF758ED39383A6E57C006336C4FAB81F9B2AE61F041909AC10C6127D6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224900, "uuid": "c7caa451-abc3-4a27-bc96-220f3e828889", "value": "1536:J6iCo2cK8cMrZ2D38pD33to19LNpG8CGHlEusnTjfo:6KwW2D23C19Gr/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224900, "uuid": "dfdab344-7fff-41a7-87c4-77e076c80dce", "value": 54484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224900, "uuid": "b8fcb319-b2d6-414b-8591-5ef659d5d90f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224900, "uuid": "be8ba619-e580-4fea-b4b4-47a4d912159f", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdf3e8e-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239923, "uuid": "bdaa8e55-67b8-4f6d-aeb0-c1f95f285037", "comment": "Malware payload (Mirai)", "value": "f23e702a4414b9721950b9b6a32183a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239923, "uuid": "70fc63a8-a1b5-43ec-99a9-6a0e53b6bc20", "comment": "Malware payload (Mirai)", "value": "94bce2e2e785d54c50fd2d0f6a9702535c9ee8f145a94c666de7403303743fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239923, "uuid": "f36c9d3a-2ebf-45f0-a816-d87741699dcf", "comment": "Malware payload (Mirai)", "value": "0b644c1d4375a1ae241ad436d82390a6ae9696ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239923, "uuid": "3d26aaf8-8226-4c41-b580-5c52e3550482", "comment": "Malware payload (Mirai)", "value": "d3ad1613de4286932cfaf17481f15da43dd1858a7334d8931394a7ce71b53189d6f01aaa58c805eafe982f7273a15c45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239923, "uuid": "ecebbf43-d09f-4b96-9d16-e68a79197097", "value": "T1BFC31907BD42DE12E4D721B9FAAF904933136BB9D3EA7102CC209FA537C699B0B76511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239923, "uuid": "9e29f636-6e0e-4264-a6fa-e2cbd2b29095", "value": "3072:+ZHYWGEoEK1xMAJ5RnmGOuagvAKmtRdQUhBDWbMgc+:+7/od1xMYvnmTuagvAKmtIUnyLc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239923, "uuid": "be3e13d4-27bd-4ede-aae7-df3d7ae1c592", "value": 121968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239923, "uuid": "09c1c77c-aaf9-4b3e-9e13-d224b3136db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239923, "uuid": "ac76cadb-b75a-4f64-90df-a8b94643d8ad", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3335753d-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212790, "uuid": "3d9a8cda-de8a-40df-8a0b-13c57c3b476d", "comment": "Malware payload (Mirai)", "value": "9c71de9a75d258818f3843301c5ce651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212790, "uuid": "1a0ebeb8-60bc-4b1d-affd-397bc6077362", "comment": "Malware payload (Mirai)", "value": "94c220d69ee80fdabc7cd865b58a9dbcb25b4db5594cae0fbc8dd537be611472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212790, "uuid": "dd538508-bbd8-4ea4-b47b-90dea61b2629", "comment": "Malware payload (Mirai)", "value": "a4ec4162432e604971eb24647f2f7b5db1d566d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212790, "uuid": "9da79716-c6ab-4509-9be1-a1582b358867", "comment": "Malware payload (Mirai)", "value": "ec3de42b6df0a99aacc710fe7ff17e66d18745adc5d334119ca9c9c5e55931f2a6dccd8cc2da544fc7687d5034c7f159", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212790, "uuid": "a90ff3a8-c31a-457d-8275-48df9d946e13", "value": "T11753AE77C8396E64D24581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212790, "uuid": "005a79e9-be59-4ecc-a219-263afc91baa4", "value": "1536:caCwtuAPFqcgdEcg5KU3AwHup+CSXHld5Zo:c58PMcgaZAUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212790, "uuid": "5af26f88-2ddc-4d54-83a8-172f247abe0d", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212790, "uuid": "c2e00260-b19c-4c4a-999e-ca08fbdb6fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212790, "uuid": "eeebf517-28e9-46cd-b48f-2aecf6143c27", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9015688b-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784185458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185458, "uuid": "ee99bbc1-a959-473b-9d61-337c00dfc596", "comment": "Malware payload (MassLogger)", "value": "459f3a516d33c24f9d8ed542c13ef284", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185458, "uuid": "6923b5bc-0b8f-4d88-b94a-67360770e63f", "comment": "Malware payload (MassLogger)", "value": "957334629acb3bd083c25c507623e6d2fa2c91eedb0adf0f9949ebcde773c210", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185458, "uuid": "ffe35de0-9ace-4369-b6a2-dea0f06a682f", "comment": "Malware payload (MassLogger)", "value": "f1e141506703cf7ceec36924b79dbad8c73305a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185458, "uuid": "b005d666-0491-496e-b7ee-0acce7ca4c3a", "comment": "Malware payload (MassLogger)", "value": "62af25a759d6c39e7b41acfa7fd2f00a1fa089a66f5474ff23b1a58f31c62b9f1498ed11f12d831d4ae7683cb19644ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185458, "uuid": "3dbbbd2e-f012-4b70-a12e-12c89a3f5896", "value": "T1D1D5E75197A8A2737B61E79E513AEE3CA40E60032CD9CF45345ED634791CE87A348BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185458, "uuid": "a1427db5-9537-4338-a5ff-ef7ea7132206", "value": "49152:RkUwwAL2esOhYr31/Wr+zg3d7FpMakSKR7mzhibTrxp/SRvIJaiFyknswzR:RkUwwAL2/OhY71/WiE3d7F2akSeQhibj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185458, "uuid": "fb89fb73-f4e1-45ba-a6ed-ad130bba2ea1", "value": 2934286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185458, "uuid": "564b9a3d-9e2b-4cfd-88c5-e95485af318b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185458, "uuid": "44f89945-fdef-4b34-aaab-f4f55bcce702", "value": "Teklas-Purchase-Order15.07.2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b01ab0-8133-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784219389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219389, "uuid": "e8bf0868-44c8-461f-acae-58c04e366bca", "comment": "Malware payload", "value": "9cca84e6949a4bda44b3f8f4dec19b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219389, "uuid": "b9733c15-892f-4f75-9481-e4c96b30a526", "comment": "Malware payload", "value": "95908ecb36e0bf31d5a8e3c1b9fe40d8e81509f6a7a30d67c3728759c59bf35f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219389, "uuid": "4aae2d27-2849-442e-af40-ab834e1dc606", "comment": "Malware payload", "value": "38c3a24f72537e659eded1d54ff953b5ab941312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219389, "uuid": "7127fe31-2bcf-403b-a094-b4e456b9e842", "comment": "Malware payload", "value": "11f07e839f1de728291cd92c877e3e662e0e7516e4bae7987830b5d96bffc58cfdbc8bcc4c2615ab1b6e6f96282bb75a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219389, "uuid": "fe24423f-1e43-4e17-b3cd-feaa36c0b8d8", "value": "T1324733D245546E9BEF145A7C8187324D6830BE33B311A67B7B8AC682BC2310DF57BA71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219389, "uuid": "15b4fedf-6691-4a0d-85ef-10d9b47ad96c", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219389, "uuid": "872d6371-8828-4b91-a4e7-935e029e35e9", "value": "786432:JbHZL8ucrxkQj265JsddvFtt7lKq/4Dbz5b5Af:9ZoFH2652fdvgT5bCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784219389, "uuid": "5116f6a6-d016-4668-b4ce-9862b48efd22", "value": 26223696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784219389, "uuid": "c6ef8389-c4c1-4107-89e9-052a1e508040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219389, "uuid": "ba6c79c3-1ab3-40a2-885e-bea527f83b35", "value": "Chrorne4ccb-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777ac578-810f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784203885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203885, "uuid": "d5a4e8c3-d98a-432d-8dd6-3c460e06df29", "comment": "Malware payload", "value": "fffd404ed2dbff6969672a5ab2bd691e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203885, "uuid": "a34ff9fc-3154-4bdf-8882-7cd7f53f6d35", "comment": "Malware payload", "value": "95ad73d21dd38ec3a931bd347e41405117bda832fb28c2cc44d463cd88e80786", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203885, "uuid": "2c7acf53-bf43-4731-93e8-5015193d086a", "comment": "Malware payload", "value": "6ec0090166af34dd81613e1632db768da9751664", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203885, "uuid": "fe8126cc-e126-4712-afa4-84a234a7dfa8", "comment": "Malware payload", "value": "fe61132a51ed1cba3dded7681534d71beec56ea4bf4e5dd58ac1a8b8f670db5f16b31abc36e39d77d338f53534819f23", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203885, "uuid": "a17f9def-e6c1-4641-b463-bb467b6c0b8e", "value": "T137C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203885, "uuid": "ee3df27a-e700-4fa3-b2d4-d66aa2412917", "value": "768:M8vCB+25j6es8Rw9FYpMSUpi+20qUpi+20YQX:M8l25J2d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203885, "uuid": "18d8ef2a-6348-4bcf-957b-e26601d82ec0", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203885, "uuid": "bf1ae17b-57ae-4fad-8902-6a67ba9cb880", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203885, "uuid": "f9fb9fd2-bd3a-4648-87bc-6e73d3117297", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c7a218-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784212792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212792, "uuid": "b94e5bfa-1727-4668-b8b6-0f6d260a65ed", "comment": "Malware payload (Gafgyt)", "value": "89b82803df1a7a58f777257d8282e595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212792, "uuid": "0cd3cb6b-4c27-4814-a29d-1dff4c843a03", "comment": "Malware payload (Gafgyt)", "value": "95ff4b4b2e581004fca8d5767bcb6bba0c31954226f70596bc672c1af611f7fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212792, "uuid": "0cd10a04-21e4-444d-8a13-f91b88e35ade", "comment": "Malware payload (Gafgyt)", "value": "62f3657650a04ed167ae1505834cf964a1240d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212792, "uuid": "7a4de52e-0f3b-45da-af3c-2bb7558e7a99", "comment": "Malware payload (Gafgyt)", "value": "a74df537b894de6926eac4ad2b3f3ddd4b7e56d77ed72587dea69222b299f3da715188cc976fb189d78e6aca933a6dfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212792, "uuid": "82257040-489b-4e9c-b6d1-3a67c2fc71a6", "value": "T184E3965ABB619EB7D81FCE33069A5502118CE58612E96F6FB2B4C52CF74B84F08E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212792, "uuid": "c31e95cc-6f38-45ab-9e3c-ad8dcce400f7", "value": "3072:/dyHq/0pR68MqnklCJgfmMOVcG1DJ01so:/dgxMW8CJQmMOVcG1DJ01so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212792, "uuid": "a8f2d174-cd2e-4f73-9449-779a7e767358", "value": 151396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212792, "uuid": "53646003-5100-4c9a-94e3-6beb863cec05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212792, "uuid": "21639f15-edc5-4ef0-b842-cbab653dc373", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beff901b-813d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784223762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223762, "uuid": "670911ed-6d44-45cd-a3b8-540f93a53aa3", "comment": "Malware payload", "value": "78f7f60e06e3e9b0dd7fe3b3eedfb7e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223762, "uuid": "aa3b6022-64b7-4612-b055-bc1c7b70b285", "comment": "Malware payload", "value": "96c895a6aadbd888a82443839b5a0f2c0fb31add663b897065e74c567bcab8f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223762, "uuid": "dcc86fe4-4c8f-4c4c-8c58-e378bf620937", "comment": "Malware payload", "value": "7b824663f163a86d5a1f23467aec9a2a6a30969f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223762, "uuid": "815a3053-74b7-44a4-be4b-e769c2fd4316", "comment": "Malware payload", "value": "928a0332a7dca9172b1543a4b0d350d6296f53b61a89ae5b8fd1f9a013ec0ba7325a0e3ebfdc8bc8cbec9b83321bfa56", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223762, "uuid": "a7904816-3b83-48c1-a235-03eb7f1f917e", "value": "T13E236C6516857C14AE99C4365C7E2F0CB9AD43E6314492EE7FCE3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223762, "uuid": "83e3b9d0-5369-45c9-9a71-bdfbe240eeb6", "value": "768:lr9NyXsZztC99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tHusZXcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784223762, "uuid": "af7bc206-26e9-4470-b846-a24024d96052", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784223762, "uuid": "c754ef7d-cfda-4868-9da6-f950b2da4e63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223762, "uuid": "56057048-f13e-4cd5-92eb-8b6da04c1a91", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff28945f-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784186074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186074, "uuid": "d19898d7-5ba7-43c5-91a8-9626b0d99ac7", "comment": "Malware payload (AgentTesla)", "value": "e321080e50bd1fd954fe19f4974bfe0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186074, "uuid": "54959755-0582-43e5-9a8a-6451e1e6b4c6", "comment": "Malware payload (AgentTesla)", "value": "96d47c2c61fe0d4ca573e687789bff547c8edb63cbd9a0ea23e23ab2a3c9b6b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186074, "uuid": "a3ae765d-94b0-462f-b473-d6b67c518c93", "comment": "Malware payload (AgentTesla)", "value": "a20e98f13379dde63ff2e2b15a53f335fc0d479c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186074, "uuid": "176197dc-e0ab-4131-9a2f-fc185bbf6c99", "comment": "Malware payload (AgentTesla)", "value": "c23b14a4036b4890fb16ab3ff22f2746035f1e1d8e864e87039e2d207d9da6372e1e07d7f88f494fa77942f27533eb9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186074, "uuid": "1976013d-771d-4a89-9b09-67ab5092f8ca", "value": "T16CE5F800A734B476A42CD76CD536EF78484D604364DEDF1C34BA8228BA69E5BD35CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186074, "uuid": "add3a864-47f1-4c45-8421-8571630722fe", "value": "98304:xPvA9L8A2KtWB05Dk2VPOwDuN/1yCpGikEXxO7NbIDcYcUX+M7MzoHh:tWL/hVNu11yCpGikiX+kMz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186074, "uuid": "ea2d97ef-4648-4ba4-b57f-9ed66748ae0f", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186074, "uuid": "1cad1ec6-b97e-4fb7-b924-34e484ad8bdb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186074, "uuid": "e9fc518d-6faf-4a00-a1ea-236f731a2d59", "value": "purchase_Inquire 94p485.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa1eb99-80dc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784182013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182013, "uuid": "75c288f1-e324-4808-a8e2-1c6722e1c202", "comment": "Malware payload (Mirai)", "value": "b6a191c16d0f90a54197f73d36412485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182013, "uuid": "84a5e86f-704b-4033-b9dc-55cffddf534e", "comment": "Malware payload (Mirai)", "value": "97d2ae888d11a97c4d257e56b0e883d4a58c2fcef4e64db90bc63b6f2b46e321", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182013, "uuid": "6be5b624-2729-46e6-b323-fa7acf291c65", "comment": "Malware payload (Mirai)", "value": "c635d9ec674576935519b3d351babb4c157c659c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182013, "uuid": "c730843a-9dda-4a58-8c12-a872f5906c5d", "comment": "Malware payload (Mirai)", "value": "cb5aa578df51e960f85dd07bd1fb866f7658f19526b774fa6c513a28620fc3e906473d0acc689143243ce6e2e389b7d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182013, "uuid": "f8c36228-d73c-4256-ab71-7685c6d8b698", "value": "T145342B87F900DE7FF80BE27244530E15B130BF6A58620677F116BDB6AE2A0D5192BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182013, "uuid": "de54e883-b73a-4058-8140-e2debf0ed5e3", "value": "3072:MR1Rk8+1UBjFFcGg+cAzJJgy4H5YbixajrRR5elb7YfVdjbiKLBIF3lpNijy:MR1RkyJ3DIy4ZYbiMjZeV7YxL2RNiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182013, "uuid": "913040cb-d9ba-437d-96d3-af9d60a9848d", "value": 233452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182013, "uuid": "1bcdcd23-c271-4874-9707-7efb650a72ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182013, "uuid": "f24c8dd1-182c-4130-8684-2a72926bce32", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fc66f6-80ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784162194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162194, "uuid": "6098f946-91a5-4d24-922d-4852c12e96d9", "comment": "Malware payload (Mirai)", "value": "7000b9fa6f934c949e36b7b70155d1b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162194, "uuid": "aafb093e-480d-4b21-87fb-921414e3d403", "comment": "Malware payload (Mirai)", "value": "98170b42f23c069e62fd90e946a5047765c030f608f2cb41f22ff5a19c9d7fa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162194, "uuid": "e494b99d-dc2d-43ab-bc0c-24e94d453cf1", "comment": "Malware payload (Mirai)", "value": "1f4ddbe9220928db21276aba24085a638dd45346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162194, "uuid": "cddee7bb-dab1-4658-8de2-94ee08f8d114", "comment": "Malware payload (Mirai)", "value": "21a7142ca1d2bf8d468f34b27696b7233548fe87282de86f64b7d26ccffa14c644f5b38160c8099b7310e66cd09aefb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784162194, "uuid": "7e8b0657-5ec0-4c3e-840f-9010164b7f80", "value": "T16DE38EA89E0F6D82C2C7E3BDAD453F63312634B445E8C3BA1E00528DE6DBDD58DE5522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784162194, "uuid": "2c887c41-0bee-4b03-9338-9a3c58bed240", "value": "3072:XwSwA+ST8S06MbN+mIiVf3aqdJaiopzl2TdDkKhRYZA:XpQo8r6+Ii/dDop0Td4Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784162194, "uuid": "7e3927fd-861b-489a-b5d6-78032b8c9bfe", "value": 145312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784162194, "uuid": "229c446c-752a-4dec-bb72-d571bbb4803b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784162194, "uuid": "8751e1a4-6374-4ecd-b144-fce05a8cadc7", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea793e5-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234579, "uuid": "6f23a350-a02d-4371-abfa-e01428a718fc", "comment": "Malware payload (Mirai)", "value": "1f0eba4a00928eb613a2fd7f57dafe17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234579, "uuid": "d90929f5-d694-4448-9cc1-654ddde3a8b1", "comment": "Malware payload (Mirai)", "value": "986e9d0bc12a96608d20689051056d8df7b5d510409ca84f2c73b234af3e4906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234579, "uuid": "cbb14caa-b1ec-4e42-8473-9ef2a7a8a328", "comment": "Malware payload (Mirai)", "value": "837b7348ef1617a433b740016612f320d5acc5b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234579, "uuid": "f26a8ef2-f9d8-4d42-b31b-d6ce3ec23657", "comment": "Malware payload (Mirai)", "value": "019d0721e69bb7854cfc2ee7f6ff9df6c396085f3fa6b8f0383fb2279d03756ea4bb37d12fe93b64c73a309d62bea7a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234579, "uuid": "6d1ee280-8e6a-4988-bcc9-c5d20341d5b9", "value": "T120E3AE97F6472092C96302F407CB6BCD2E6362825F9BD9E76D2F753B19360DB1402792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234579, "uuid": "8207acae-6e22-45c2-9b72-3da73142b3d2", "value": "3072:PfpcpGAcRtyMl3PJYZE9TcGOI6wOJwgu72q:PgGFThwGT372q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234579, "uuid": "3314fcb7-797a-48f9-b63d-1ea7d9a75fe7", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234579, "uuid": "7f3e19d6-5f43-48bf-8384-a356d6b9b91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234579, "uuid": "a4bda30d-7e61-4bdc-8003-c46f0856a35f", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5dafda-8111-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784204621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204621, "uuid": "8f3ad3cb-d71d-48a4-b188-12cbfe03b30b", "comment": "Malware payload (RemcosRAT)", "value": "63bd99d4ce2e11852e71ba2058f8d6e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204621, "uuid": "c632dd9c-ae4d-45ec-bc2f-dc27fee412a9", "comment": "Malware payload (RemcosRAT)", "value": "98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204621, "uuid": "10514e68-0cf0-4087-910d-7402dce855c5", "comment": "Malware payload (RemcosRAT)", "value": "c7d28f4477041cc6997fc7d055fc724fc7f5dafa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204621, "uuid": "abf191ab-e099-48c7-93f4-366953e41f29", "comment": "Malware payload (RemcosRAT)", "value": "5fa963da42f939a1ee8a0c90da5bfd2914ae81103c18ec57b89420745a5b4a8a1eb46a476b85b80d1d40e23bb2561c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204621, "uuid": "50514d56-b68c-413c-a33e-ed1c0c1f0f18", "value": "T172D2B5BE52722C4EE612700FD949EDB088E9073B25625B2E62F9558D014D74EB0D3EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204621, "uuid": "924c0e7c-da53-4abc-8ad0-80322b61ffc4", "value": "96:QTp/UYBGZTjKhp5kg+w6V7Sulxg4BYhWNWeoKE27IRfdtmmTBN:Ip364BeoZdt/TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784204621, "uuid": "e0d3d728-06ce-416a-8dec-cf2dcd0b2d89", "value": 28465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784204621, "uuid": "2c514830-83a8-45ef-b1e8-65459192829c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204621, "uuid": "ab569e27-aac6-4dfd-a0eb-55333cc16c81", "value": "goingbestplacecomingforbetterwaysinthelifegoodformebest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1679db7-8106-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784200143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784200143, "uuid": "f70f6331-575d-43e1-9b34-9c4b3935936e", "comment": "Malware payload", "value": "661b5ae6a22141fb372b946f838c67ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784200143, "uuid": "8a052e52-af51-42ce-9452-c928d5494f45", "comment": "Malware payload", "value": "99a7eef495e271d0c8bc8368c7378950469fa58ae43d13b3efed4f0b4b95b48e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784200143, "uuid": "df9785b4-1023-446f-8182-e8857bfd119a", "comment": "Malware payload", "value": "c5852b414160ac3c4067936d98dd0e1de02953fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784200143, "uuid": "13af4fa5-6e12-428e-8279-bc5f654779e4", "comment": "Malware payload", "value": "523c74f0ef0600d1a8c84660fa42498890f63716b1ae7a7d2a45e94e5b8dd98aad4da90b5a35077d8685db315cf97b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784200143, "uuid": "3f4ee8e6-4b36-408b-af79-4883e1300cbc", "value": "T12B52F311B3B0DE7FDC2C47B84457073492A7A46862B243232B14F6252ED37A8BEA7DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784200143, "uuid": "21a62ac1-ab87-4432-b3ee-d4c2a1729f4a", "value": "96:RpYS/T/B+B5wQdfpd6dsoNUgLHcYomSNm:RJ/DwjwEfpdZoN7QYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784200143, "uuid": "cfeac11e-5f9c-42ce-a3b5-841ef6522eb3", "value": 14152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784200143, "uuid": "c568802a-3b1d-44e9-a647-f753612bbd5b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784200143, "uuid": "51a7788f-260c-40c3-aa25-04acb0d6f7f1", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1ef597-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185188, "uuid": "5c12b22c-156e-41f7-a7e6-e13a9ae282a4", "comment": "Malware payload (PhantomStealer)", "value": "4e15875d8d842b652b3c7dc6554ed275", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185188, "uuid": "303af83a-2e79-46df-846f-58dde0d5e87e", "comment": "Malware payload (PhantomStealer)", "value": "99b893ca182a9ec45eee09d6c634c7306c5febce955d9b96205b03fe56c1f922", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185188, "uuid": "5a59d65f-cf26-40bb-95be-ed7bffe1256d", "comment": "Malware payload (PhantomStealer)", "value": "9e8d1d44b2bedca3ef05364e07bd9d3c49a041b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185188, "uuid": "f0147cad-726f-4901-9da0-cd4c33090a57", "comment": "Malware payload (PhantomStealer)", "value": "93c5159fdfe3e701635cb008b46b5fde22b6ec0bad7623362d94bf0865491214a7da05159355dda3e1cd36df35cddebc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185188, "uuid": "00e3324c-5b3e-429f-9fba-93a4d0e8b711", "value": "T1E2062961536491736A68D35DD236EE78A50E701324EACF4C309F9628BA5CD4BE34CBE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185188, "uuid": "bea08698-5505-4800-8b45-a04932911e63", "value": "98304:yDeXsjliggkkyT6i1JALUMuGUpTU1Nylt0FXg9AePQnMCIctBjh1L23raa+yNot3:6u/tLUcUuyrmXldnZjhxiraYSHMAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185188, "uuid": "fcf0da09-60c7-428e-9bca-a374dd66bc91", "value": 4015630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185188, "uuid": "a96848f8-b69e-48a6-bef6-a8a0c9dc70a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185188, "uuid": "6651410f-f3c6-41d7-8d79-1a4a0ea395c4", "value": "Project FMD2026UOS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7162ae2-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784164156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164156, "uuid": "5ccfa6c3-045c-4eb9-94dd-c1c849f2ac37", "comment": "Malware payload (Mirai)", "value": "87f29d4d2ef7a747da6e9cace4f1cf0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164156, "uuid": "bd883ac2-6269-4439-8e62-0bc1e6d8c82c", "comment": "Malware payload (Mirai)", "value": "99cfa4eb1fc878b61eb532ecaea600038f3e789d31625fa413f669ff1ee5b22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164156, "uuid": "79162111-31c4-43b8-bf69-122a96f0b9eb", "comment": "Malware payload (Mirai)", "value": "8ad5fb2dda7bc68f52871f5b43362e0191589688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164156, "uuid": "c62f8a67-0b85-4106-87bc-15e37763acc6", "comment": "Malware payload (Mirai)", "value": "8a46ad8f7b9247610c45a1b2418c156dfa2a3c573a8272aba731a11b0b3ca9b1445b86ad4fd81fd1906e2462dde2e66e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164156, "uuid": "37cacce8-c6c6-483e-ba73-9fd419e2fbed", "value": "T1F6838EC9FA03E0F1EC525AB10837A3175A76E5355538EF81EB912631BD13B00AB07B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164156, "uuid": "b1896b72-a1b5-4ee5-b059-84756f9b4db2", "value": "1536:Rx0vpwbUFaujDjyEC0QEUOdyfJ41qz4PjBuLnmKSkJURrdJ89yf7:39b2aEjyECFN+2p4bBGfSpJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784164156, "uuid": "2f5859c4-885e-4090-aa04-c9824db4b0c5", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784164156, "uuid": "5bbe3e0c-dd31-4f0a-b18d-a1653c040784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164156, "uuid": "6330164f-2578-447c-9a42-98cd1fe787fd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acb2e26-8135-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784220185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220185, "uuid": "efc6ee6d-c327-406b-a7c0-400b7267c752", "comment": "Malware payload (SalatStealer)", "value": "23285f10bb9b3002a24d3dbf865f07e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rufus-llc", "colour": "#F64196", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220185, "uuid": "9d69ba5f-9e29-4d3b-a93c-70e8f694f8f8", "comment": "Malware payload (SalatStealer)", "value": "9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rufus-llc", "colour": "#F64196", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220185, "uuid": "f4bad28b-1f0d-4cc9-8fbf-058369147b6e", "comment": "Malware payload (SalatStealer)", "value": "fcb14e821e391defa8096c553066e5f555280de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rufus-llc", "colour": "#F64196", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220185, "uuid": "3b931829-2aa3-4497-958a-7e2f9ebc6b32", "comment": "Malware payload (SalatStealer)", "value": "96fc1dfba3dee28910bbeaef41bc115a2c44b1d2032ace80f040d29b19ecc69cda54913e0bab1bca4d70dace211f1a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rufus-llc", "colour": "#F64196", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220185, "uuid": "a126e764-fb67-478e-884b-e484968e36cf", "value": "T17AF6332567B044EAE0BFAB7DD014E525E5B230640B83E65BD3EC978BEF032E02675761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220185, "uuid": "d859cf39-f415-484b-99c6-a79e48fd94e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220185, "uuid": "ff1c7095-898a-492d-b338-23947ec73426", "value": "393216:+YiDfDg8c66kbdzaDfZbHIl395Ppi70ij9ryRYaZbhknk4RrdapeQa:+Yib0jPmdW75ol37x65chaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220185, "uuid": "8c499006-91a3-4f56-8764-56546b22d309", "value": 16056869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220185, "uuid": "f60126c3-bcf8-4a16-a4d9-97503a915014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220185, "uuid": "5b13d10a-be5b-4483-95bc-dfa70e3e87af", "value": "rufus4.14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a88592-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186494, "uuid": "ee47ccb1-7453-4733-b0ae-8b5f0728c0fb", "comment": "Malware payload", "value": "580b5d04df8ff9ea26db8e5c795763e3", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186494, "uuid": "5455c028-f124-4156-b8f7-b824cabba500", "comment": "Malware payload", "value": "9a9f8384ff7e4d101405b15d03bdf23ad376548db22b1a67646e6f8838a9b80e", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186494, "uuid": "a0a04ac3-14e9-434e-b8aa-aa29f58000a7", "comment": "Malware payload", "value": "d68b5eb38c2106845f373377eb1c328eeb30f108", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186494, "uuid": "f2d93608-cb27-4669-b8aa-c0877b1ff841", "comment": "Malware payload", "value": "1e6ea2492a9d6475a0089766dc68925fd0e598f931e3fbf438c79611663a2cfc485b634025e8e7e86244029a8d98e3b5", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186494, "uuid": "231814c3-5ab9-4c84-9b5a-0153270afe3a", "value": "T18405F166B19A6D69CFE314FF91CB44FAA34BEAE206C502102EB177F285703D4805ED79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186494, "uuid": "5dfda9f7-9eda-445f-a7f4-968df653eff8", "value": "ce21766d52a5fd9cb38316242f7fcf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186494, "uuid": "4a422499-cdab-4333-bbb1-56467e1d82b2", "value": "24576:XNZ+mYhxYBdE+lToJe5k/uTG4IKPwA3EX9:XBYCi+Zue5k/H8EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186494, "uuid": "e6b65159-7dbf-47e8-b162-6db398c72a44", "value": 844447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186494, "uuid": "453a37c5-0780-4234-91b6-74ce17f4a37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186494, "uuid": "502fa403-df08-43d9-a824-e38d68fad601", "value": "netutils (5).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697e8c9d-814c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784230061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230061, "uuid": "e4a146d6-0d05-48c3-99b8-7d587bdaf147", "comment": "Malware payload (Mirai)", "value": "4ce22abd16752721eb762e38d1139d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230061, "uuid": "90ebf72c-6307-443f-8d69-35be04564b8d", "comment": "Malware payload (Mirai)", "value": "9b49459da27fac94ae8ead4ed4ee5d794f77e4fef2c3085f772042f734ab555c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230061, "uuid": "b8498d3f-9a93-4cc6-aa3e-d3b67a4b78cd", "comment": "Malware payload (Mirai)", "value": "6d43f7cdc695ec76bf199ba5db01d854f28629f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230061, "uuid": "650c6f41-35cd-4501-bcbc-5225141636e4", "comment": "Malware payload (Mirai)", "value": "bf9756cba86d9ae3f8f3b4820cb238397af1fb0307230c45e1286a730805c078558dec89382c2d123c0cf1f0ae2acf1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230061, "uuid": "1e70796a-6075-42c3-93f9-0a0e896bd065", "value": "T12BE34A5DFA57C0F0E1C341F1067BABAA563A99226237F1E2FF563762F871342588522C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230061, "uuid": "408f20bb-d701-4794-ba49-499c0e541102", "value": "3072:FZpuHMOnt2w0oFtwaLo3fraiZ3TWI54eYlUi:FasOnYwpZoP7VTbHYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784230061, "uuid": "5286f1e9-c5b3-413d-853a-a9ff71f87f21", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784230061, "uuid": "d4f96833-0ef7-42b8-a43f-102ac3011e86", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230061, "uuid": "8064d165-483e-4e75-87a8-7606ef7b7621", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de823fd-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185454, "uuid": "96fa6c6d-b641-4c48-a9db-eb14bd440fa2", "comment": "Malware payload (XWorm)", "value": "52e447aecb5ac94acdffac125856804d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185454, "uuid": "35afa965-14db-41ee-84fc-4ad44f6813e3", "comment": "Malware payload (XWorm)", "value": "9b9e8c44b72d92c5b795d571031210eb88d0d156b1f5808487ca9b980157d299", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185454, "uuid": "9f0d587e-6bd6-4d71-b34e-1b0a5a04850e", "comment": "Malware payload (XWorm)", "value": "1f53c0f22d3b5302cdd650f4ba8e085b9d200fbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185454, "uuid": "2fb36f7a-3cdc-4be2-a702-2683c98b54a8", "comment": "Malware payload (XWorm)", "value": "e1fccff0630353866e28dc5c42da73ee7e3d74da8df54d2a174019890d13ac99410c9bfd3fd87ff20dfb4ece8a839789", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185454, "uuid": "35e1440b-52c0-43d7-8fcf-35a071b88b4b", "value": "T10045007FEEB718C28530077759ABA320D5702ABD98520C65B637DA88BFA34D60673D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185454, "uuid": "b0c2a427-52e6-4e82-891c-a7349da31632", "value": "192:7bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb0:9VLr8l+LY+I2IdaCyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185454, "uuid": "b30e7f82-b2d4-4ada-b5f9-03c1222231b2", "value": 1200634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185454, "uuid": "373e6317-140c-40f4-968f-382c4bda6425", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185454, "uuid": "fd86e665-aeb1-4264-b762-4efdc20e9c29", "value": "purchase order 4900046467.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6420c943-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784184955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184955, "uuid": "3d76c48b-2b7e-411b-b53b-b423f743e126", "comment": "Malware payload (PhantomStealer)", "value": "95958667b24126329d2d1e27453afc60", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184955, "uuid": "a6dd064c-f437-4560-a191-e0a1cebaa990", "comment": "Malware payload (PhantomStealer)", "value": "9c63081fc7ad95b6ed7d55bb272ce94bac7456b51459941bc78925a4162a813a", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184955, "uuid": "6fac3b4f-4d0b-4617-9086-75c58dcb9f06", "comment": "Malware payload (PhantomStealer)", "value": "9c7ab7bbb63d200e747ee6cea45acf815b0dafd8", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184955, "uuid": "0cef40e9-2a2a-43cc-a89a-8146b6b977e2", "comment": "Malware payload (PhantomStealer)", "value": "2500518e1c186f47e7b561e27cbf151ee88d9728d7a1ecb56b486cb3073ccd9418fdc53a53bd1d79cf5e28df6f5d652d", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184955, "uuid": "ac3641e4-95d5-4814-a85f-4f8dbe7f7de2", "value": "T1888523384D3D21CF8608D2F2B726BD5872E973C71C45279603ADC66472F96A49DA38B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184955, "uuid": "55edbc4d-4c22-47fa-b697-0f890170f0af", "value": "24576:2cG+8e4HTTCvb8yzgYzAEEUHj74gZuZ2IKpPh6zBMb1Y+db62seyKyBOp2:26qW8bOnSZCPhYksUyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184955, "uuid": "76dddd22-7bd8-4f90-ae4e-d42c046da991", "value": 1755973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184955, "uuid": "f9315727-916a-445d-9207-fa33600ed32f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184955, "uuid": "5cc9a53f-184a-4d31-8250-39ef8e416497", "value": "secured4_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22891692-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234666, "uuid": "62b6e413-118b-4de2-a5dc-9ec1d4087c6e", "comment": "Malware payload (Mirai)", "value": "28111b812b9a0169950614b45f995453", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234666, "uuid": "1191f927-99bd-49dc-a734-085759b90bb7", "comment": "Malware payload (Mirai)", "value": "9d355ccfe95f001ad3c5ac516da54ce041689ba6cb6a9db8355c6d832ccc320c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234666, "uuid": "8884888d-0ea2-43f4-a3af-40a5c91dbd97", "comment": "Malware payload (Mirai)", "value": "d559ca4d44e4dec31df79c9957f3621f73df956b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234666, "uuid": "db79d510-a472-4096-8e63-c9a6d1baa3a6", "comment": "Malware payload (Mirai)", "value": "e9264dbb72f340a27acc6a5d4dd4bb031578c8af2d70d9c4b8486bd7af59e31599d1dbc86e8ae6a7a94757f0277a520e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234666, "uuid": "472f8512-c42c-4b08-b178-d4a9aca250e1", "value": "T141D32946F8824A22C5D722BEF92D218E331317BCE3DE32129E245F6137C659B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234666, "uuid": "c152a92f-1981-4fbf-9395-b754b5bec423", "value": "3072:whnE1dzzJI8GseKIsd7ca/CDWxyC+iR/oHfx:+nsJI81+sdYawpC+UoHfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234666, "uuid": "b783eef5-6f61-41c3-9ea4-447afa293bad", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234666, "uuid": "66a79ecb-d792-48d6-88af-2c551d0cfe08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234666, "uuid": "f874900a-b7bc-4c91-afec-5de27cef5ef6", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f223db5b-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225136, "uuid": "33331ed6-9469-451e-9db0-d20042e456fd", "comment": "Malware payload (Mirai)", "value": "fd2a8a103407274323ca8423dd28893b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225136, "uuid": "8fba1f36-c704-42ab-9136-c3434d2408a9", "comment": "Malware payload (Mirai)", "value": "9e3a318a6a1c649cd2bc0d182a4721c78e1d0f0dfc622dc3118307ce1f9405c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225136, "uuid": "33173f94-3458-432b-b69d-6fbee80a6197", "comment": "Malware payload (Mirai)", "value": "76b2064d938971f95384d3261a23747c090155a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225136, "uuid": "7ec23104-7c4c-43a6-9a44-2b2c51e8c301", "comment": "Malware payload (Mirai)", "value": "bacbf5d6f42b4764ee8e8a9fc05a075cf44e3089dc5f4f57f095cde670a1dcfdcdbed07182f501dfb10c4739db8f8cfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225136, "uuid": "62c70c06-6531-42a0-b508-a5a06b3e3974", "value": "T113831281EB6C1FDCE2A3AE35567B68035903429662F4522315887CD48D73C5BEE8B337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225136, "uuid": "0308cd40-04de-44e5-9ab0-876270775ebc", "value": "1536:kc7CLNTa5svhbD2GTh5Oq9zPQcNZ64STfaa7zDpv9D0OuQiFo3PhHyj0/:0NGOvhbpTh5J9BHs7zDHB3PhG0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225136, "uuid": "fd41aa54-20b0-48da-bdfa-f545a6611bc9", "value": 80812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225136, "uuid": "ee468100-d568-4ad3-8ee2-0133c10e3392", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225136, "uuid": "7490dd34-3406-4958-ac44-6ea97e1ae339", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ea2b14-80d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179891, "uuid": "9770cc3c-2fd6-438b-b486-535007384598", "comment": "Malware payload (Mirai)", "value": "405ec09faa9d7dde38bc171296183d92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179891, "uuid": "007100d1-5528-47cf-93fa-13d3d4dc823c", "comment": "Malware payload (Mirai)", "value": "9f00901cdcb17bce2f044f68f8a5c823751bcf4b5f32e129d69ce3dcb480df94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179891, "uuid": "427b5579-d0b2-4840-87dc-cd476227e58f", "comment": "Malware payload (Mirai)", "value": "514f346172540ac1f6bc2932f1e5721cb8717953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179891, "uuid": "60956c4e-9c60-475d-abaf-ef3d0a039d35", "comment": "Malware payload (Mirai)", "value": "31d571b4c7c22de878ccec9458725ffe08718b39ed3eadb3ab0a605e43cafbe4ea7f211377cc9a861af905df780e1955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179891, "uuid": "8c630bb3-25d8-4d85-928f-3af4b68183c0", "value": "T1535302F6A0E87DCCD2968370010B56473DD567B8A05A663AB3C4B6594AF2340CFC8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179891, "uuid": "10a0ee0b-0aa1-423d-ad6f-c77ffd0c1d23", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAU4mLkg4azH4:CM5az1Fy0oPgdZX6hTo8RfLGazH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179891, "uuid": "ca089c87-79de-496e-b5a5-0ad29b8fa528", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179891, "uuid": "c9e999e7-4885-4a59-a969-01272fbbc5a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179891, "uuid": "7806b97b-93d1-45ea-bd9d-4ed78002dc15", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7941bd8a-8142-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225792, "uuid": "7c94c6c3-24af-4d4d-b195-83f49a3850c9", "comment": "Malware payload (Mirai)", "value": "9ab73ee5c8bce04742eac21f13c5bdaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225792, "uuid": "0a57f795-7e1d-4b09-a72e-ad0da6815a4c", "comment": "Malware payload (Mirai)", "value": "9f0cc92f45de4c7bf9a6976c7d6030c28934ba34cb512f6464cba6c8b6aa29ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225792, "uuid": "be592099-a8af-44fd-a518-1f6ae0fd0786", "comment": "Malware payload (Mirai)", "value": "8ec6172b56b431350e1fee6d574e88fbfa6e3203", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225792, "uuid": "be7e2396-1558-4a1f-a92c-22df2a9b2773", "comment": "Malware payload (Mirai)", "value": "d2dc2704817d631168c0973b68f7d670560e0b19b7f19178ac202e307f18a5298386aa351d049e980891c91aee4a9589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225792, "uuid": "f438551e-63e7-4e11-ad9c-75b78402e34a", "value": "T1D9B3E085B210AE55C02672FCB1870990A3B17E7B4B9A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225792, "uuid": "1c087261-7482-4a92-9a78-50522f20472b", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wus:as5zqhr5Nzy7w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225792, "uuid": "0e934598-4390-4157-b128-fcfba48d85ba", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225792, "uuid": "8a10f554-e91c-4b77-955b-454495e57e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225792, "uuid": "73055459-5baf-4d4e-8b71-015119ee3401", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f94218d-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784208623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208623, "uuid": "443f9610-05c4-431a-b872-0e3e22ed13d8", "comment": "Malware payload", "value": "8972fb1f05874c3998a0f4299ef3875e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208623, "uuid": "e5de1649-1cba-491e-a1ce-50ea954ccc8f", "comment": "Malware payload", "value": "9fa8e1aaad7c6e5fb17d839db348f2f0632550622691754fcd11ae76d18e63a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208623, "uuid": "49d5c675-3896-4770-aeca-b1a6f4490d6a", "comment": "Malware payload", "value": "265196bf98395de26d649ba17dc88a65a07076af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208623, "uuid": "a6440f2f-c407-47cc-a6a5-d2f7cfaa443d", "comment": "Malware payload", "value": "20342118f3095b986ce5d9c4d82249271f7ac900fbc5b54dab73cda09b7d23e269288699c16d8ba35ed1d5201a239fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208623, "uuid": "3af06351-6ce5-47c9-87c7-07cd6df4dade", "value": "T14927CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208623, "uuid": "c7753bae-7825-4d86-8c6e-9af4fbb255d7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQu:cqYUQuVDt0TZEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208623, "uuid": "8704e110-a72b-4036-930d-d8669aec6846", "value": 21921792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208623, "uuid": "875c914c-e56e-4efa-8a61-ee426bdd7052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208623, "uuid": "da0dbe1b-020a-4b86-9596-a694c8c52d5b", "value": "9fa8e1aaad7c6e5fb17d839db348f2f0632550622691754fcd11ae76d18e63a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0828bf-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239913, "uuid": "f172838d-df02-4f7a-b81b-025426a8edcd", "comment": "Malware payload (Mirai)", "value": "5cbfb227713bedaf52b0e55bc048aa38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239913, "uuid": "c31ea1e9-9323-4eef-8d85-3bf3d2954a4a", "comment": "Malware payload (Mirai)", "value": "9febcd6b2e7829e8be76fb01fff52136962570ea3b682322e266a861c057a014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239913, "uuid": "a11cb9e5-e5b9-4368-83d5-f642db7554c8", "comment": "Malware payload (Mirai)", "value": "7c7d80575adeb00d0ff548716174d138063e5898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239913, "uuid": "5dbf8ea2-f42d-479e-85fa-6d2b44aff768", "comment": "Malware payload (Mirai)", "value": "1cf8be8ff5fb43cfe5fa73b571a40162711bac4ec014d0bd77fbf5ae322df94a9623dc097abbfe13e1f4f5559db3d22a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239913, "uuid": "4687c91b-c07d-4d1a-969a-4586a5e22e26", "value": "T142938E00770C0E93C5636D74293F2BD1C39AE69122B5E6452E1F6F0BC1B6D72868AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239913, "uuid": "0f7c6310-4bb5-4c56-8d91-fa5fb2984ccd", "value": "1536:fxwk2kUkmSZeOcNOaSBgrLefMJIXa4c3m+0fMNPkYO1sqARjdF2aWBQET1:3gUcIXMNUgx2RBx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239913, "uuid": "e83ea47b-ffaa-4a56-9983-b9813749387a", "value": 95784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239913, "uuid": "e97ee612-d78b-42a5-81a2-7ee36357a432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239913, "uuid": "271c0c80-89d4-4ec4-98cb-a3c95b581f5d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de21d1c6-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246148, "uuid": "a2871708-1ebe-4248-81ad-d280eb5c406b", "comment": "Malware payload (Mirai)", "value": "b95a8166d6570ad88a76e4693d4905a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246148, "uuid": "edb279f3-124c-464a-941b-fa092139477a", "comment": "Malware payload (Mirai)", "value": "a266eed844e439b943d2d734b2697905914a8a5478c3767fe7435da339db8173", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246148, "uuid": "1305ea7e-9828-433b-b7c4-f6564521d5b6", "comment": "Malware payload (Mirai)", "value": "f0a8ec9bc84ea6a20aa43a425a0d8db528c1179e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246148, "uuid": "20e34aba-9d3e-4877-aae9-db7bd8d26eff", "comment": "Malware payload (Mirai)", "value": "71c3525ca11bd36f42ac285f19aec457729df6f08a25eb2be06c3711e33d19df5c5f5a05065c513d1e25794127615c0b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246148, "uuid": "80860c2a-3d2c-4f98-88fb-f03308a99e03", "value": "T12A11C2166803C0F2D36A557F8B6FE24A30F730531022A818B74E3B214F7B5217962A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246148, "uuid": "0de032b1-6c23-4640-9ad0-aa6106b00c1e", "value": "24:EucrM1apkMQHMQZrxMQQLHMQXBMQuH2MqMuM3hMsD+MFw3MT3sKkMxslMrlu/+MB:5craapkFHrrxyHNBMWUuAhfD+gK4st0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246148, "uuid": "33112c71-e8b6-4242-aa97-f98747ea9edb", "value": 1030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246148, "uuid": "78630fb0-8f41-4945-b366-b83e821ee231", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246148, "uuid": "1b663d18-53b6-41c3-ac1e-352549efdb41", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32c05ed-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212978, "uuid": "32d86399-56d4-4256-904e-cfecbafa43a4", "comment": "Malware payload (Mirai)", "value": "a10002f8c77bc8fa98b1b43bc3eef4b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212978, "uuid": "eb223d06-a907-4b03-919f-822d801c7edd", "comment": "Malware payload (Mirai)", "value": "a304100e5cf30af2c62a8b6b541ea79353dec7d725f6eb3daa8cdca187eb584f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212978, "uuid": "ac168ead-3a45-4d07-b265-e0660b0ccb6f", "comment": "Malware payload (Mirai)", "value": "f35b80ba957a9b181ffc0fed93e6994001dedf41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212978, "uuid": "0eecd476-5268-4ef1-abd3-74aa15619a21", "comment": "Malware payload (Mirai)", "value": "4880c9827ab23efad12f2db1ba1d9e0d938bb37a0c8e109560f754394dd70b4ea031d4ed499e2c1ffe72d6c982e349a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212978, "uuid": "be4bf102-4e81-4746-bd0e-7cd3320df68e", "value": "T14482C03522DAB5B3E3F02435EB95C2D6777983F9C1A9337504127678C96218ED3F6206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212978, "uuid": "fb3d379d-eae0-4133-81f1-86657d6b17db", "value": "384:3czJ2ycgX2VF8l4sdV4dRE/Bxp9V9acxNeRfBMGPVdvhymdGUop5h4J:Md2TgGVF8lEda9VU2sfPfs3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212978, "uuid": "d56b1386-8d86-4482-aa5f-27d47a254031", "value": 18032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212978, "uuid": "d7efad47-8650-47b8-b645-7322ae5c989a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212978, "uuid": "3b9e1b83-d0b5-4167-b545-912738b5dbea", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b5b04d-8106-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784199877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784199877, "uuid": "f286ceff-ff7e-4c48-b20b-784b7cb3d255", "comment": "Malware payload", "value": "6d5d28bb666655a39e857d80951fa52e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "qspaas", "colour": "#E5DF28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784199877, "uuid": "e844a640-9a94-423e-8032-8fa24268c8e9", "comment": "Malware payload", "value": "a3242742c9028388ecf7beecf81a749b772f83b83ab9a809d2229284642be229", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "qspaas", "colour": "#E5DF28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784199877, "uuid": "fb300d01-2e36-4a2b-b07d-aee1a4fa2ff1", "comment": "Malware payload", "value": "b2462e9e7ab69f1fedfc8b68e6f7be9fc798af03", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "qspaas", "colour": "#E5DF28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784199877, "uuid": "6b57ab3a-4476-4d21-ba6b-7d7427258339", "comment": "Malware payload", "value": "6f97052d5e23f1a6a7eeb79725bc103fb9f5b37a9a1e2fd7546cb2a15664a303ce6ed0d3c69b30d2aca525744686a420", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "qspaas", "colour": "#E5DF28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784199877, "uuid": "e171f31a-85cf-450a-bb14-e1351491b436", "value": "T1E6D6333ADB269121F8EBD13B89B7665A70F4A0E0DB43D7D2F50917A402CE3D65F058E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784199877, "uuid": "790a4bec-cfe6-4fa0-afcb-bc4e1429be7a", "value": "196608:Z9tnffm0GqQNgBa3k8mXZxf7RDC1cz96tumTUb4d1uNZwcwTd4L6sWGbNQM:Z9tWcQV31kZxf7RO1U6tJA0dfstxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784199877, "uuid": "dae730b7-136d-4308-ac09-799d4687b2c1", "value": 12898531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784199877, "uuid": "bc6826e4-ec2f-4c19-86d6-451e6d2308db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784199877, "uuid": "d8a0d7e7-bd1d-4968-919c-13d819cbfac3", "value": "PDF Contrato.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefa58d9-815d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237586, "uuid": "a4d4fc9b-9f77-48aa-9dcd-363f2fc064fe", "comment": "Malware payload (Mirai)", "value": "af583722c8bbcfb4fc30abc399e13c37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237586, "uuid": "81d96034-6d35-4ee8-831e-0bcdf23c73fa", "comment": "Malware payload (Mirai)", "value": "a4245666f7de7ae220ee59032141dd706d600cf2ccd54735becb6868e9dbf773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237586, "uuid": "97992d58-e8cc-4249-8627-fc00064efe0e", "comment": "Malware payload (Mirai)", "value": "148db213ca3f97c5e03c559e90cd0697d68f3292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237586, "uuid": "64a01e34-8c94-4a54-abc6-eb2a68fe8768", "comment": "Malware payload (Mirai)", "value": "e983abe63968a7fcd5a000e45ac349d8b8cf5a3b36e1ecd926e9868b99e1e3fac66f4d5557398f4fa064b68f757a7247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237586, "uuid": "7df063e4-bf98-4c96-afbd-bc7c0b76aefd", "value": "T18793D94AAF651EFBD82FCD3705A8074235CCA60775B437753538C928BA4A94B8AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237586, "uuid": "848cd6ed-e27a-4094-a91f-09acd69c3625", "value": "1536:1FroKo+uCbCnX2VYIDnAWIiXKu5697bWvyI2E/QFEgccZifp7:T5FuCbCnXYY0nAwhSFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237586, "uuid": "35613674-e520-4e00-9013-138bbf697370", "value": 89768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237586, "uuid": "dd871dde-eb57-49a1-8006-46001e510c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237586, "uuid": "ec90a1f0-2f88-4b75-a21a-6755125382dc", "value": "Pj2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec38f150-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234575, "uuid": "3997afd5-2e4f-4d4b-9b21-d55b2818aa43", "comment": "Malware payload (Mirai)", "value": "3c6ee03eb444797badf090fe247fd01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234575, "uuid": "226e1a4a-8b93-4f76-b3e2-40fbebb8f526", "comment": "Malware payload (Mirai)", "value": "a4884d39c0d2640b108f8c40505d8847cb20681b46a0a9c11f1411e5ad03090b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234575, "uuid": "9a588556-7c80-4333-8c4c-5623d1570664", "comment": "Malware payload (Mirai)", "value": "4146b771daa3104462ab7bd855c23c8be1674aa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234575, "uuid": "3552002a-99c1-4574-ab8e-7afb16cb8a7f", "comment": "Malware payload (Mirai)", "value": "079cf94e67f946afcecf2deff51d557b30bb14631a88741deb2e6fc81079f308ed2895c65ef4b414c69022d5ce708b48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234575, "uuid": "4cfb6206-b42b-4f78-9759-a994724b75c9", "value": "T14E2302DB52BB91FDCD2BCE76C42F5A707DF16523CA25A32708D597BAC8A7F184400A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234575, "uuid": "d5a418aa-df7b-4c63-96be-81c6ce8c4e99", "value": "768:JFa6gkyhnq5c7Jg9Klf31/fzm7pfwtvuyWaOsUW155kQm8mbITJHtpzmXvix0Y+:qRnq5e3lFttnOsUWz5OJbILpSqx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234575, "uuid": "e638cac2-d43a-4633-8626-578990810d1e", "value": 49508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234575, "uuid": "23e8c06b-c197-4566-8718-ac91482189c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234575, "uuid": "3c19916a-f240-4789-ba38-81eb7a6a22c9", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7778a7-8111-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784204808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204808, "uuid": "c57abbac-1aef-4f02-ae49-2fc000ac6e53", "comment": "Malware payload (Mirai)", "value": "3548e8c348c1e70b5d15c9340f7749ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204808, "uuid": "1df4c3a8-96ee-4797-a9e2-8fdac002ff1f", "comment": "Malware payload (Mirai)", "value": "a4c24e02a8a4808dec06ea3f607e12501b59562f517dc52f93c8f5b66f11d41c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204808, "uuid": "1adceb8a-cec8-48dd-94e0-dcf814304da3", "comment": "Malware payload (Mirai)", "value": "a48ef4abf41fac1f79d5b72c10b8e0f3ae720f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204808, "uuid": "a7cd9cf7-a82b-46a7-82d3-d2d314b68fa9", "comment": "Malware payload (Mirai)", "value": "16976a4fd6ac00b5422fbb1e296bc3351a50273838814d2dcd2e214809f8a7a9d30b8474a8685fcb4caf060b4c68177d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204808, "uuid": "1b2b597c-fc7b-49fd-a48d-d84d9b1e70a8", "value": "T17D242806770D0E03D1432DF4267B0BE14BABAD5138F9E6817509FEC957B1DF2644AA8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204808, "uuid": "57fa2ebb-9fd4-4f6f-8ce2-a625bf5758fc", "value": "3072:7i0aZsJF52CbjuvkQcUtgxfM2T9DP8DU7raQnDkWjMnnGO4:7BJF3b6CvxU2T9DkDUHaQDja4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784204808, "uuid": "8f815d60-a69c-4af7-bd6c-7fb9f0fe955b", "value": 221992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784204808, "uuid": "9a0a03c3-b0e3-4399-9c49-14854b3c9817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204808, "uuid": "b2a030bb-4071-4165-9d6f-0c792dd58fbb", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019812cf-810d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202828, "uuid": "f409230f-d9de-421b-835f-f7a5fcecc5f4", "comment": "Malware payload (Mirai)", "value": "b10eb45a462f38417fb58f9cf1cfb9d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202828, "uuid": "97e6f9dd-b66f-4a4c-9e5b-a95f85c7b87c", "comment": "Malware payload (Mirai)", "value": "a5555ff1c8c91c8e4346e40b5b29b2582810052e144d990042c3b7aa1bf97974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202828, "uuid": "735d3df4-30c3-479a-8c72-558fbb240286", "comment": "Malware payload (Mirai)", "value": "ac5d371cb71a9c90edf59962261936d800dcedd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202828, "uuid": "47149ad5-6cf4-42bd-a648-88ab7f9a2396", "comment": "Malware payload (Mirai)", "value": "442c20a129212571dfbaa1f9d7e6c331cfa4936a8660594ba86a91aea825a8436a9892f846b0803393db86d96cb14ce9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202828, "uuid": "57cbebfb-42a2-41d4-9883-77590ebf18fc", "value": "T19C5302F2A0D87ECCC29A5774020B094A3E9677B86089663776C1E6654BF2390CFDCBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202828, "uuid": "308c1399-0425-4ecb-9dd8-73db57fddb0f", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASA70Lkg4azHx:CM5az1Fy0oPgdZX6hTo8RE0LGazHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202828, "uuid": "32f08357-db33-4c46-8247-3b403e289a89", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202828, "uuid": "7899a788-5b67-4b23-8c74-04188666c139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202828, "uuid": "e1c58a55-ca43-4f46-9622-5e622d3dccbd", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c6856c-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784178924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178924, "uuid": "8056a3c2-6346-4708-a91e-a3dce6c3b475", "comment": "Malware payload (Mirai)", "value": "d636efaf40430a5ac78e9f0a46ebecfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178924, "uuid": "6c909948-6562-4ba3-90fa-1a50badad9d4", "comment": "Malware payload (Mirai)", "value": "a727e06c82281edebab5b4cde56a0494861ec48ff7e7356718804893510bdb08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178924, "uuid": "af982b8d-3f40-4376-9685-3bdff9997473", "comment": "Malware payload (Mirai)", "value": "9393ff4b5d8c4c8f5b0fc09ac6d427b189febd16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178924, "uuid": "fa7bf41d-3894-495d-9d6e-6dad99dcf08a", "comment": "Malware payload (Mirai)", "value": "605d6d5a15ee9656bdaefa3af67a773a73c7acb6da8a25e854b65c0f75b6645b041ce8ca5047a64fdf430c3dc7ed043e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178924, "uuid": "3e14674a-a870-4671-9e82-0dc943712fc9", "value": "T17C24E947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178924, "uuid": "587a1d1a-ed2e-4eca-bd38-ddb990ff6fd4", "value": "6144:pWudAoqvp7+4vqljlB1FJagFVL7mcZ0wNlm/Wjy83:pWuvqvtvq9lhJagPPZ0smujy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178924, "uuid": "ee6328ef-3964-45d0-8b58-5c1dd59e241b", "value": 222020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178924, "uuid": "51491457-2aa2-4c01-826a-10c694b51567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178924, "uuid": "5cbf4177-74ea-4903-9702-549feaaa6615", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805bd54a-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227952, "uuid": "1e7f16dd-1800-4716-93d8-835f6913cd5c", "comment": "Malware payload (Mirai)", "value": "3928b09b3f65a6e8579be21bc1fe9910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227952, "uuid": "5c16b5a6-2340-478f-b09b-6cba20861ed8", "comment": "Malware payload (Mirai)", "value": "a734a185318f52d12d7f6d39e356223247e2a1c534193d79a21b87ab794a7366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227952, "uuid": "2b728b9c-8d88-4d0d-ac60-da47b074fab7", "comment": "Malware payload (Mirai)", "value": "08d12617fe6c185d20dd790a511601bb4c9fb53b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227952, "uuid": "e2857ee6-f96e-430d-a649-071e413b11b5", "comment": "Malware payload (Mirai)", "value": "8e8b5329d83116a3c5cf0fc1218fa51f4c0b6abf2180e4b35e233482f3e7519987545314a56b286145f798fe83c59397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227952, "uuid": "52f3f6ae-50ce-4432-aca8-d2e1027a6478", "value": "T14D5302EBC2201E91E9A794A50CCFE5D277AC4B1F73B18CA0B528D0641F07B51B8E0ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227952, "uuid": "6276caf2-d141-4391-a287-73409cb96518", "value": "1536:Xb14XItQYrVohNeMrWReFS0trkT1+aszQG2S4u+qgw0rj:LuMQs1TeXrA+5zQG2S4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227952, "uuid": "d12926dd-23d6-416e-ab7f-429f99fddb03", "value": 62084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227952, "uuid": "62c8d574-4388-4888-8ad0-5e96079ea251", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227952, "uuid": "4f967c57-673c-45b5-ba77-6a32427fc85a", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c283befb-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186401, "uuid": "cc3802a2-a205-4a64-87a1-b0471ae376b3", "comment": "Malware payload", "value": "4e84516779920203cb80329857391659", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186401, "uuid": "033606b6-7d62-4908-bd92-93b6d6582082", "comment": "Malware payload", "value": "a7353f52707f9be746a81ce1bbbed86376605f2c7b55184b4e2072dd9ee2a319", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186401, "uuid": "abf83843-e3ca-4d78-ad15-b624b2f69539", "comment": "Malware payload", "value": "e103a28ce348432dc71c5a66454a25c8d0e5ee41", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186401, "uuid": "7210e592-77ee-4051-9b5c-22bc1d0a9a0a", "comment": "Malware payload", "value": "ce58e47f9b6efe1940031b2d169fdc2c9e1a0c6e84784e9b6b1b5991882f76849e922cb6e3c93f815696f6ffeccbe44b", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186401, "uuid": "c2dd3e8a-b5d8-42c2-93f3-31fe7c9b32f1", "value": "T12A25E018A26618F9EE234ABCD45E5C955A2AB6520BC141E732FC42E1DF113F04C7EE6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186401, "uuid": "d161e6c9-b290-4809-97fa-784c0870fd8c", "value": "24576:H1ib43PtLUIaZy/SDnzDuYulqsndPn3OSOqYlPuRzhIgCxZZ:J3pUIaNDPfulHP3OVlOIgCxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186401, "uuid": "337a36d8-d043-44fa-a7b8-d7e3818b34c7", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186401, "uuid": "50722d07-1477-4b59-b94a-cdff6468b21d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186401, "uuid": "10dde53b-6b55-4c8e-b0b7-a8a8139ea225", "value": "a7353f52707f9be746a81ce1bbbed86376605f2c7b55184b4e2072dd9ee2a319.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20c534a-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246154, "uuid": "9e5720a2-81af-469e-b53e-b99e96a94e1e", "comment": "Malware payload (Mirai)", "value": "e0a84742e4e22132577dd824c0712dca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246154, "uuid": "6fd93177-aabe-4a4e-89d8-0752f8bca64f", "comment": "Malware payload (Mirai)", "value": "a771462d3aacd20a9c599533fcd83bb86f24f081a0e7b95055013f9e1944a80a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246154, "uuid": "fdef1384-3a39-460e-af29-3d5546a902b7", "comment": "Malware payload (Mirai)", "value": "c8b254095bf8746380bdf2e34254eed0685758ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246154, "uuid": "100c5e61-6f16-40d8-9be1-d879922c906c", "comment": "Malware payload (Mirai)", "value": "e39d495e178297d9b5d122436631187d858fd7b895038533ef9f8d7010fbc18259b2a2d5b8971dde95e4c8714f907d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246154, "uuid": "41cff00b-6b7e-4fca-81a5-b129ad8c37ac", "value": "T17393AD33C52A6DD4D6559674E0F48AF81B63E50082671FBB19D8C5E95087EBCF20A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246154, "uuid": "4bdf525d-50aa-4ac3-a48d-2e16f78bf605", "value": "1536:CGKS0rFc8wtAGzd8qjeCckbJcNcnwCQQjCTFilb3qK+UAA7ULEKwvCpuJUEFW8I7:CG70rFc89GBxjeCcEeWnDWY3t+mmEKwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246154, "uuid": "d963ba41-9b2c-4adb-a7d6-4abe0bef496b", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246154, "uuid": "429deffe-3947-46fa-8f4a-b832aa2784ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246154, "uuid": "8d39bb85-8a10-4983-95b7-ed1c2105615a", "value": "nerv.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c2bb62-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239931, "uuid": "673807e5-4efb-4296-9f8a-53a37856bf3b", "comment": "Malware payload (Mirai)", "value": "74c1e987787b29490a50087b60736d8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239931, "uuid": "7c2cf8ee-3f4a-4e17-b2f6-177643ffbaed", "comment": "Malware payload (Mirai)", "value": "a82d1d67292f1f36e16577fe794d604ebaa9b93846117e4ff95143aef988a193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239931, "uuid": "2bc82bc8-7a46-422e-8cb8-5e8940b51126", "comment": "Malware payload (Mirai)", "value": "595472fd9a16dbf222cca7935d524633d32964e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239931, "uuid": "ef185062-2dbf-48ed-99b7-e99ecc9712c7", "comment": "Malware payload (Mirai)", "value": "e4df33e477b95a1c789f497a259174c93e0e9216a13b871c9fe238c50419cd6307a98a2a0e8dd027bf51fcb0867d8005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239931, "uuid": "77e934bf-e0bc-420a-b462-3de2c4cd1b8d", "value": "T10C931981F94B80F9D8434CB454ABF33FE730D9544230965AEF899F3ADA337525626A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239931, "uuid": "446bd2f7-4b9d-424a-ae45-ce48ff43df69", "value": "1536:I0Ev5p1oFzLgrypf6f5NQwmp0h/h9hvEhRRoWBoMGp6kRbE6qd5dPzUw1Q/:IH5pS6PQJpgCWMGp6kVEV7RzUw1Q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239931, "uuid": "4b0f3ec7-1ad0-4ad0-a58d-0e8c417bded2", "value": 91376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239931, "uuid": "c1ad38a8-509b-4cfc-9ee9-65dacc26427e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239931, "uuid": "bae46fb0-3fe3-4aac-be1a-5380beb915c4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370a8daa-8137-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784220957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220957, "uuid": "802b5563-b7e1-4b14-98f2-297ea73a3dfd", "comment": "Malware payload (Mirai)", "value": "07585d6a8597953165801a4f3acf5f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220957, "uuid": "3b1fac76-f0f7-46cf-809e-e58f8f21afef", "comment": "Malware payload (Mirai)", "value": "a8b42fae721dcbf760f31ec9d797ddaedb6479b52e70807de162a8af4a3b4059", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220957, "uuid": "62617e10-531a-47be-9fc4-acb957a0695c", "comment": "Malware payload (Mirai)", "value": "761df0f0ecb4ea6ef8967ad642ce38c291c9dc69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220957, "uuid": "580d85a5-c3be-4d02-aa1e-6840f73f2e2b", "comment": "Malware payload (Mirai)", "value": "881602ba68d7cabecf31dcd5b24a1ef29d87e6932df01f52bde5b32b6ef7c102299cce2b5a2fa881d936aa4c707b85f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220957, "uuid": "6f2a1351-4013-45ab-86c4-edde90cf848f", "value": "T194C32B99F890DE42C6D1267AFA5E414C332353B8C3DA7206CD249F3477EBD5A0E7A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220957, "uuid": "9b81943e-232b-48ad-9550-79e99fab5522", "value": "3072:1UPRDjpzcY3o1iWEeUQ4g8OoCqF/EM2NANWJ7DmG3f1Dl2:1UJDVzcYleUQ4g8OdqFsMUJ7D/3952", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220957, "uuid": "4ef754f2-bcfb-4b19-8902-867e40100624", "value": 124356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220957, "uuid": "5cda7298-4676-4b73-8dbb-a7834c6c7f8c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220957, "uuid": "5712797f-9473-4df0-8467-236152bec435", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e9208a-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239926, "uuid": "9d55ed5f-d26c-492e-b96c-222ac4015273", "comment": "Malware payload (Mirai)", "value": "ecce07806412210494f6f72db6279d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239926, "uuid": "9867c64a-6ee4-4bb1-9baa-5c4863e1b9af", "comment": "Malware payload (Mirai)", "value": "a97c73139ebc430850adcd2e70381a8b810b47205145d49ac7ff1b201344db7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239926, "uuid": "84874cee-247a-4a69-94ef-82962f7715e7", "comment": "Malware payload (Mirai)", "value": "7eb1486c84c8637e5c3673bdba8c793f903e6780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239926, "uuid": "166a0dfa-83d0-4dc8-bf02-3d1ab0643edb", "comment": "Malware payload (Mirai)", "value": "5d57fe2c0f760273439517d4d5d0b40043ad70f9f9cb74ed3c4fc0b52edbebca347061b01852a29265c5a26f46622feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239926, "uuid": "1949c583-4e39-49c9-8848-4f9f6dbfaa8f", "value": "T173C3AE97F74B1452CC2106F80BCB6B9C6E6322228F6BD5E72D1D667729B90CF49063D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239926, "uuid": "753d1a21-311d-42b3-92a3-d5ab2e50d440", "value": "1536:xPLYF4iW3X+IPUHtbGFQudeojQnTBbOglG+KvsXoFgEv/LWZ:x8F4b9PW6FQwXjUTBbN0hvsYFgEvqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239926, "uuid": "b14fe985-bfd7-4ab4-8794-178d001f0f79", "value": 124596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239926, "uuid": "ea8aa41f-e8fe-4f5f-ad9d-085173c5a2b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239926, "uuid": "e06f2bf1-ada8-402b-9544-864b10f0a598", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6908c8b5-8120-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784211162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211162, "uuid": "d2fe0e9e-c678-4541-9b38-cab1397314ae", "comment": "Malware payload (RemcosRAT)", "value": "fc0351cd829598d4394a3930f9fd99cc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211162, "uuid": "2ad9f1d7-8c71-4d42-b98a-8d42103a75f9", "comment": "Malware payload (RemcosRAT)", "value": "a9ab393275643769579674ba78b285a6305e8e6795b1466a49f782cb83e8802b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211162, "uuid": "16e43652-fba8-4308-bda6-1b9d5d9b3b72", "comment": "Malware payload (RemcosRAT)", "value": "cb584a5d068a9820fd85347b36d1a5feee1b9088", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211162, "uuid": "5caf2405-fb73-481e-abc6-8037c09e2a52", "comment": "Malware payload (RemcosRAT)", "value": "bf6a4a1aabe94e01d05bb46b5d3d9d13e3d8b9dbcdd65afac34dbb699e378f94c5c9e074536417940114121c1fb6b5c5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211162, "uuid": "a5a30569-a773-4a3c-a7d8-3aa015083edb", "value": "T158C2F952FF4105570B8B17F6C47C0F1A85A8C67A8131BCA0FF7DBA1ED6536A8266C12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211162, "uuid": "f81bd794-3534-4c1a-a483-4d4ee968144a", "value": "768:EAKLrd5uysaHImTQ/bV5ZCfBiJ2c4OT1aXCfK6vioSeY9Brip0/ysw/T:5yvICQp5WI4c4OTkXCflqoJY9Up0KfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784211162, "uuid": "e366bffa-ce7c-4d8b-ae1e-e6d7e8ce46fd", "value": 26322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784211162, "uuid": "8a5ccecb-9289-4d18-8d51-42ad9a2ce2f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211162, "uuid": "07e969b7-94d0-4000-97f3-d8fbf9767434", "value": "Remittance_90523_03.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b63fb6-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185284, "uuid": "41c000ef-81ad-4f71-bb6e-34c7c1901784", "comment": "Malware payload (AgentTesla)", "value": "885fddc9ce0d53c5b8e36bc64fe5f241", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185284, "uuid": "f82d49b3-1980-4072-979d-f4cb862ccad7", "comment": "Malware payload (AgentTesla)", "value": "a9d3611deeab56cd074e66f4a878cc59c8931dbb6d6755d46ea7ceb2409f5ae4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185284, "uuid": "1f0e5ad5-c498-4a96-88d0-73e0044cd9a3", "comment": "Malware payload (AgentTesla)", "value": "ec7f822f67e1314a354e56796bee0fd17f9218f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185284, "uuid": "ad29fb0a-5d88-40f8-a87c-7b52b6c7d029", "comment": "Malware payload (AgentTesla)", "value": "b90fd231fbbaeacfedf5de7828a5e84e654a8fa3192c1ed061bbde7e6b27568aa3a95a18a4f2b99132b259b3f5613166", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185284, "uuid": "42335d94-e8dc-42b9-b411-9730ccefc3c3", "value": "T13A65F1105FC46FAA8AAD1628D07F265EF3E10685546BACCEDF337C495FAAB00D1271B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185284, "uuid": "0e0e0c8d-9117-4547-b4b8-5d67c9c90665", "value": "24576:zvNKPYTmLxFf6Iwb+zgUCg0lLVWqJFxFrdru+LY/1I7m5+BwSkj:zABIFxlzG/1I7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185284, "uuid": "5f624d5d-2980-45ed-b317-52cebb593724", "value": 1515512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185284, "uuid": "e5af852f-2527-4076-b099-5cf76271ec25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185284, "uuid": "27c6a93e-7204-4495-80bb-5f7e0fdd479a", "value": "Dekont2026-15-07.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ace616-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186487, "uuid": "e75bf236-c965-4b63-8d86-33096a3e55de", "comment": "Malware payload", "value": "7147ee8c453db1872288e2a6f814fff1", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186487, "uuid": "bf6ffe9f-d977-4549-99fe-4acfc4ed08d3", "comment": "Malware payload", "value": "aa249958ed6be4d43f6594f41c53a0f118445a3dcca8589dc68d37a1dd9f1725", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186487, "uuid": "51a56dbc-097c-4a10-bd2b-08b1262f23d1", "comment": "Malware payload", "value": "1aeb87790075425bee48fb0f46f88e7ff107abe0", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186487, "uuid": "a01b52c5-35c9-4114-9f67-11666e07bd15", "comment": "Malware payload", "value": "6233d60daa9c5dd7e9159f93399d10a2d1b3908757fef9a23e8db82ba786ff29649df4a9bed7fd7db264126095c8b2a2", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186487, "uuid": "fc61d3d7-761a-4a00-b34c-71f5230310b2", "value": "T13105E025B5A30E6ADE173FFCE14EC4AB7B6F9EE207C6001517B845E5EE44388481EE58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186487, "uuid": "b9122fbd-598e-466b-8164-089b9f405c9d", "value": "ce21766d52a5fd9cb38316242f7fcf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186487, "uuid": "d586ab3e-c13d-4520-9f98-f4830d3e34ee", "value": "12288:hJbFHjBBZfPWrRDv5CeWQeI8v83pBsuozcAxZAuc0WlfOX4EjKILqKgZT:hJb5xPWFj5C7I883pBsuvP2WYqpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186487, "uuid": "da22b3f7-7ee0-46b0-a14a-9958d13a399a", "value": 844902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186487, "uuid": "19f1fefc-66f0-4f65-806a-bb68d2fa2567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186487, "uuid": "77568ea0-dd7e-49cb-8a9a-c7ed90fa9a1d", "value": "netutils (3).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d716c27-8158-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784235060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235060, "uuid": "87bb44d3-8085-451e-98b3-a9287bb2d9f7", "comment": "Malware payload (Mirai)", "value": "8169464b9645d5d015922345bdc50bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235060, "uuid": "2a2a0b34-a41f-495d-b945-539f85985dcf", "comment": "Malware payload (Mirai)", "value": "aaace917ca12470030182f439c01553732537a06f4a571eadb9fe31c81b0af3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235060, "uuid": "0384f9c6-5395-498e-90fc-4452277ec914", "comment": "Malware payload (Mirai)", "value": "44d37a3ac23f0314717813da46b0b12a67576c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784235060, "uuid": "76ee1b37-4c90-4b5d-9e70-41cad9199359", "comment": "Malware payload (Mirai)", "value": "db1d1070ab0e941babcc6106b20b774ac6113ee064af46f8fd393af509098639bf573cd106cc43f8c3ae482ee5ee959f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235060, "uuid": "df370671-7c07-4553-ac59-7390f9249829", "value": "T161C32C99FC90DE52C6D12676FA5E518C332353B8C3DA7205CD209E3477EBD9A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235060, "uuid": "3a1fc41c-a52f-4494-9679-9b1f05d030da", "value": "3072:OX5OH8lflygDo1ivcAUQ4g8O9CqFVd+3tha7tmP3f1Dlw:OX88Fly3AUQ4g8OoqFVua7tu395w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784235060, "uuid": "69b460be-19a2-4ccc-8f9f-3b3b9e9a2d7a", "value": 124356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784235060, "uuid": "fe6b3e14-2728-4d10-a928-682300c7fb7e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784235060, "uuid": "275ecc01-976b-4198-9b6b-1124aec9aab4", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c703332c-8141-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225493, "uuid": "204af93c-290f-46af-8905-2abeee61d0db", "comment": "Malware payload (Mirai)", "value": "94e8b2329b0cb80d4d1bbdfbca1f60d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225493, "uuid": "2be90665-4562-45da-8f69-ad523fdb9e95", "comment": "Malware payload (Mirai)", "value": "aacaace4ca5a2e5b374224db99473dbaa9911f81647b2d304f31164346320243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225493, "uuid": "e214e843-eb2e-4f2b-ab01-b00bdb520b20", "comment": "Malware payload (Mirai)", "value": "2c9fc6ce301590c725e60e59f49a3d9be8a760d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225493, "uuid": "c7019127-c8d4-4606-91a6-8a89adb780c9", "comment": "Malware payload (Mirai)", "value": "5936049778e3c1ce335f61348b45f8fb1c75215ccc993ced9804f9104710d9796820c00ad7cce1108c84c3e3635efdfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225493, "uuid": "17f3dc99-333b-4020-9738-8f714c19eaba", "value": "T122145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225493, "uuid": "454a5754-b41f-429d-a236-46bb4b3d36dc", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXRUaN:HZ15BTYCrYq1QDY6S4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225493, "uuid": "5f8959ea-4675-4d6f-bd0d-f8a76688cd98", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225493, "uuid": "7e64edbf-a014-4835-abbf-bed79611ea89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225493, "uuid": "5fd13375-dc03-4d70-bd3c-33131808d6f4", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d23bc7-80bb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784167939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167939, "uuid": "c0ad722a-6767-4353-b57a-456175c2d3b9", "comment": "Malware payload (AsyncRAT)", "value": "308ef15b5e8f0662fc5c1c828c6c903a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167939, "uuid": "ca533c1d-c193-4e54-8442-18e886631864", "comment": "Malware payload (AsyncRAT)", "value": "abca9cfafbc5165e73c2bb0ef24815c23a5f865a4c6a4eca61b2c17ec80c9ca7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167939, "uuid": "9117993e-7463-4e5d-a621-f6f9946165d1", "comment": "Malware payload (AsyncRAT)", "value": "8377396347225864adea430e96e5db8103c7e40f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167939, "uuid": "6e344cd9-3830-4660-9388-b9ceb564ffa3", "comment": "Malware payload (AsyncRAT)", "value": "e4a16fdae320bcc7277fc98fe5928cf512b2fae6a27f5e3548e455cd3ba0d755ade565c0c1209d86ee56f162bc1ff289", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167939, "uuid": "e08a3fff-419e-46e7-9dba-c60b8b0b09e7", "value": "T1DFC22B0833E4C576E2FD4ABE8C33D5008B75A55B9923D75A6FC490AD29237CD8A14FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167939, "uuid": "d978b407-c50b-4974-8a3e-6bb31f0f525b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167939, "uuid": "d209a6e2-2635-4661-9d24-5c30acec2133", "value": "384:ugSVEEMiNPWmvHtZARPn9jvH9qbuUshybQxnCJfJBndnjJGK3R:ugSVXFdt+zIbIBiBnnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784167939, "uuid": "d14c101a-b004-4065-810a-c65ecf5fd46b", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784167939, "uuid": "93e362d3-25b6-4613-bce9-5fc22ad0b75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167939, "uuid": "75afd972-7f23-43db-af15-a4d11506f4f9", "value": "VIN88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3432f92-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784213058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213058, "uuid": "09c24ada-a3d8-436e-a7cc-4a6de9c74412", "comment": "Malware payload", "value": "42c715523f5365ca7ce30f5254affaef", "object_relation": "md5", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213058, "uuid": "eb87a9f2-ef49-41d3-bdbd-7f0f5bb06aeb", "comment": "Malware payload", "value": "ac8eae94d27122f4751bc96d9ea52d30000b7ca37569a2291b2710824ca3396f", "object_relation": "sha256", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213058, "uuid": "9781c570-2f42-45ca-8ca7-08ad3056d272", "comment": "Malware payload", "value": "b3c187bce26934c3992ac84d4b1b77ed607e0ed0", "object_relation": "sha1", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213058, "uuid": "715e2d14-a8ab-4bbc-b884-64cc281f760e", "comment": "Malware payload", "value": "0e4c647fd551d886439754dd1ef6ce55e86e1e7181c8b5f4732d03559f216af1080c7ed8987a934812ee6105ce678dcc", "object_relation": "sha3-384", "Tag": [ { "name": "DOGLEASH", "colour": "#65C9AC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213058, "uuid": "14af1552-5156-44dc-a87d-f5a04729695d", "value": "T10783F989FA408A51CEC565FEFA5E529C371307ACD3EEB2029E115F3026D655B0F3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213058, "uuid": "a6bb3da7-2a6d-400f-851a-30703341cfdd", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+Co5E:bGVAZyojaPTIsFsGO9Zr/REugmPkXCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784213058, "uuid": "5075c086-6a4b-4823-8964-17ae009b100b", "value": 86168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784213058, "uuid": "7e325d3b-3803-4ef6-9e2d-6046be832c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213058, "uuid": "4c19964a-5d0e-490d-9bfe-f6a6cfc4ee80", "value": "ifbqzheym", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982c1939-8160-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784238729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238729, "uuid": "a4c29653-8d11-483a-9fcb-968bd8b4663e", "comment": "Malware payload", "value": "7a97c126021dffab430d3f421a3b2ce7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238729, "uuid": "47f9a93f-6676-4c0f-bf8d-71a0701368c2", "comment": "Malware payload", "value": "ade04646ba2a8df5d360bd09dbfd94f4c8b61de086a800bc6dd60dfa009de6ec", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238729, "uuid": "12a2167c-a551-4dab-9e86-4f1449e1cad2", "comment": "Malware payload", "value": "cd3273a8f04f20c41e92985158dd768356dddc83", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784238729, "uuid": "a0d1cb6a-107c-43ca-aa33-2ea84612a2f6", "comment": "Malware payload", "value": "809f92cf849e77a947f371e2a777aa92e61271c90578ac30a6928fbeead427ec8c4deb9971576435d3b0e49509e63cbb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238729, "uuid": "be3ed025-59c2-42c6-8079-586648ab3159", "value": "T19EE6331464D023DDF9B3403DFEF18266E56934A11F35CB8B2AA887529E1B2F49D3E613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238729, "uuid": "a15fcbd4-80fb-4ccc-9c2f-c4d186156c6a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238729, "uuid": "ee5a54b0-833d-4b52-a661-2cac975e1a8b", "value": "393216:MX8FTrq3zak9bHzUUebfI3kb3aiXMCHWUjXycuI3/PGTAI:Me/q3vbHzCZb3JXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784238729, "uuid": "22cb41ce-bdb9-4fda-8b44-4ae5795e2276", "value": 14297281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784238729, "uuid": "26610932-00a5-4923-89b8-5cbe05873018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784238729, "uuid": "e8b3a415-5a3f-48f7-90f9-a59d272fbd23", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fcde8c-810f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784203802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203802, "uuid": "e35352d5-705d-49c1-8989-8a999a1a997a", "comment": "Malware payload", "value": "ad21561b4e64ef200ee04ff3b2314e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203802, "uuid": "12958575-ab92-4aab-9c72-ef467b12fb85", "comment": "Malware payload", "value": "ae0bee7f6f37f29ef5045919590975cd3ac56f4dabc0dd90a3a83a9b7e434a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203802, "uuid": "7b9b440e-57a9-44c5-b963-6b79adea96b5", "comment": "Malware payload", "value": "28d52b7adfd5bd7eaf167f9a8eac4bb61a86c78f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203802, "uuid": "204b07f3-945d-4a55-b6d0-56fe7798a77b", "comment": "Malware payload", "value": "22b7209b5bb77f64c36bbb283be732b33aabfa725ff0546062536c57ca12ad6b99ac4e51fec44b4cc06d8570ce3b49d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203802, "uuid": "beab4e03-9672-4f38-b26f-4cf89a809146", "value": "T164E633A157D00DF9E627A73EC80B8054A2B1BD064B25DDEF16E4428F2F17AD06E39BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203802, "uuid": "3674b0f2-c1a3-4773-8bb0-d8f719b99f7d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203802, "uuid": "614107f2-2eff-46a9-b437-2baa0a2a312a", "value": "393216:IjrFLGYlQbZklOIl2a+1SD8nTQcyoln7wCCOl:IfFi6QQoTnyU7aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203802, "uuid": "99e61939-be35-49ab-8e4c-e241dea25e82", "value": 14335486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203802, "uuid": "d9fc6890-b8a0-4262-9fe8-b9bc4eea2e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203802, "uuid": "c4e97464-5142-4efa-82ce-222b1c2bede4", "value": "ae0bee7f6f37f29ef5045919590975cd3ac56f4dabc0dd90a3a83a9b7e434a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ca978c-80eb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1784188286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188286, "uuid": "429151f2-2a9b-47d8-9517-028890b7a8f8", "comment": "Malware payload (DonutLoader)", "value": "38dfb8f27ed78234ed82350d80ea2599", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188286, "uuid": "cb544d5b-38a4-451c-951f-6d72f6019074", "comment": "Malware payload (DonutLoader)", "value": "af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188286, "uuid": "da3c0b18-21e5-44cd-b64d-1d690f14e7d7", "comment": "Malware payload (DonutLoader)", "value": "01d3b735168582614844b6bd2392de079eb4e94c", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188286, "uuid": "4f995ff6-eac9-401a-9061-d2d0f0433dc6", "comment": "Malware payload (DonutLoader)", "value": "2e11cc2e8138a067394690af1abec70cf13babccff4282103bfd8a34779ef0a542f9cb44eaec1e39b585a5a5e2869802", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188286, "uuid": "132c8a9b-71c0-4c97-9daa-139121c218d2", "value": "T13FF4332CF7F8AAC2F2619C7705D4B4041B02339EDDD68291242F67779C21667F1256BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188286, "uuid": "04d2c420-e285-452e-9367-0a5933bb94a6", "value": "12288:4cTHHERNTheXe5urVD/MW8C8KdKV3AwYS12ojrL5XusLkcyqyi7axon:4cbHEJU778CdKNYS1v+xFXi7axG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784188286, "uuid": "6d9e8630-a2c5-4b20-be3a-4a73e9d8eb52", "value": 788792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784188286, "uuid": "9d0f2dbd-175f-4821-8822-60b51b998a36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188286, "uuid": "c0f9c218-e495-4eaa-ab1d-80a8677d4570", "value": "Notice from Tax Department.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0629b3-80ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784174100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174100, "uuid": "a487b686-e6ea-4821-972b-17db450cfe54", "comment": "Malware payload (Prometei)", "value": "93f34bb6bc18bf11fe1a5137c545e39a", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174100, "uuid": "49ec8ae7-9878-4298-80c5-1694dac72fcf", "comment": "Malware payload (Prometei)", "value": "af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174100, "uuid": "ce566296-3b8a-4565-98cc-0aac113a1ad0", "comment": "Malware payload (Prometei)", "value": "f6060b8b2df84b7d6474269829cd21862b27368c", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784174100, "uuid": "1dae6d97-49a7-450d-acd8-88749ec69f6b", "comment": "Malware payload (Prometei)", "value": "4251244b731a94fb05ac46adb2e0008dc2a9e7619bfd647028371c310759cd8b07d1c0de454b3a546331e1a47b49029f", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174100, "uuid": "ba6d510c-0186-412a-849f-7f8a954c805f", "value": "T1F421E14F0B1586B14B6E98ABD79A82D79B0701430009CE15B7DC9A8ABF3A158F0E93C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174100, "uuid": "ede573c4-12b9-4ea8-a519-fb0bfff44c85", "value": "24:vP/iqghBgaU0dQtFw2AALFRYyYQmYlYYYcaYv2GYQYEDsYj9sK6YFu/sYgwya:vLCBC0dQb9AALfJfmgzEMpLFDsM9sz0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784174100, "uuid": "55f98c2a-e7a5-494f-b9a9-41d52447413d", "value": 1415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784174100, "uuid": "7748005d-350f-49c3-90c2-cc0c0dbbc335", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784174100, "uuid": "12c3440e-7c97-4e3d-9e1f-2587e60c016a", "value": "af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662bdefd-810f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784203856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203856, "uuid": "430827e9-8309-4e42-8bec-30e515857f64", "comment": "Malware payload", "value": "543cb8745c1af3f4965f8062b28e0e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203856, "uuid": "efdce058-b12d-4162-873c-d1fbb86cd569", "comment": "Malware payload", "value": "afabb604604f69f41313d52d60c9045db555e79a020362bba5d707e7504e5acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203856, "uuid": "dc13b92b-29c7-4883-8951-113b4a7e6948", "comment": "Malware payload", "value": "bd283ca863facfb6fd47c917fdb66594c16ab213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203856, "uuid": "b5c16660-4ebd-429c-9ab0-292cff07972b", "comment": "Malware payload", "value": "a6c8ecaab032f9c811d5b168d42152625a7ae3cd244b12c1712f51e2d63b600ad1dce41d8639961b4c9fc13d8f3c9860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203856, "uuid": "48d93b6b-42d1-4432-aef6-29c8129fe452", "value": "T193E733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203856, "uuid": "ccd5db67-e815-4ad3-8559-df33c3bfd3d6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203856, "uuid": "3cfea248-4076-4489-8218-26af27ebb135", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNz:jdPJKrtOsHtAsg7lxrmeVlQFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203856, "uuid": "0b4e685e-4534-41a2-be1e-6959e024b0a3", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203856, "uuid": "ae4b08c4-27c8-4dd7-b857-889e35c55f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203856, "uuid": "2bff870f-593c-474c-8222-d362def97d10", "value": "afabb604604f69f41313d52d60c9045db555e79a020362bba5d707e7504e5acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5908d6-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246147, "uuid": "da7e6843-8304-4d99-8046-6d9bae5e4b11", "comment": "Malware payload (Mirai)", "value": "ce8c364f2cddd7ad361174d846dc3069", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246147, "uuid": "0f2cb3af-7568-4fb0-aed7-bbb9b5987402", "comment": "Malware payload (Mirai)", "value": "b019e12026ac88f8e95e5b579aaea7129659e1c97433d16bea769b29c2acf7f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246147, "uuid": "19100a6b-1e28-426a-b7cf-b88459be43a0", "comment": "Malware payload (Mirai)", "value": "39db49fa376caea91da1f3ed1d23545369243d3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246147, "uuid": "f6f894a1-e386-4544-a245-d2c79ae5f301", "comment": "Malware payload (Mirai)", "value": "d43c0a47e94311343b746f4398b7009f853a7bbd52e89870234bc9c4a8b20340854ce06ef6a131b1a759b0842008a45c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246147, "uuid": "375b97ab-4eb3-45b9-b422-0639f89887a8", "value": "T101D32A46A9415E12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246147, "uuid": "a6bc476b-f857-45f2-9173-891e92d008fe", "value": "3072:7+P2y1xiqVpO4nnHfGxKWER3AsBcaJYC8E8ABgc4f3610uGjIHC:fy1hznHexKWEdAGcaJYC8Ebgc460TsHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246147, "uuid": "4b44b217-7318-4de6-a936-e64a59f39a88", "value": 135532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246147, "uuid": "8ee520b7-583c-4408-9403-f33cd45819e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246147, "uuid": "b144535e-a482-48ea-9a25-5b3cefd96c0b", "value": "nerv.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e612b07a-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186461, "uuid": "9b1babd6-b5f4-410e-bcae-61b2bd7e96fa", "comment": "Malware payload", "value": "36bf1b908cd8e5e8ce9b3d88f716526b", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186461, "uuid": "d8a8b65d-18ce-449a-9e04-e62a05b76390", "comment": "Malware payload", "value": "b0b6c3be5ea20c257e55a56566ccc46a9367c5886e2c9be0478df6101bec256d", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186461, "uuid": "89063753-4591-4817-835d-4cbba7a0f0ff", "comment": "Malware payload", "value": "e4f86b26e3968f234ee40f5be296e3de208d739d", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186461, "uuid": "5f433dcd-ae93-4a53-be97-3b430efe394a", "comment": "Malware payload", "value": "c3fb3d31c522362363ffb416e7901564f8e63738491ca4e01dd333892c9f83792ebd02fd5b93e36f1dcd2973322de5dc", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186461, "uuid": "8c7c4c8c-9e01-4cbb-8d91-1d8f943e3147", "value": "T198823B27EB8A866CFC10C4B882B79F73F167F446A516F30A97E18B292E90760173854D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186461, "uuid": "b4c91963-7f5c-4845-b7f9-c5c592fc3e49", "value": "384:8wXdaOTfCrauAPjWzXiaaO3pjr5Zzr2zOAKFYzZngLW:80IOfCrauDzbBAMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186461, "uuid": "f5109590-9492-45fe-8102-2bd9078e4c53", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186461, "uuid": "68f4f669-8ac7-44bb-9002-01b5b2da4415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186461, "uuid": "cad977b2-1e30-426d-bd90-f628d4f7340e", "value": "killav", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7238aa-8120-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784211356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211356, "uuid": "cf1af122-bb2a-4e3e-975c-1c87a5886678", "comment": "Malware payload", "value": "ee0e7ca9573fce7f936a1dbd8bc5dd65", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211356, "uuid": "df17a1f7-6f03-46ee-b96c-7c29523c2157", "comment": "Malware payload", "value": "b0bb24ef186899d151218036cf4f9f62de9a2a881f9e0fce576c428995f14a58", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211356, "uuid": "c2b786c9-2b34-4924-83b8-d9648c58e7ba", "comment": "Malware payload", "value": "f3b0f6ffffa2cf45d6644f521383f5efe37a9abd", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784211356, "uuid": "f494b5b1-23c8-4fe9-bd7a-2f7f3e9962b6", "comment": "Malware payload", "value": "b279422ecc53c880f7e332ae1dad132418ebf729306379d70e9f1b2d4467ae500edf8047a0b1c9f2f3c3a32fd006c46b", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211356, "uuid": "ec272f53-fd67-492e-b2bf-7ea456d71c0a", "value": "T19DA3203076E90058E1F3EFB2ACF477C5AEBFB5B76D72525A1441020A1912E40ED26B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211356, "uuid": "b6eb03cf-0c49-42b8-988b-ae3535abddf0", "value": "192:TVcyagfZJduNqbOacoHFc1E6zZZ6ScIAMhBV7HJK:TVcEfZJdsac2FcSpScIPBV7HJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784211356, "uuid": "a8f5b06c-65d8-419b-84b1-813abe490285", "value": 107289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784211356, "uuid": "42c7371f-084f-4df2-81d7-ecd16db0c3fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784211356, "uuid": "1e41e6e7-d095-4bb1-95e8-bb728d4fdb0a", "value": "ProtokolZatrimannya.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd97321-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784185347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185347, "uuid": "a09133eb-5317-4974-ae38-17f179fbdd2d", "comment": "Malware payload (RemcosRAT)", "value": "8d8d6a6893dfb8f2a42614530848f988", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185347, "uuid": "c83dfd16-edc6-408d-b97c-0a02d64510a2", "comment": "Malware payload (RemcosRAT)", "value": "b19a5e35b834b52e290d4287956eaaf93e5d19a92ced03638fd7f0305c23b896", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185347, "uuid": "60509178-56fa-447a-82ef-3643b555b9b3", "comment": "Malware payload (RemcosRAT)", "value": "c3d3b32efe2150c28ef9ef2ea69afa577b3207b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185347, "uuid": "6330b7ff-ace2-45d8-add2-32efaaf08d4d", "comment": "Malware payload (RemcosRAT)", "value": "f740fe5fcc039163522c92a16bf35e956d8a07072ca9104fde714617f2f3bd76ebe7204a795a654e3f0053cbbdf84325", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185347, "uuid": "93d9ba5e-93d4-40dc-8cca-34999f0c4aaf", "value": "T1ECA57CF0288A5385379D1A069F569879F86040707CB6F23D6E0CDBCCB612A71F93697B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185347, "uuid": "be49979e-415b-4ae1-8894-b146ddd62c6c", "value": "192:mMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOMOM:jAzCCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185347, "uuid": "37697b60-badb-469d-81fe-1ccc34b2ab71", "value": 2144193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185347, "uuid": "c9a40cd4-fbb4-4283-80fc-9784ab24999b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185347, "uuid": "cebd676c-8132-4488-8cb4-9d4f5b4afbaa", "value": "Order lists.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9617beaa-816c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784243879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784243879, "uuid": "065755e6-d844-4481-922c-13d8e0cb2f8f", "comment": "Malware payload (Mirai)", "value": "fe9885d0230eb6797b695e203ba229d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784243879, "uuid": "db1ed19e-cd54-4bec-a0d1-8292f1ca5ec7", "comment": "Malware payload (Mirai)", "value": "b1ee45a84d93ac693f95caa82101559e9d5dabb7e5b15067ad58bf193c20707f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784243879, "uuid": "0e8cdcc3-00d2-4d53-b813-b628179ebfc6", "comment": "Malware payload (Mirai)", "value": "7fb858b5938c15bb53c72518524854e5cd2f92b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784243879, "uuid": "eafc8acc-c68f-4f87-b153-22583631684d", "comment": "Malware payload (Mirai)", "value": "59ced76dc816ea1b3087ab5f4475b49c5deae3cd9a6aa4e843226b0824d136f362dab6c633a05dd3a9ff139ac8ee4621", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784243879, "uuid": "57d308d0-a5d1-4c15-b96a-d8c0a2c935f5", "value": "T1E6157D2AF2F2E67DD00BC03047DBC6B15131F0755A322D7B26C09A353EAADA5171AB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784243879, "uuid": "63ab4383-949a-41a4-9fb3-f497d3cd4d84", "value": "12288:qglfBNgdY4IrdcHZ7jJ9pn0tArMvGwGayCWBHXlLOOpNTCpNB:qgdBNgdVfHF0tA4vGH/OSNTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784243879, "uuid": "ab2d6adf-138c-401c-a8ae-9267d19fd99b", "value": 876176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784243879, "uuid": "144a8b6f-308d-4ec2-8f40-b5f5b394fad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784243879, "uuid": "d17df09c-21f5-4ec8-a7df-b23e1af649b5", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce02749-814c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784230040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230040, "uuid": "fbc79f97-2869-4496-a7ba-f5dfe034176e", "comment": "Malware payload (Mirai)", "value": "2ef7fef59e33ad7c83a07c6a73435f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230040, "uuid": "2c182827-0b9c-4cc9-94e9-c45141d62744", "comment": "Malware payload (Mirai)", "value": "b214e83d368a96cc26c0932c5d92e0585a959a3cf5edae1210948aacb83bbc93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230040, "uuid": "8bbe0695-296c-40b0-8aa5-cb3608cc9e51", "comment": "Malware payload (Mirai)", "value": "2931043fda2d4e05328af79d55d3b47b16fef5f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784230040, "uuid": "40c2d331-3a2c-4f8d-9b42-bef7a8eab3be", "comment": "Malware payload (Mirai)", "value": "05c9532e030f1b395638251ff0ff70b58b78e644dc80d84045d158ddaf33420503a5b26dcfdc490d5d837714d2afaff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230040, "uuid": "fcbbee70-d409-4c46-826c-af91399c1f58", "value": "T1C443F169FA1BDBADE30640376C08FE0E1811CA49CFD8DC669684273F6815EC1681DB6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230040, "uuid": "a27338b5-2c78-4644-89d1-2a0a95d51615", "value": "1536:wpVCDoc6V2oqICiJSm8ck9f0gCa/X7y7DxqGLNynouy8DMw:sgo/VjqICHm8ck9sgCxZquqoutDMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784230040, "uuid": "13017912-5efa-41c0-950e-bd2c6bf03c27", "value": 59320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784230040, "uuid": "de48bc9b-2027-45ac-9851-1fcc0e55445f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784230040, "uuid": "5ef0c88d-d749-4ebe-a477-0008b3504968", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e860484b-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246165, "uuid": "bee2b74a-498f-4fbe-ad31-f9251a946fde", "comment": "Malware payload (Mirai)", "value": "4e3147c080091800fedbf2153fb59736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246165, "uuid": "58b9ed9c-f7c1-4ecd-a8b2-485357f9b654", "comment": "Malware payload (Mirai)", "value": "b228a7e7b1deba424f0a2764fc19c9d7181da226dec3bc3f9c16b0e66758ad6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246165, "uuid": "f0bb6e6d-7e0c-4b34-a97c-f76a14a77eb0", "comment": "Malware payload (Mirai)", "value": "600fab2fd0b13cb4d9b9b195eba898d424aba6f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246165, "uuid": "b48df00f-bbe5-4ffe-a3dc-ff2baaec5066", "comment": "Malware payload (Mirai)", "value": "4273f7f512efd80b985661da9eb4ad1ba91ca1fd127fa1ecc89ca0f51f0d4030135ad4726cdf2c08839ab6838d931bf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246165, "uuid": "8b199583-2f4a-4ea4-840b-7494de1af6ce", "value": "T1D2D30816FB210EFBDCABCD374AE91705258C651A22AE7F367934C928F44B15B16E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246165, "uuid": "e25529a5-e17a-4637-8dac-08e81a2c184a", "value": "3072:NXj17Jo82I/GFSiPep0639c51hER2jPrRz:NXFLOPX8mxERWVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246165, "uuid": "3fc4f358-2aed-4e97-9a32-35c5943a7295", "value": 141604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246165, "uuid": "32be97b0-ce06-46f9-a561-8fcd5715c927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246165, "uuid": "613d9a9b-d18a-437d-9e37-64b263cbab2e", "value": "nerv.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b09ecb-813f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784224328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224328, "uuid": "e1e0e1e1-3b22-45ed-8756-d5f86dacda48", "comment": "Malware payload", "value": "363e2636b49e7b260a596dcc5feb680d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224328, "uuid": "836e5ca0-9a36-4cc7-8707-cd0191281da8", "comment": "Malware payload", "value": "b274ed3ed0879c0ed3f8eb386b945e56122574f6f6ba854d3e7b7bf20afcbc9b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224328, "uuid": "da1eea7a-f4ff-4420-8a03-683f85fd2987", "comment": "Malware payload", "value": "030560902efce15746f81ff97f28b7db864717f7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224328, "uuid": "a96f9d51-28bc-4e71-834b-c723dcd1cc6b", "comment": "Malware payload", "value": "3a7e3faf5a2885c0e6adf8a29bacd27d4d4104033cc8db8204706316aa74edf8ce87d3d8dc2e5e1fb3144cb3c0b8a363", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224328, "uuid": "e6b3d2d5-8088-4022-92ae-215b0fbf8435", "value": "T1AAE63314AAC012DBE8B77038E5F19296D95AB8760371C2EB13A4C3E56E6B1F54C3D31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224328, "uuid": "30489686-f464-4b39-a63b-14af6e3b2e8b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224328, "uuid": "13103aef-a1bf-40df-b757-705b4b56bf76", "value": "393216:ZiZTqjA7ePEzLOvYyXMCHWUjXjcuI3/PGTAI:ZYE8LSvYyXMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224328, "uuid": "7fbd1ab8-0d71-474e-9fac-49d536ed8d7e", "value": 14290085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224328, "uuid": "6c479a51-f1ce-4e0a-92ee-9152313e12f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224328, "uuid": "cf6b7d08-2414-4868-908a-db3e712c3224", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2113652-80d1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784177381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177381, "uuid": "a7dfebfa-0075-4033-ac59-272a1d68915e", "comment": "Malware payload (Mirai)", "value": "be36faa3a821eedea3922dd1512f7034", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177381, "uuid": "828443d2-758e-4be6-991f-b6c6edbd38f6", "comment": "Malware payload (Mirai)", "value": "b4764b40d8552c955e65797bcb7e80823be94ff2f436f26440da8d844ed2c018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177381, "uuid": "b2954720-8f21-47b2-a0a3-32af4726578d", "comment": "Malware payload (Mirai)", "value": "78795f5f5be5479aed60619216aba52482b8c1dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177381, "uuid": "dbe3be53-10f1-4706-ac30-b737eff89608", "comment": "Malware payload (Mirai)", "value": "3f495288720933185a149cc61b00c896e3a5a293e10a32861a35197fc488c6dd265774103321fa17463f963c410827d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177381, "uuid": "1f1d01b1-ef39-427e-89bc-d82422402613", "value": "T1D4148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177381, "uuid": "cdeaea30-8445-4c16-8921-ca577cbd7545", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRmUKG:IcY5JpMByVs9jS5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784177381, "uuid": "563522a4-9fa9-4e5e-99bf-0efb8cc6b40b", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784177381, "uuid": "e99d06cf-a72f-4b36-bd54-0833f1a297c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177381, "uuid": "df40c9dc-3be9-4231-b99a-cd37d30a865e", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d70144-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234645, "uuid": "31b780a4-e711-4565-8cef-674e5dacddae", "comment": "Malware payload (Mirai)", "value": "665e7ff46c8ba419618a7512ec90505a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234645, "uuid": "8124211f-b552-439a-a14e-dfd1e6be0e7c", "comment": "Malware payload (Mirai)", "value": "b48beb80eb14cf08abf906eba926a131bc699846844883bec9458711b4e27db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234645, "uuid": "a55fe5a5-6215-490c-b59d-bcdfdb3c2da1", "comment": "Malware payload (Mirai)", "value": "bf2f3e0375f7039ffc8feb51fce492d445d90746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234645, "uuid": "0cacc17d-4edb-42fa-a0ee-a2ce3914763a", "comment": "Malware payload (Mirai)", "value": "57a4e5b280ac43738f203c68ed4f17d61efb0890c195fae374c2c3fe2133a86b919d937b2ebb037933f68d95e91baaf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234645, "uuid": "5aea6d03-e109-4aae-80c3-4c3604267024", "value": "T18DC32945B8829622C6D723BAFA6E21CD336163E9D3DF31138E219F1137C659B0D67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234645, "uuid": "73873b86-14ff-4c01-a7ad-98ca6ed4286f", "value": "1536:FKS6AASQ6ei2cdv/Lpl+9RKp1anmmE4zQyFRQP2voSNemOlccFPLv7H/N:czAA/6eedYZElTP2vonxn7H/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234645, "uuid": "41a159a1-f5b4-4740-902a-8746296b13fb", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234645, "uuid": "889f9e65-5f80-4974-9ac3-a1b8a6c1c5b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234645, "uuid": "827ec1f9-deb8-4deb-bc14-7b5fede669e2", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeb2926-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178826, "uuid": "b5cc7930-55e6-4cf4-bebb-3443cabf2901", "comment": "Malware payload (CoinMiner)", "value": "d87b81b0701fe0362da6764d421cd313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178826, "uuid": "3adf26bc-0e05-4c0d-9f22-f224a5f3b07b", "comment": "Malware payload (CoinMiner)", "value": "b4d780466f9deb04216b42d6cef6cdf5efb0dc6914fa1b543f4d64ae0326d7a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178826, "uuid": "ac93964b-4888-40dd-8e1d-f7e0a39ba529", "comment": "Malware payload (CoinMiner)", "value": "f9aba55c44cef56ccf59807a40237cb247b3d852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178826, "uuid": "65934cb6-63f3-4042-a624-76402e1a6c34", "comment": "Malware payload (CoinMiner)", "value": "deaede255258676cc155809395d97052b4eba24fe05c352e93eb31e5de0e6c66719d0125a6f6ebf0a38247bf0ccf76b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178826, "uuid": "f33d735a-a8d0-41fc-8a8d-232c4bf4e0e7", "value": "T18F9533DE264D381B0C99BF317BF3615A4EE362B0811B161EBB18D5E82C64497B6C643F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178826, "uuid": "652c6951-e94a-4b70-9fa9-50d640788c89", "value": "49152:EkUZHewTYZyQdQnyXPlRFRchFiFBHLcilVA9Vfevf2p8ep:hUZKykPlPRcE9IY09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178826, "uuid": "507d5a81-6bcc-44cf-ae24-417ff8c92833", "value": 1951792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178826, "uuid": "65fa110b-dbc1-4a3c-ab8c-f5c5da59e24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178826, "uuid": "c8b07157-2a35-4eb3-b29c-0b453a0a71c6", "value": "b4d780466f9deb04216b42d6cef6cdf5efb0dc6914fa1b543f4d64ae0326d7a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7281fe52-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212896, "uuid": "f64f3625-7c31-4bc3-b55d-e3cc8c792c5e", "comment": "Malware payload (Mirai)", "value": "3fc42ecae4e4e040200a6428b7f2dcc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212896, "uuid": "577cb40a-7f1f-4725-9bea-8d9fdbde38c3", "comment": "Malware payload (Mirai)", "value": "b6942df0c5947e2093a79223166d4ddd8df493de9f01cb18457f5d8c9ceab7a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212896, "uuid": "b4c8673a-db3a-4280-89ed-0021ba2e3b4f", "comment": "Malware payload (Mirai)", "value": "e97be7b496a3484cc8a3901ce7d43edc0a2d3747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212896, "uuid": "3965e1d6-ef69-4065-a24d-1397f5edb7d3", "comment": "Malware payload (Mirai)", "value": "c102e2e1f648f0ceb5ac4b076dbbba83e3621487aeedefe56851225e3ee6c0140b8130d79f20636c67300212c0d20228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212896, "uuid": "e632df75-b7e5-43af-bc0f-08a54c4d83a1", "value": "T131730995B8818B22C9D512BEFA1E118D3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212896, "uuid": "8b357bc1-c4c5-4df3-b34b-cf65dfd6305a", "value": "1536:TAnYSDACyTQtObE80RbavEwpDQQMgiR33ATHa387oL5oYMd:mMCH4p0Rbavg3ATHa38kLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212896, "uuid": "8811db22-4971-4061-8c2a-66509e3e3566", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212896, "uuid": "a868f47e-9478-4c17-b9d7-43fe5ec4a79e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212896, "uuid": "d5aed0dd-502c-4a7b-b5e3-e5b698afa3ac", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a654ac6c-8116-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784206970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206970, "uuid": "05814446-2d21-4b8d-92eb-93e0bf2a1084", "comment": "Malware payload (PhantomStealer)", "value": "b7ccfe406d065782ba492aee53a2b721", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206970, "uuid": "41814a92-dddf-451f-ac79-f7b6db5e5e85", "comment": "Malware payload (PhantomStealer)", "value": "b8719f39f6aceed3cf69ae9b49fbeb69da4e12ad8273296dcb004290f81eab22", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206970, "uuid": "921b5ded-cb7f-4431-b28c-1663324738b6", "comment": "Malware payload (PhantomStealer)", "value": "b54852b5850a9b4557da4fd871d475e358b4955e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206970, "uuid": "d35555f5-3347-4afa-a058-ce37e6e76eca", "comment": "Malware payload (PhantomStealer)", "value": "f9071c5886d58bd4aa31017335629ccb2e995a9c95061b352ccb94e6a9834636ae25d6c2adc0d401ff25d17abf6b1da6", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206970, "uuid": "2eede7cb-f99e-4dc3-b8ee-b8f8871dee37", "value": "T1B7557C24B3F405A4F1FF9B75D4B18522CA71F84A9A34C78F259882AE0E337919D74B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206970, "uuid": "fdf86897-9380-4566-acdf-b9af821fb343", "value": "12288:U9C924e4koL3MpKy3OzQdyBxjbCFroh3l+C6E0+:U9CQ4FMKy3OzQdyXbCFQl+CN0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784206970, "uuid": "b8efc68e-3094-4d4a-a17b-1b04aa541d24", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784206970, "uuid": "5cf54fad-8351-4d44-812d-ada89d0fecef", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206970, "uuid": "c0b0e9e5-a1fe-4b37-ad1e-3f1f3e81f50e", "value": "Booking-302-100-475-pdf (1).img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c45094-80e2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784184717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184717, "uuid": "9b50dfd7-7dc0-4692-9dab-5cbaeb0baccd", "comment": "Malware payload (Efimer)", "value": "7929dfebaa9211a09ad7af7e52a3e6ba", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184717, "uuid": "70050189-80d4-4907-b493-c4a6c8c78b7a", "comment": "Malware payload (Efimer)", "value": "b8c06437d73a92c739b949a576fdceaf42af55b356feb2f082fd6154e5b338f2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184717, "uuid": "956d90ba-26ab-4021-b930-9ca854873d40", "comment": "Malware payload (Efimer)", "value": "9584bb2e3341b948253684c1082f2fc190c3faf7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184717, "uuid": "0241a6be-6d24-4c94-a2c6-8c8300b4c69e", "comment": "Malware payload (Efimer)", "value": "48cac80217a364799aa9fdc9ab7ab25d9011ed9fbeb3beb6d0583136d363de69d88bcadcfa2aa7b38416d4626b25761c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184717, "uuid": "735a7845-7cd8-4ba2-bba4-e514be9d6183", "value": "T1ACE6331866D053FFE9B3813EE9F19592E1B170755B30C9AB978893716E232E18C3D623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184717, "uuid": "be7228fa-f587-4ca4-84ee-f6f6eec7c7a7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184717, "uuid": "08a324ef-3736-420b-ae79-458b49bf4537", "value": "393216:rMq9bN/B9CgCImkgHXMCHWUjX9cuI3/PGTAI:rJNXefjHXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184717, "uuid": "7a1a78c9-e63b-4b24-a033-07deb30d7f34", "value": 14322327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184717, "uuid": "cbfd964b-efa7-458c-8f1c-ebb5b29b32fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184717, "uuid": "f3fc9baa-80ab-487e-8bac-d886959c2edd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54cf042-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234590, "uuid": "ed4bc02e-6779-4d8d-b67f-0039652eb81b", "comment": "Malware payload (Mirai)", "value": "4194624b42e65a581c2fc3cd2b9fc1f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234590, "uuid": "513efbd0-c56b-445a-af88-0ec746893791", "comment": "Malware payload (Mirai)", "value": "b8f0cd29f437c39f1eef27cb098a2b1d53af4fd895ad101d589a013eedd08f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234590, "uuid": "810c6177-1a3d-446f-8ca8-3e7dbf0215d1", "comment": "Malware payload (Mirai)", "value": "6159bfe0602fe4198a22b6dcf28a239012d0c21a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234590, "uuid": "6f03b4d4-0624-4d94-b22c-aff4429a7913", "comment": "Malware payload (Mirai)", "value": "ac5f8d7af45d1f5dfd4c2cdfbb5ce8fd7a54844b38ece52c917c56d9e5c806b85edf1a3e2d81c4c97ac6a4401232f649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234590, "uuid": "832bf94e-6045-4032-b4af-5b565e7bed5d", "value": "T16B23F10BD697CC1BC0A9447D247FB49A2C41C98EF35D747F3AD131688762E909EBD262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234590, "uuid": "81024250-7d21-470a-9aff-451a6d1bfdfd", "value": "768:qhL7Psev7osOaryryH1BKpzYxhS4k6JvFj+75Ep8CH6HyS5OPLOAYPD9QQBynbcI:qhL4WH1Bthx9MEf6/iOA+D9unouy8Hy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234590, "uuid": "663e1612-0acb-4970-b165-ae52856c9734", "value": 49084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234590, "uuid": "ae38f9b6-1ee1-4a5a-b181-3d83f435b853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234590, "uuid": "6edeaf96-7c42-4b14-ab77-640ec25f8efd", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3719bb20-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784212796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212796, "uuid": "d759681a-9a22-4210-9fa3-ab76c7fe7213", "comment": "Malware payload (Gafgyt)", "value": "c5dcbd9b9612f1613df6cc9b94e50931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212796, "uuid": "51d7990b-d68b-4263-b28b-750e0bc32c7d", "comment": "Malware payload (Gafgyt)", "value": "b9f19cb9fbd83466d02d96c03f2782f0b417c69ea2196e5677626e71a8ad528d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212796, "uuid": "46e89efe-5919-45d7-b392-a260c9a0a929", "comment": "Malware payload (Gafgyt)", "value": "0bac62d1839709ce57afaee299b9348ae2cfa0d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212796, "uuid": "7ce7cabf-dbe4-4dfa-a129-b2411357b2b1", "comment": "Malware payload (Gafgyt)", "value": "4996b4edca8b9394344aa9ae21d2f22c55c47a1351950db1268f72d49cf7ba55349998d17465e265f0e3f23faf748b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212796, "uuid": "2e952952-8f2d-43e3-adbe-b1ea7f61a5fe", "value": "T148B32A44FC414B6BC3D327BAE78E478D3B315AA457DB33156A38AEF42BC17892D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212796, "uuid": "706ce67e-2472-4509-ab99-9f755421f6ab", "value": "3072:ZpRgKs6PkJyzxRtm3+BUEhAn0fBumVJTQwOPHCXQ3o:Z68kJyzxfmuBdAnsBumVJTQwOPHCXQ3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212796, "uuid": "7bc56c5d-310a-40d3-a861-786b0c9d70f4", "value": 118170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212796, "uuid": "299f2eb7-c7a0-4643-887d-a96749bf01b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212796, "uuid": "8ac803b9-69ce-4405-b998-b1076e8987ec", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10385d75-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185243, "uuid": "4f7bb323-3d1e-4779-a41e-0854d8ffe29c", "comment": "Malware payload (XWorm)", "value": "cf1de30d41b412ffd5ce69d950fe0c2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185243, "uuid": "36be8705-99fa-4bf9-bd2a-275e433cf8cd", "comment": "Malware payload (XWorm)", "value": "bb112bb9c4a80dfa451b0af100d3d4dd90e803575c1e18bc1f72ed222a3ec49b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185243, "uuid": "1c7a2dec-f791-476a-9831-472a64a1c131", "comment": "Malware payload (XWorm)", "value": "41e847146d52b26c9d3720ff262f8061c6c24845", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185243, "uuid": "8750d696-5e29-4c4f-aada-bf38e377c036", "comment": "Malware payload (XWorm)", "value": "31b8ca97f4074e4b277fc4c96e2df7fae58a983071cfa94bcf2546f5a8ae3789eff66509d9a5e377740d0e4c1b0df689", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185243, "uuid": "cf638ecb-103a-41e4-b03f-a2af4d4e0299", "value": "T1D1B5DAD4EEB897B562BF16F90B252200AA1D65C14B0ECCB877EF47DED8044C42C5B9A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185243, "uuid": "8bebf1cb-6e55-4e7d-a9f8-ad16616b1125", "value": "384:aiP/CJA0+VzXDWWPEJ0H84aLBYc4SzTFptHDZuZyNSQhDIEy6Nb45r4Qmbm:B/gty/h2C2dYGFptHDsUxhDL0UQmbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185243, "uuid": "a690cf13-b4f6-48b6-97d6-0b6140f793fd", "value": 2378109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185243, "uuid": "51f53ecd-9e7e-4bcc-b5f1-386d307c5fb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185243, "uuid": "911ef909-8e1a-4017-91a3-afcc78b76f68", "value": "15.07.2026 pago a Solupaper.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147475ab-8114-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784205866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205866, "uuid": "4b1009b6-ae3a-4f35-a761-67a43d5b4f21", "comment": "Malware payload (Mirai)", "value": "074658e2e531d73d001c6e30081036a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205866, "uuid": "506b9dee-8489-49a1-8191-f72beb836216", "comment": "Malware payload (Mirai)", "value": "bb36333c2d24f329c4cf7a514d184273c0e141f3c724bc69b26a4e5a430cd6d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205866, "uuid": "7c0c710e-69db-4e8b-aaf4-3130433a8839", "comment": "Malware payload (Mirai)", "value": "d1905e16958a18679388a6adf91b28c5ce96ca91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205866, "uuid": "f9f9e4ea-035d-4d2f-b55b-7c72ea30eb9b", "comment": "Malware payload (Mirai)", "value": "c326acbe23e2b1afd042ff20d381b2d8b59cc5c4b2d1f431fc9ed757f7a55fb78ef86ec9976a0c3a40a77675ba06795d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205866, "uuid": "1565c8dc-38df-4721-90ea-9a666d0d6925", "value": "T155148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205866, "uuid": "c63b5b00-a7b1-4b45-b233-79af32101bc0", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRsUKG:IcY5JpMByVs9jSHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205866, "uuid": "138f7aa2-7ca1-451a-b7fc-7cb618ff14dd", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205866, "uuid": "d391fea7-eab4-4f11-8f5d-80a6be692620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205866, "uuid": "7815c4a9-175a-461f-80e6-d5feeec642c0", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9533f92-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186386, "uuid": "4fdd6241-6a76-47d7-8289-d349d079cd23", "comment": "Malware payload", "value": "48312e4912eb3958ec192cc35990dba1", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186386, "uuid": "45c881e2-c6a1-4f41-adac-d6d2ac42782a", "comment": "Malware payload", "value": "bbbd03df4cf60331873e8b1e266a75b5c73cce91239cd49b9c9b68041aa7c3db", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186386, "uuid": "34210a0b-1a03-4c42-981c-0963bdc3ed6a", "comment": "Malware payload", "value": "71268fb0fddc915b1ff3a1c9fad7fb5f2528e29e", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186386, "uuid": "8abe3898-d85c-4833-ad3b-ac510d317b79", "comment": "Malware payload", "value": "07339a55b2d7c30165cdaf84c1bbb3f9516f54ab6dc9fb0ce09322f5754277aef9efbd5c4e4cb52f695ada0a6964e875", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186386, "uuid": "b2fac282-0797-4b5d-b68a-582b7b60151a", "value": "T18065F152B1E96CA8DFF315BF918640F9775AF9A2078502DB3EB472F24B203C48439D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186386, "uuid": "a1ee2813-dcab-4742-8794-15d0532eda9a", "value": "24576:81ib43vNZ+mYhxYBdE+lToJe5k/uTG4IKPwA3EX:m3vBYCi+Zue5k/H8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186386, "uuid": "769acb4a-9a18-492c-80b8-07a4aadc74cd", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186386, "uuid": "ec43e287-585f-4cf7-9358-59fe53993c06", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186386, "uuid": "d556e495-4e93-4fab-97f1-e673ca8092c4", "value": "bbbd03df4cf60331873e8b1e266a75b5c73cce91239cd49b9c9b68041aa7c3db.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a4d1cf-810d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202895, "uuid": "8f5f146e-ebd4-40d3-b025-ba6e5edd7ef5", "comment": "Malware payload (Mirai)", "value": "44643efcc8573b5598244802034592ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202895, "uuid": "22559158-ffa7-42b2-8dc8-7b26056abced", "comment": "Malware payload (Mirai)", "value": "bbc90ea30268738b04f8a5a6c5af1a37b2c5c8eca4bcf53f89d9b3da1973e493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202895, "uuid": "bea3eb49-b023-405c-ba9f-1c455cf27798", "comment": "Malware payload (Mirai)", "value": "394eafa7e84a52d952ac8c2f37acccff5cbba4f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202895, "uuid": "ba20696e-166a-476b-8b78-fd1b7b24736b", "comment": "Malware payload (Mirai)", "value": "6ea8d3126a2886eb9b56a036f17d4eb19851bafeb5ca408153175fa21910052dc6e79592befe1478f70b6170eba27ddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202895, "uuid": "766d1e40-7192-4ad9-aa3f-05e8a95fe08e", "value": "T14EC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202895, "uuid": "c461227a-89d4-48e2-bb9d-0ff41c93a74e", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyWw:VoRNjmj1VGFVrRiyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202895, "uuid": "c1d28dff-a822-4c85-b76b-f0e877205b95", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202895, "uuid": "781d242c-9efd-46e1-901c-ae736b73eda5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202895, "uuid": "b4c72bf1-b121-464e-8031-e80bb8eb2713", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d80f70f-8141-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784225262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225262, "uuid": "0c651e76-409c-48f6-9c0a-ef6e1a020a2e", "comment": "Malware payload", "value": "053d536f240f35d3fbc86821e74f145f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225262, "uuid": "f1a98ea5-1488-4b39-aa6f-531c91c96b86", "comment": "Malware payload", "value": "bc12b183198174b8609a39a03d46039194f23999fc51107b9507709bd7c52906", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225262, "uuid": "1ad0dc15-83f1-45c7-a99a-e26596c2ed8e", "comment": "Malware payload", "value": "cd6036b4dd5c8172c9ef6ff59c6ef22581c0465a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225262, "uuid": "992b967d-18c0-4a0c-b913-daa929b18b24", "comment": "Malware payload", "value": "6201e3630e1da6a260a126a88f559792602f3338d8a2eb5a8a76dc89d02debf56357f1c2853dcff0218baddff74459a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225262, "uuid": "f95345df-3bb4-49c5-a3ed-9527be611c15", "value": "T1BB236D6516857C15EA99C4361C7E2F0CBDAD43E6320852DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225262, "uuid": "3d77f1cf-d645-4565-9cdd-b1cf8b1a2856", "value": "768:zcsr0a1ldL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:rh8cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225262, "uuid": "2947fe89-901e-485c-97b0-127e57c054e7", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225262, "uuid": "b3d90514-cdb4-4471-bdf4-50444ab4597b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225262, "uuid": "269c5d1a-6860-4e84-ad20-480904379211", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f27d938-80bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784168706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168706, "uuid": "7b948724-5f50-47c4-b0bf-608c86df8a0d", "comment": "Malware payload (AsyncRAT)", "value": "fe5ea86baf480aa7bd6f81542a83b9ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168706, "uuid": "25bf2c8d-8653-4f47-a544-3522867ba166", "comment": "Malware payload (AsyncRAT)", "value": "bc2d5313943d2e4a33cdb0a4708c6ec94c60f26ae402626caf970e283d0ad9d4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168706, "uuid": "fe83de28-9683-4438-adbb-c0fa118fe658", "comment": "Malware payload (AsyncRAT)", "value": "e8befc6de16d4809754a296aa842182111f02d64", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168706, "uuid": "bf893cfb-efde-4205-a623-dd466d1013fe", "comment": "Malware payload (AsyncRAT)", "value": "c24ec8f8b5f1793f96b65d70a2750cfc1ff11ffb1a7512dae928e19769ec72511a150712bfdef0628f17e8d398537fdc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168706, "uuid": "cf8afc30-6323-4528-bf98-f41e56d0bf69", "value": "T116C4E0E427C42DBC575A5E3AB23FA0D9F6A109C5298508CBF716BC44EAB9700F5A3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168706, "uuid": "b8017638-de26-44fc-b48a-37ca111a2546", "value": "6144:jYecHF08PeWBOY8ha5KR6on0ELDzAGnt2Hl9iYsKFJj8qHD7XGJRnt7YdNA7u+5O:jYDF08bov7n0asGt2HniYsKXReJ1Bx78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784168706, "uuid": "ccf9aa0a-c1e8-4a12-8848-c8a897dc3669", "value": 559266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784168706, "uuid": "811ebc92-e5c0-463c-ba33-ee8cf142a7a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168706, "uuid": "1eebbd64-3ced-4124-8136-b9046c6171d1", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e2739f-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784224980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224980, "uuid": "007a3db1-ca7a-48b4-a919-d6e61f9d2878", "comment": "Malware payload (Mirai)", "value": "9de6a052f098e436f10b3d5d199734bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224980, "uuid": "a13bb69b-5282-4eaa-9127-ace3e4898d8e", "comment": "Malware payload (Mirai)", "value": "bcb1ef5bb211a8a3402b4a9cdf2469e4b2cc8b5a5fc14f859ecbf79ee2a25177", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224980, "uuid": "e9da4e5c-1613-41dc-8051-27b19eabfd29", "comment": "Malware payload (Mirai)", "value": "8b40b511b96443ca2c83532bd7024160eff4d809", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224980, "uuid": "7715996c-7a45-4f30-a1d5-a9ccc6b3b3ac", "comment": "Malware payload (Mirai)", "value": "8614fe1bcca22ed1380ae9ba16eacba456f4a08ae9eb3909f7e644efd4253bde951760e951e8dbed1824763efa389139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224980, "uuid": "af5acf8e-26ac-4d8f-a25a-3d3dc48d1d2c", "value": "T184C329A9F880DE52C6D1267AF75E514C33231378D3DE7109CE209E3467EBD5A0E7A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224980, "uuid": "c6f52fca-82af-4506-998c-fe77cc275484", "value": "3072:aY45kbyt+I9M6lKBx9RokeVElcYEEUrH7pCx2a0hfrmFT72Uk8W+Af1DlF:aYj5sEs+lcYEEUrH7pI2Z9rmFztxA95F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224980, "uuid": "437afe4a-ba4c-4930-a7e9-120260b25ddf", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224980, "uuid": "d1feedbf-6403-42cd-869c-d60b0ac1d80b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224980, "uuid": "ac96ed5c-65be-4fe7-a63a-276044a918c8", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2d44b6-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178821, "uuid": "11d5fc0e-dcf0-4839-ad1d-140c6defdef4", "comment": "Malware payload (CoinMiner)", "value": "aab18a57aed8136f596271b151d352af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178821, "uuid": "acb00f7e-a8e2-43df-abdb-8a2c5ce2cda3", "comment": "Malware payload (CoinMiner)", "value": "bcba4234552933d2a50fbf5878e2e4155d94f251aba99345d1d9108ea6c8a6bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178821, "uuid": "a7725bb0-f60c-4f4d-8cf6-385857c369e6", "comment": "Malware payload (CoinMiner)", "value": "98c7a3675f6623ddfcb81934ef3684a31ff79da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178821, "uuid": "3589e537-2a1a-4478-9fcf-49dfdbb3bf5b", "comment": "Malware payload (CoinMiner)", "value": "341a6ca1efb5817237e6ef5182390dad27b243f6ae2f2af9cf9d6fbd4860bc747085d3b3ed45f6d91b66d2041c7060ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178821, "uuid": "b0ff5446-4aa1-4fd3-8be4-3154adfc4922", "value": "T18F853350E9E083BEFB00CB917563B1725A66F978C2C4382490BB7687C32E65546E8FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178821, "uuid": "beac61ca-264b-4442-aecc-aaf51258ad96", "value": "49152:miFUBxy4Fk1bo9BhxBAnbf981MLSoIAnmu9nnth/u+G:mgu9BnWnTuYnIKpVv/uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178821, "uuid": "19de39d8-3a71-4961-8502-1c69fdf4791d", "value": 1793552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178821, "uuid": "fd387d9e-0e2e-4179-a1df-4fc89a5e53df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178821, "uuid": "080d9071-7735-41cc-b6c4-b50333fe5f50", "value": "bcba4234552933d2a50fbf5878e2e4155d94f251aba99345d1d9108ea6c8a6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c60c2a-810f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784203770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203770, "uuid": "0d549349-3647-40d3-a407-43a553aa3882", "comment": "Malware payload", "value": "85192ebf3258868b6a7bda79a773e642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203770, "uuid": "8e261bcf-a0dd-4d1f-81e8-6a058e80e277", "comment": "Malware payload", "value": "be1d32509ff99d6f2af4a727ea71e9aa9931a3d7dbd3e021661184cb7d94a74c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203770, "uuid": "893fddc6-bb00-4240-bbde-dfc70d3b7048", "comment": "Malware payload", "value": "5a90e56e79512323eb9b613fa7f192f37b6abf95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203770, "uuid": "07ca6572-ff5f-4738-a2c0-08a6050c526e", "comment": "Malware payload", "value": "594f8a35fef2bcd5de7f0e72023512b9fb5bd19154f482c2fe70ff10fbfadca42803c3c870f1d8267f1e769ca9378873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203770, "uuid": "b6551819-606d-4b88-ae65-0d0f9c1596dd", "value": "T1F3C71256E2BD00E8D57BC0B8C6574A17EBB1345513306BEB62A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203770, "uuid": "c60d4e80-e460-440a-baef-ab9ab97a9519", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203770, "uuid": "419297ca-58f3-4fb3-a903-69d7e0080f1c", "value": "1572864:BFMoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLia:BFMogVJnhVTMVEDjQKoFeLia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203770, "uuid": "f89764a3-9edb-4e0d-aea2-760fd14565e7", "value": 52791569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203770, "uuid": "5f731ed5-c242-4b18-8b7b-133d4cfc2eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203770, "uuid": "802179d7-6a32-4356-8296-d1dd6eb47371", "value": "be1d32509ff99d6f2af4a727ea71e9aa9931a3d7dbd3e021661184cb7d94a74c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1a02c3-80f3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784191922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191922, "uuid": "57860601-8c08-4217-b0c6-e4905110de76", "comment": "Malware payload (Efimer)", "value": "c5d16fdfbb374e81b6e17440550a2d8b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191922, "uuid": "76025fb5-f49b-4aa8-ba0b-56d34c226dcc", "comment": "Malware payload (Efimer)", "value": "be234a21cd001fb8b770a7938d8e456ff58aca9a891b1f3c6b5279a219eaaca9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191922, "uuid": "94c7bf1b-f7fc-4514-8540-189e526cf461", "comment": "Malware payload (Efimer)", "value": "a83f8c7c60068286c17663111eb19e710f88f09b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191922, "uuid": "0c9d016f-0168-4424-a28d-b9080cf5d64f", "comment": "Malware payload (Efimer)", "value": "d7cdf0acf5e5cc2e33654153dd973182488621b3230061d271ad0f0b8a842acd0ab5501fe9ae2b7fa174cfd19940036a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191922, "uuid": "8b923475-52f5-4b07-9bca-9d2387706714", "value": "T140E6334466C046FFF163C03DEDA5566AE66EB4B60772CAAB07A89342BC931C04D3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191922, "uuid": "100d6fe3-e3c0-4885-9e8d-3bccbf6b5933", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191922, "uuid": "84b976b0-f231-4b7d-957a-bce5b9a50694", "value": "393216:s65M5MP1UQWRnv+Mwta0xXMCHWUjXscuI3/PGTAI:s6eFwta0XMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784191922, "uuid": "e9f3f4b2-bfb0-48e0-a9c1-7cf78662811c", "value": 14300757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784191922, "uuid": "6906333a-a3d0-4131-bdb7-9728b1bc495d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191922, "uuid": "27d72113-d896-4fe4-9cb5-255c6e7b8ff4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06f1dbf-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1784185485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185485, "uuid": "8019ba58-8f05-4637-a222-a215c15dc387", "comment": "Malware payload (AveMariaRAT)", "value": "2d850835de9c0ef66b0c490f41bded2f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185485, "uuid": "1375d9a7-1efe-4c68-b5fd-b1a0ba806b8c", "comment": "Malware payload (AveMariaRAT)", "value": "bef4b9729fa816ccb0786d571de40b3f5f40b5940fe341ff21aacdae44152521", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185485, "uuid": "5f920f6c-174c-40ad-be79-bc1d709e3fb9", "comment": "Malware payload (AveMariaRAT)", "value": "bd0999df799ed8d14b4afeb80c5c34a4683b1234", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185485, "uuid": "93fa51d7-5505-4d48-b9ff-9c05b8a5194e", "comment": "Malware payload (AveMariaRAT)", "value": "0e0cfb000f1b46cc89a299f15e7e7890d518dbcf8eb658eca1bf2e6795aa2740ce3a1e56128de66bfd397433dac5a7b6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185485, "uuid": "146f21a6-b7fc-48d8-bea9-f3a62621fd7b", "value": "T1BB55E03223463CE4E3AB3A93F04A3E791C783B9B92D7503F65D74A8521DA1744DBA835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185485, "uuid": "ec77d374-beac-42a1-bc98-85a673bae51f", "value": "24576:zfYk9GzgmZS8NMsM9jPuuuF+sltyuW1/Jzm4B6J5Y+casIKDVs:zNGzgl8NZMM+sThB9/sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185485, "uuid": "63eb48f9-6269-4f50-a85c-852cc631092f", "value": 1295136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185485, "uuid": "e535731c-3d96-483c-8760-f44c96569c89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185485, "uuid": "f57b26d3-2815-4492-8e8e-2cea3dfbb999", "value": "ORDER-2789-456PF.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f8fec1-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239910, "uuid": "012c3bbd-72ca-4e8d-a39f-65157ae407b4", "comment": "Malware payload (Mirai)", "value": "e572dacfb9961e6d0cb11ec723a3be06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239910, "uuid": "17cf5586-2ba4-4b0d-a058-35b34ff357e2", "comment": "Malware payload (Mirai)", "value": "bf74031ee6a38dbb5dce1c9c74865d88076ad8f2537fd8ddc481c829e3e40981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239910, "uuid": "972aed91-255c-4914-ac22-282535948468", "comment": "Malware payload (Mirai)", "value": "2c296cb9a2f9196911340773a459f7a7ac6fbcb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239910, "uuid": "acc034af-399d-404a-bf3e-4c715ba78898", "comment": "Malware payload (Mirai)", "value": "ec14fcaec643643df05c112be19795a637502de2bd36233ee4c692ce7945e8945ebcb1ed94fc201667471aca36cbfe80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239910, "uuid": "e38304a1-3e45-4178-8690-e8df29724f04", "value": "T197835B95E783E8F1DC4101F011A7E7327772D5690134EB8BE7689B77AC63712AA0A78C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239910, "uuid": "62c650ac-09b0-4446-abae-85c2f2150edf", "value": "1536:+TTjfAAm8OYbyrWi0ukNQn7nhKshH/hfjh85hPMhzo1VjLHrAPn:+vjfAAm8Puwa7we2hyz01LSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239910, "uuid": "a005792f-aadb-4e6e-b368-7ad8daf201d6", "value": 83792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239910, "uuid": "9a8ef52c-a27e-4167-ab56-bfc36c980181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239910, "uuid": "a95e0849-ad58-4204-b68e-7f2b40a4cf40", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea96aa5-813d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784223708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223708, "uuid": "6505bf78-d3d9-4c0e-87d6-e07305e93b51", "comment": "Malware payload (Mirai)", "value": "b46a8e81679a51329ea659e856807dfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223708, "uuid": "41784f90-2c94-4d9c-9c4b-ec854b6ca122", "comment": "Malware payload (Mirai)", "value": "c022f2238fb7f26564eba366c9beeff03f529eb71f845791753e9a215b6fe82b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223708, "uuid": "f13c2167-8ca3-49c8-a7e9-9b392dbceb59", "comment": "Malware payload (Mirai)", "value": "c430f9f771e9dedca61e3a7937e8a9a62251f8e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223708, "uuid": "0a0e9c33-75cc-463e-adc8-7872d6e9cd36", "comment": "Malware payload (Mirai)", "value": "6472d93a62aebcbea04b99aa469c8566accbb37caca9530952ea42328f604c7b97427bc3db65b5e7d38b78d1bc6d81e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223708, "uuid": "ca534a16-f42a-4380-b1c0-782b8a88b0d2", "value": "T1B7C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223708, "uuid": "73eaa745-18fd-4ef5-b29b-66169a56404d", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiypw:VoRNjmj1VGFVrRiy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784223708, "uuid": "d52628dd-c6c4-479b-9129-d1d44c65c4cf", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784223708, "uuid": "5b654a7f-604b-4e61-a6ef-d594c2206de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223708, "uuid": "3caa936f-f29c-4446-af87-f4de0065f646", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb0d2d-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784212791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212791, "uuid": "52b9100f-7156-41ad-b8d2-1abdd9e77fcc", "comment": "Malware payload (Gafgyt)", "value": "84f1ff822de6f546b23e57959770cc8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212791, "uuid": "6587f5ed-af5e-43e6-8923-c70125fac722", "comment": "Malware payload (Gafgyt)", "value": "c04df8579f5a2d5eb560b20f43e31d84eedc51e36103c1cba0fb04c6e1650b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212791, "uuid": "7990e97c-f995-4698-bcc4-c5353737d60c", "comment": "Malware payload (Gafgyt)", "value": "3c51ba7ec903c08ba83c1db68e577b0674dc63e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212791, "uuid": "bf5366e1-2ee1-4dd0-b6e9-7d631ba30cfd", "comment": "Malware payload (Gafgyt)", "value": "ff3eb549e878e19e376b423eaa16a0957cb12915a73ce6ee06b8902f3f174abeff0d0798cfb18eb0711fc8939446e226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212791, "uuid": "a1b6e6ac-a838-42d4-bea3-d33f6eeeaa85", "value": "T16FD31A04E551876BC2D2137AF79E465D37331BA493DB33215A34ABB82FC179D2E39821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212791, "uuid": "0bb0f175-74de-4406-875d-29208cb207d2", "value": "3072:Fv3H7bfua//cVkW8hG7fXPyh82GLgmFQwYvQX8T7:p3H7bmaXRmXPdLgmFQwYvG8T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212791, "uuid": "b47aac9a-1d93-49ba-8028-bbd9d88293e3", "value": 135625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212791, "uuid": "2b3c9e22-57ff-45a4-9271-729ea7885661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212791, "uuid": "512f763d-1e37-488f-86f8-00b4bdca5b85", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2aca61e-816f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784245323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245323, "uuid": "28c9cc98-070c-4822-ba74-7810b6d81694", "comment": "Malware payload", "value": "6171e00d15bf7abeb413ec1586c3c7ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245323, "uuid": "2d446d42-4541-442c-b3b5-b7f4a479765f", "comment": "Malware payload", "value": "c0605974f0c0efecb1cb7426588b72762746574b331781c5e29d9c599bc8ac2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245323, "uuid": "145e7ad8-fafb-4333-b856-5f604ff6cca9", "comment": "Malware payload", "value": "c7510a8146cb277530f6d9af301199f9e17ca9aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784245323, "uuid": "cda94b53-8428-454e-bd5d-af1933857fcb", "comment": "Malware payload", "value": "167ec65a3a11dace4a8419d0868418f1672edc3367e4a451ceffbd8edbe0a89ad8b08c05cfc3c1d3d4146a8a24e0ccfc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245323, "uuid": "ae29cf66-1a6c-4a22-b22d-56502aac31ff", "value": "T1FD236D6616857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245323, "uuid": "1ed2e6bd-7c87-478d-813b-50371643068f", "value": "768:3XRWNGxVB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Rlxocr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784245323, "uuid": "767243c6-d720-46a8-a297-7e13795ca41a", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784245323, "uuid": "356e9ec3-3639-4185-824a-4603e2574883", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784245323, "uuid": "ca3914d3-bcfa-43fa-a462-3a7ee69648c5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a2a7a4-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784212787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212787, "uuid": "838871c1-d2dd-4ee1-aad2-edf4e71f3a70", "comment": "Malware payload (Mirai)", "value": "9b78f6ca62657810de229ebff20ed14c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212787, "uuid": "e61a8dc4-8220-4a1c-98bd-8a1ca8ae01e8", "comment": "Malware payload (Mirai)", "value": "c0e8f81d6a5ccb2c249478bbdab22f0cd812b8fbbc46a6b14a1b43da5d8e82d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212787, "uuid": "8270e3c6-34b5-4b43-91de-1d3dc0670f10", "comment": "Malware payload (Mirai)", "value": "4ab808d7fb9ea3dafe9f080131694ba28923429d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212787, "uuid": "b450b08d-138e-48b7-82b7-4ee89aac2c1a", "comment": "Malware payload (Mirai)", "value": "12204388d7338f9dbaaab5e21cf6e617d0e33768f2edc5ab81d73d9f4c43cb44bc39b31aca9f861c68da79329d60ea54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212787, "uuid": "7bc24c34-3c38-472c-b929-328ff129ac95", "value": "T18C735B22BA751D2BC4D4A87A22F30725F2F2479B25AC8A1A7D710D8DBF31A5032477F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212787, "uuid": "3963fac9-fa06-4407-9059-d2c410269bf0", "value": "1536:mQMSZZm4fVFd9BPzpJoHQ7jtEeCNM5UeWzQSkWtgWG:DpzHzXjmpN8UeIjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212787, "uuid": "4cf1184f-8369-4b8a-a114-d3965094a4eb", "value": 76448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212787, "uuid": "6544d0e5-f778-4f84-a2ee-308cf57041a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212787, "uuid": "35ff8695-4a1a-4d0e-aa1e-2e230577b937", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72540bf6-80ad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784161786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161786, "uuid": "d1adff5a-d00d-4fd1-9c27-338ab2323a40", "comment": "Malware payload (Mirai)", "value": "48d6f7d6f94e437cd8b6c98870ef8c87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161786, "uuid": "4ca85bd5-e971-432e-b2ad-38b86f7dd909", "comment": "Malware payload (Mirai)", "value": "c19a9ccea95a758dccbd692cbd469e9a2d373fe6e63cbf4009d8c76fd073e288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161786, "uuid": "04660d3f-ec54-443b-8a8e-56e93ac1f6b1", "comment": "Malware payload (Mirai)", "value": "a9547efe5e9a7e2b9a0b6d08bef7e0a6358b187d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161786, "uuid": "840d98b4-e936-4147-9c18-75de96e6e2ce", "comment": "Malware payload (Mirai)", "value": "8d92d1af4c6df22faa1e8c0092d0706a74812d1f3d84950e8dd18a89ed03e113cc0594332c559aa422bddbe1f6df9610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161786, "uuid": "d2537a71-9f8f-418b-87a9-c5e16e272a07", "value": "T119147E01BF181953D1931DB45B3F0766D379D88318B8F109190BBB961733EB7AA87B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161786, "uuid": "78f3cd13-422f-4d81-9077-fb7846943cac", "value": "3072:t/njlJBseKbpY0EUoGIy4yS010AEvQH/JGaRp1DrojG9uJ:t/njtse6Y0EUtI/F5AEvQH/JGOvQIuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784161786, "uuid": "9c722a3e-021e-4e1f-93e3-76a869e60992", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784161786, "uuid": "a5bafcc2-3c1b-41ff-85b2-1ad12eb16b49", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161786, "uuid": "1acada8e-ebfd-4fe7-89fc-f1d2b8d4b350", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dcab8b-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784185335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185335, "uuid": "ad537183-2781-4950-8979-b304fca7cf70", "comment": "Malware payload", "value": "37ca2bb7ab00f9c6e3b2fdd6bd32cf7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185335, "uuid": "24097830-5e5e-4f76-8996-b572e0362a39", "comment": "Malware payload", "value": "c1c07beb5462f3294e0072c56f98c58919b02f4dfbc795212c441c24b7a0f588", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185335, "uuid": "8804b052-7dd5-42e9-a245-4e1c45b8d2a6", "comment": "Malware payload", "value": "f94a1123c6faca1b2a9d69a652a15c42199792cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185335, "uuid": "3ea7efbe-e81a-4c56-abd1-3b5314a02807", "comment": "Malware payload", "value": "d9c08707d5d864ea3864b4e42f261c1a4aea6e5ef1bd548e8c93e1a51d35c2b664bf9b6f2ad8c734673c597366b289a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185335, "uuid": "31f15dc8-0500-4a8a-8752-100048e65554", "value": "T14EA57BD649873C46A000F726EC3673CBED545C563BD16A5C64AE9FBBCC5D0E88B18CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185335, "uuid": "51e7db6e-46e0-4241-9f3d-aa30b779f383", "value": "96:Dyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyn:44gJPhtKmVoWvpiVrE4EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185335, "uuid": "7e91c8ef-7657-4de0-9a94-19e720ab3fd8", "value": 2104705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185335, "uuid": "6361afa6-15c9-4145-863d-6c920f438a3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185335, "uuid": "ad08d35b-85ff-4d86-af1c-b930e97de726", "value": "pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be6d0ce-814b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784229635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229635, "uuid": "661d92a6-ffef-4c60-a125-23a91fd78847", "comment": "Malware payload", "value": "080d486acd3b828fc4cf491979976984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229635, "uuid": "15d57bd1-34e5-4cd7-a59a-3b2f25673d2b", "comment": "Malware payload", "value": "c31561aeea1dd25f63cc38d0ab9663847479536a3138244e8740c8f889e18c07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229635, "uuid": "7c98246c-9fe9-48be-b48f-28a7bb20c5b1", "comment": "Malware payload", "value": "19bae28da9eecce75281de5f669ba008289c724b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784229635, "uuid": "bc5d3c2f-e127-458c-96e4-0e29d18c564d", "comment": "Malware payload", "value": "7c8b415c43c4912987971856994cd781c2cfc37206524c5d90dd8c761cc5ce23a3b66542d792cb6258d26c564fd1a784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784229635, "uuid": "179fd633-01f9-4b95-af24-8b76aa4a23bb", "value": "T1A593C71B6E219FACF2A9823487F74B34AB9863D137D1C684D1ACD5002E7034E695F7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784229635, "uuid": "4d209ada-12e6-4c3f-bfa7-e463d318d479", "value": "1536:LI8oCBcLg8Mtat0IScV109UuDlFdsoP9jy46wJGz46kNWMtzkAGq:88sMtat0IS6109UuN9+6JZjZSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784229635, "uuid": "453da364-42ed-490b-8937-e62be53247ab", "value": 89620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784229635, "uuid": "b29296d2-fdb8-4c52-8664-7ed9cddc9157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784229635, "uuid": "da231e69-59a6-43d9-9a78-b15303ad4140", "value": "2Kdi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5b5e29-80f0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784190448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784190448, "uuid": "f861b257-f70b-4b6b-ba40-ed041171458a", "comment": "Malware payload", "value": "7fdc43fc806bdda5100f42ed8a692236", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784190448, "uuid": "a51deb5f-305d-4f2e-a576-8003f7ade82e", "comment": "Malware payload", "value": "c32de4ccec904d88014fd2228b653c7abb458a033244f3e0424c5420eccf5937", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784190448, "uuid": "1e1a32af-edfc-4247-a625-6a15ff8fa11f", "comment": "Malware payload", "value": "4526f9eb90dbee731ebc9e56a365768d62851499", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784190448, "uuid": "f4b6a49e-2a2f-4e05-8c2c-696ff1fc5a16", "comment": "Malware payload", "value": "d61c2b669b86a3de790e0a7e04c943b87cff349e70915379dffe98e44771be71764606db68f2e627b7c502b9529e2115", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784190448, "uuid": "ae48e688-6493-44a8-9674-5731f644646d", "value": "T1CE237D552A857C14AA98C4371D7E2F0CB9AD43E6320452EDBFCF3CF68C4A69DA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784190448, "uuid": "87c371c3-444a-4d97-aaf4-1143ef29a822", "value": "768:TXOGVvu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:TLzcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784190448, "uuid": "45bd81e2-38e8-4521-88d5-5a17afd5ee28", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784190448, "uuid": "1ce09046-728b-42f2-9077-59be6170ed71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784190448, "uuid": "4e81e35b-8f96-4c85-bf54-cfc696298f61", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86917539-8141-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225385, "uuid": "92405e31-2715-4b47-b1a5-4b293c83d9f6", "comment": "Malware payload (Mirai)", "value": "addd1188387700b7d9ff150e5117b724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225385, "uuid": "131d6d64-b343-4c99-a0c2-6e74add8cb47", "comment": "Malware payload (Mirai)", "value": "c39c2521caaf52e422e7884a380522f45e9e2571cd7ff6648fd94f81f7cbcd35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225385, "uuid": "b3d616b6-6116-4612-b7a6-c3ba16498b74", "comment": "Malware payload (Mirai)", "value": "28676fcbd3300e4b86d1fa857e4ea1898eacf8e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225385, "uuid": "de35bb09-8811-4038-b796-bbe4c84f0459", "comment": "Malware payload (Mirai)", "value": "5af903b90007af7ced25dcdac3e002b9f11459d79eb5fabc26da94744b98c7a975b13c90ce015ca5e5086b4e815be94e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225385, "uuid": "35d61db6-fc8f-48b9-b9ef-65137786ba7f", "value": "T19B631283FFDC9BACE8DA17FC07AA25CF13529435507241A41DE69CC9816FEB1219A8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225385, "uuid": "ac4dbb20-5dae-44e8-a84c-065432a186b5", "value": "1536:Ja7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgWVNRqrPC:47Mbp2L+Xqdfoz2sPNRqrPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225385, "uuid": "99f03ddf-b4f5-4657-9690-2bfa9b1f1895", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225385, "uuid": "d7f29170-6c93-4eba-ab5e-cf475085f02f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225385, "uuid": "a8956c8a-ae78-4818-b571-a691d65895d9", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e4d3dd-80c1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784170549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170549, "uuid": "e077b322-05bb-4a82-bd83-d365053ca283", "comment": "Malware payload", "value": "a28bdd6231ec973de56116e4c50d8af7", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170549, "uuid": "9387f733-43bc-4306-87d3-d604abd2890f", "comment": "Malware payload", "value": "c3c9b9054a3bab92bbd7a0a64ad0b3dccb1908fc9d16cc4e491b1397d8e49ae6", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170549, "uuid": "b2a813ed-1f0c-4a97-848f-6da0494519bf", "comment": "Malware payload", "value": "1ac3bb7cb431aabe284cd3ab15d3b23cbff50ae7", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170549, "uuid": "ff9547b5-941e-4bc0-86b1-fc7d417128a6", "comment": "Malware payload", "value": "a118c2434b44646d4f541627b80c5807d500e883386bac5b1439c551fb78a9f89b34ca143ebe8fceff6b7d0feb62e2e8", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170549, "uuid": "8c0aec69-aad7-4bf3-8970-ba2304ad61ce", "value": "T11795128FEAA612F9C83D51B454218212BF94BD024F50CEDB6A687DBA1C739EC2F35705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170549, "uuid": "5b87b58d-b474-4110-abad-393119e44c1a", "value": "5a08440e22a99b9fda864d620400de65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170549, "uuid": "957e53f9-6b7e-4f20-a8a9-c2d78d2e2227", "value": "49152:adQSiNxeK5/93iiY7ZqK+QeWu9JKD7xuCgO:aQNxek/9yUKOWu9JKD7gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784170549, "uuid": "c5198afc-db44-4a8e-9ece-fd8539080358", "value": 2052608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784170549, "uuid": "5af27f06-659e-4cbb-b222-08f97e6496f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170549, "uuid": "03daa046-abbe-4d80-8234-66686fb62369", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18256546-80b4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784164641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164641, "uuid": "f064eeb5-60df-4f1b-af96-ac552f9d33a6", "comment": "Malware payload", "value": "1b331848237ab89b94829952a78d23a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164641, "uuid": "44622563-2ef6-474a-8a33-8d3625be5785", "comment": "Malware payload", "value": "c47a9ca2fce589911fb281bd7d94c53d2697581994031ddd6d62a01a354dcc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164641, "uuid": "55337db8-3661-4b0d-809f-1edd5e4d5aba", "comment": "Malware payload", "value": "004600b7d9089142784edd3bd90caf8e81cb3089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784164641, "uuid": "7fc83cb6-2324-4e83-8b9f-5eb3c4899e78", "comment": "Malware payload", "value": "027086d6cf168ceb5062f3a764f5e63d23cf19d8a77ee97a0fde6139d273ade20595504dc000ddf1867a378725c00bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164641, "uuid": "2d111973-2598-41bd-9e87-7b3c8c186064", "value": "T172173399B79509EEE4DD123A83C1C22B67B334A24724E1CF1BE41D925E677E8DE35B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164641, "uuid": "f8261b42-23e9-41a8-af0c-9ca0623d7c3d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164641, "uuid": "7b54f788-470c-41ee-ae1a-c123dce2a4fe", "value": "393216:JXpW8QL5NLn1+TtIiFlCuARuAr7Yx4rTWdS9QV8ax6i8+41b00JhCoCbYkfXCIoo:bW8Q9xn1QtI0CuA7m4usM8ax624ZDCBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784164641, "uuid": "21f99139-7843-447e-898f-d173bdde5122", "value": 18974613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784164641, "uuid": "b756473f-d5a3-4eef-81d5-d8ca800d4bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784164641, "uuid": "892737e0-5de1-4718-a18b-828468e16f6c", "value": "gothgirls3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca9516c-8139-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784221879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221879, "uuid": "c64659be-49c6-4762-a5df-a3e2c7d989cf", "comment": "Malware payload", "value": "5d61d0030c943e77ce398bc0d86fceb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221879, "uuid": "e432ece1-8fd4-44b7-926e-1cdc49f41fb1", "comment": "Malware payload", "value": "c6443b07d46f07e2f41bc0314c9ddf6616862e71894a3dbea182dc53f9b655a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221879, "uuid": "4df2474c-e05f-4c42-9294-a79df2f828af", "comment": "Malware payload", "value": "959130c711c34d2123b3af71122f0939d8ac527c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784221879, "uuid": "f867ae41-6d02-4608-94e7-f6fee77f736b", "comment": "Malware payload", "value": "96fa980d69dd6635249fcb2f61d598842dfbb26d7c1817b32926d45a9217371c8c6fed0e8744685cd3e0bf110b9d1b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mytrfnuif-com", "colour": "#F8ABF0", "exportable": true, "hide_tag": false }, { "name": "NeedleStealer", "colour": "#E7FDF8", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221879, "uuid": "99c92725-a530-4b0d-b383-a92938bd2d93", "value": "T194D6230CE2A916E8E27685348BD37E32E7B1705A535DB9CB1B58F6113B239D06B3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221879, "uuid": "260f475e-896a-4ae9-850e-20b087931d51", "value": "c66389b0063ab50a73d65d53ea020d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221879, "uuid": "6ae38f4b-422d-47a7-90af-3922221f08c3", "value": "196608:SvARoYhAshkj6HmyxLC5pUQee4weqmAbhk:SvAqYhAsdHypUQX4wflk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784221879, "uuid": "2258a070-1438-4337-bf50-17592237e8d3", "value": 12645888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784221879, "uuid": "910af2bf-0f03-4ee9-8277-3dc4662d0b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784221879, "uuid": "2d057a47-1cd3-426a-9e75-4a19ad01c645", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0057ee-80eb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784188323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188323, "uuid": "c7c38a2c-0a6a-46e7-a7eb-b12713f677be", "comment": "Malware payload (Efimer)", "value": "b6368c3260085a19e58e9b74ba41b24c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188323, "uuid": "91e581f1-482d-4ec4-8b5b-ee939b4f836c", "comment": "Malware payload (Efimer)", "value": "c65504d546b414a45310ec3cf0728fddc601f788a53aa534bf02e76c54f3d321", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188323, "uuid": "088e456c-3aaf-4e54-8524-d7591a403d3d", "comment": "Malware payload (Efimer)", "value": "2b46322746993c23561e9d0d98bf5b2ffd70673a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784188323, "uuid": "664bde01-9425-4007-a22e-7399db3b53b6", "comment": "Malware payload (Efimer)", "value": "e571aacf56200d2109ceb4ab3b4420cfe589303cf5d5b803f106850e15938f2037ce52b75872d4b3cfac494e17a6cb9a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188323, "uuid": "c5d63b77-26e7-400e-8bb4-6c33d1c57f54", "value": "T1ABE63328A7C801FEE5B7913CDAD20A65F968B8B147B4CBDF07E04366AC632940D79717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188323, "uuid": "463f04a8-29c0-4225-a09f-728dd9f62916", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188323, "uuid": "c968350c-be47-4bce-84ba-513399c18f64", "value": "393216:1HAP64LrikT3Q6igLWXMCHWUjXqcuI3/PGTAI:1gS4LrlTKXMb8XHH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784188323, "uuid": "521677ae-1954-42c5-b530-69ab39adf701", "value": 14278004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784188323, "uuid": "413bcf33-46c4-44a8-8998-a6519571d41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784188323, "uuid": "2e43ec38-d229-4996-8e24-0db7e8b641df", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a59cb2-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234598, "uuid": "5aad1f3d-8150-4886-a08e-6119ba48a406", "comment": "Malware payload (Mirai)", "value": "1f5c2580788c35a7c2efec4faee6487b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234598, "uuid": "6b02614f-1b52-470f-ab3b-c6470e69a4fc", "comment": "Malware payload (Mirai)", "value": "c697966246050da34197787a8fb958c8f93fac0fbfe9dbc9b0cda818498b5d1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234598, "uuid": "51c83b2a-3baa-4231-b468-f9428c91501a", "comment": "Malware payload (Mirai)", "value": "41168ae4f723bf37b449a0800695eb09b3f906dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234598, "uuid": "faf84dbe-c6d6-48a5-a6d7-6b54f7182248", "comment": "Malware payload (Mirai)", "value": "d9fee9f7fcac824b14dfea55da570124cc6d3b8d7d6af3b2517dc962e37d102228c75a16d38a5f74da1fc6d52a5cec88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234598, "uuid": "6f96538f-95a7-43d6-bdbe-6d5d27abed74", "value": "T12533F121CB1215A6C868D1F1C7ED0FDA2EA58AF8FEA3DC960D8D4D558F56025E8B32C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234598, "uuid": "e482d22e-342b-4c93-ba18-56cc73a90ffd", "value": "768:oTVJppYJxjeqNkQ1ocrnWXWJYi0xxrWuAOS0ztFeDlrUBbV3mJgGlzDpbuR1JY:CVe2jQ1ocrnWXnJrWuK0z7mlcbsVJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234598, "uuid": "3ca68382-151d-4755-8c5f-8c866b59db06", "value": 50520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234598, "uuid": "213cf54b-4adc-4d38-928a-a6b55861cca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234598, "uuid": "01786ec2-b26b-483b-8eb7-9ddf90dc4f1a", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cf6bb8-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246162, "uuid": "993d556f-fd4e-4683-8207-960ae3501953", "comment": "Malware payload (Mirai)", "value": "70eb1ab75d3139df06057b994c1f72e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246162, "uuid": "35678530-a8c3-445f-b264-65d9df34996d", "comment": "Malware payload (Mirai)", "value": "c714ddde7d41e33700ce64966ad0673edcd92d5643f133919c9cff8532ebfea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246162, "uuid": "7a48c375-6df6-4afc-9cb3-28b39e44fd0f", "comment": "Malware payload (Mirai)", "value": "ec1d23f089dbd7b497d69b28b9f1b0ab743198cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246162, "uuid": "fb14fbcf-fb76-4965-99c5-bc6bf08814dc", "comment": "Malware payload (Mirai)", "value": "df0247144fe1cd8749b81f5ba912084194db2d99b69a9d03e7582bcc68f1f99740d037de214c8b020efa8fcd01928fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246162, "uuid": "4e3426a3-c143-4340-83aa-c98e421b615b", "value": "T172B31851BC825612C6D612BBFA6E418E375623A8D3EF3213CD255F203BC791B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246162, "uuid": "e3b4c62a-f551-4894-bcac-464acf6ce2d5", "value": "1536:7jcuL8lzTm/NWSGmQAf3ilNUsdnS3qF4h7Fo1YW/avLKX4zZ5thK1rKcLl6DUtaG:7jcKamISANUsdnS3qWJnWALw4zZlfjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246162, "uuid": "34e63402-82d6-4d0b-adcc-51ebefccec22", "value": 112020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246162, "uuid": "9ff4c853-ad74-460a-a411-fca748c33ceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246162, "uuid": "41f5ac39-bd90-4ba4-8e15-293ff9b5c888", "value": "nerv.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7972347-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246164, "uuid": "2b1f1d67-2843-48c2-a618-34bdb825ca95", "comment": "Malware payload (Mirai)", "value": "43cc44494a6a1510b1f89aebd3494e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246164, "uuid": "aa3f805e-a078-40f5-ac2c-9b83c07de93c", "comment": "Malware payload (Mirai)", "value": "c995c35c2566d952e457350412fedbdce454a96c4690f06c68c730df7f7bc5c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246164, "uuid": "f619e9cf-b226-4a7f-9a6d-2f9b5b426bc5", "comment": "Malware payload (Mirai)", "value": "a1075441487d2c80b31f500e62a4493d242cdd7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246164, "uuid": "09c7582a-8c78-4a9b-86d8-91434bc320b7", "comment": "Malware payload (Mirai)", "value": "d4811790e2f13920ac45b97115e627d7a71a571bf8dcbb8a8e312c60683b9ec67ce4d57dd3f8c1400a3bb5f25a0a8c17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246164, "uuid": "cf75a52d-c90e-4ec0-abd9-bd6e49e7dd1c", "value": "T198B34D02731C0F47C5A75AB02E3F57E1A3FF999021F4BA89251E9B5692B1E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246164, "uuid": "8f6a37e3-aedc-4ad8-9bc4-3c1f95bcc36e", "value": "1536:bL8aGHx7rZazxJWsvNW/GHogtC4sr73+LzK9HqfYLObJqe4KwgmkyRwPIew5:bKKNvjoUsWCOb9djK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246164, "uuid": "1cfd56e0-e7a7-42b1-ab5f-0b622604258c", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246164, "uuid": "cd323f6f-aff4-4388-83b6-ad229ab8f9a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246164, "uuid": "f5e2a489-efb9-4eef-850b-c86433f30d4c", "value": "nerv.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b764429f-80b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1784163619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163619, "uuid": "24323686-2ec5-4ead-8db1-1b6dd7863210", "comment": "Malware payload (GuLoader)", "value": "fd419c013cadaa2100ada7f6f7dd34f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163619, "uuid": "78f0ceb0-9016-4b22-8f1a-2bcd3f70e646", "comment": "Malware payload (GuLoader)", "value": "cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163619, "uuid": "5e5e45de-7e06-404d-a6e9-1c7dee5debd2", "comment": "Malware payload (GuLoader)", "value": "fb7172c40bc110e63f5f3ecb15c5950b13590bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163619, "uuid": "664decb8-b24c-4189-9297-baf3770ec660", "comment": "Malware payload (GuLoader)", "value": "796086f51839d4ea07499755f766b74eba2d8deca563f78033fa7ea03e160a6a457ca970fd6cfeb825075752a5802c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163619, "uuid": "52cf0a78-0e4e-44b1-92c8-f47fb7c4983f", "value": "T1B694129662D4C523C7755E78F8A8C6DDABBCBE10E0B44BA753E0764EFC26E81450B321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163619, "uuid": "40f3aceb-0898-4d13-8a2f-c5cf3f56e6e5", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163619, "uuid": "ccb39ba5-bb48-467c-add1-b2b67ae51572", "value": "12288:FXuLq+uHdADtab75cdDMUxM9VGe/m/UD4K:FXuLqLKDtCdchR0G86UDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163619, "uuid": "1b71acf0-f7f9-4ef8-91f6-ab031e730bae", "value": 424160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163619, "uuid": "c5bca956-5477-466e-bc65-539c40e0c601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163619, "uuid": "32057636-1ee6-4364-8a02-d493bb69d812", "value": "rFACTURAJUNIO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2992419-80d2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784177838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177838, "uuid": "99b63e04-59f1-4b88-8c22-70a0d194ebf2", "comment": "Malware payload (Mirai)", "value": "80ec7d13ec1d497efd3db10451b191ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177838, "uuid": "a65855a7-ee6a-494f-aa97-28c7d39d7627", "comment": "Malware payload (Mirai)", "value": "cc284d76a9c408ce6509113296dba0b4c8db99178f564be2501e63dd8ec79efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177838, "uuid": "a8f97262-eb3c-43f0-b209-db3754d338bb", "comment": "Malware payload (Mirai)", "value": "ce75387b48b0d407598a0e1d84d20775aa1e0faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177838, "uuid": "599b19c1-342a-442f-87f6-865a42f080ea", "comment": "Malware payload (Mirai)", "value": "2c78ea157808282ed084d276b5a3c7c8d42bbf1834ebedd8bd344ee40b556e064c576a16d107f9e29bc97724da27ad53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177838, "uuid": "feb1f848-b34d-4205-8082-3985cdac3fd1", "value": "T19DB3E085B210AA55C02672FCB187099093B17E7B4B9A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177838, "uuid": "af4ed1e8-40c9-4f91-b164-44a4904e35ca", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuS:as5zqhr5Nzy7wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784177838, "uuid": "a8e558eb-95b2-45a6-82a4-df6946b14797", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784177838, "uuid": "1ee1dd62-daf6-4bb4-b331-29d35d78db9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177838, "uuid": "b949cb45-c852-4f3c-937e-617fb0a5371c", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5002854d-80c1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784170318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170318, "uuid": "73c2af4e-6582-40fc-91e0-4e3cd5c21214", "comment": "Malware payload (Efimer)", "value": "bf80db264e8032d72128528b07648d4e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170318, "uuid": "76030352-4ee6-4a6d-804f-a1081a5d9fc6", "comment": "Malware payload (Efimer)", "value": "cdecd2bc19737113c5c2fa88f9a160127e5dcded32ca07067917cbd138f9a7bf", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170318, "uuid": "ee2fac5b-d5b5-4a14-895b-61f3a1b363bb", "comment": "Malware payload (Efimer)", "value": "c6b074393a28a70eaad69eef8ae8cd7f085e415d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784170318, "uuid": "3ae6af46-127e-42dd-b19f-cb49f126edaf", "comment": "Malware payload (Efimer)", "value": "59dd735e48fd9f0a0eaa93b0b5d7bbf5064668b9b356aa667ae453f493407244de36aacd9c17035dd4c91908db973da8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170318, "uuid": "80d77ed6-4254-47a4-a4e5-59dc5d367d19", "value": "T157E6335C65E403FDF6B7543CE9B202A0E56AB46247B1C9EF076887F2ADA32D0583D613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170318, "uuid": "415fa910-00dd-4ed3-a7bc-bf9be1a63ea4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170318, "uuid": "63617470-8fdd-478a-8552-fae918083c83", "value": "393216:IMZkz/u6DoVvDrsZ5t6F3GXMCHWUjXAcuI3/PGTAI:IWCDoV3w6FWXMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784170318, "uuid": "d576767b-a49c-4b3a-abf9-6e5b859950ab", "value": 14298320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784170318, "uuid": "8c460cb8-dc71-4ebc-85a3-fb72fd90ec52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784170318, "uuid": "29ced8de-745f-47bf-8628-df4e01dc8b9e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571128c7-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239908, "uuid": "25d04b81-a00e-4ea4-b0bb-3168361e237c", "comment": "Malware payload (Mirai)", "value": "f10df49cf2cbeb0c05221307bd59254b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239908, "uuid": "a46285d1-f2c0-4bb1-a268-4a9e0aac800f", "comment": "Malware payload (Mirai)", "value": "ce40627f18e5b2154eb42b16cc500bf97cf389d125b5764ab5f6ebc1e24e6126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239908, "uuid": "70e9ad4d-34c9-4778-9601-428e2c4caca0", "comment": "Malware payload (Mirai)", "value": "ad17cb285ed3efce98eeed59ec83bebac8a214a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239908, "uuid": "3af08c61-e907-4d30-923c-0b0894d56eb4", "comment": "Malware payload (Mirai)", "value": "12479078f5720122575cb7fa1174d5d40bd4861a979311117015d66a939a6f4a52e3e7de7b7ae0869062e3603c17410f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239908, "uuid": "50a4d408-a156-449f-8f4a-e17d8ad0d038", "value": "T1AAB37C697E4F3C82E3C7C37DDE225AB0321FB4B9871592B52F12425ED4DEE9A98D0442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239908, "uuid": "044ec326-7988-4b3d-9de8-59449f1ff847", "value": "1536:6Qd9nepnO6tu5tEm0z0tX39zicIPtsEWgEBihgpBIWdfkN3p:L9e1m3hicI1sEWgEBOyfa3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239908, "uuid": "425b750d-2e7f-454c-8e5a-3128eea360e9", "value": 108616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239908, "uuid": "ddf4db94-0513-4294-b157-4a11f87e7496", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239908, "uuid": "2ce99c11-5af9-452f-971a-b6cee3c79188", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c292031-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178901, "uuid": "9d2b48cf-99d5-40fd-b569-abe14e14b756", "comment": "Malware payload (CoinMiner)", "value": "e9d3958683dfdcd4638970b00627a002", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178901, "uuid": "c35dc4b7-912b-4260-badd-0627caaa1901", "comment": "Malware payload (CoinMiner)", "value": "ce4b41b1cba3c019ee40821970246f4779808a44a8d9651dd2b57a9f5eb0719a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178901, "uuid": "e371815b-da22-4ff8-a7d7-02300fa1623b", "comment": "Malware payload (CoinMiner)", "value": "133b7eb9a46ec672d72560d2c7d96d5fa067ed31", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178901, "uuid": "afda793d-f6ba-4b50-ad1f-a85ba988b39e", "comment": "Malware payload (CoinMiner)", "value": "c89c25cdc28c26496e95f45c01ec5f56e3c3a36d8c21205d79ebbc4a7dd6f570fc9fd5fa078691d83bf165373cd67868", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178901, "uuid": "1438ac59-99bc-4c7a-b298-6552c3d5bcd2", "value": "T1C6365D4BF1A360FCC1ABC434475F9963B931786901217DBB66D4EA302A33F605B69F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178901, "uuid": "d28d4536-4b1d-46a5-9baf-ccdd1faaca24", "value": "98304:uvF4aatsYSUv5p8dHaZhC93Hzr4LDp/Css7SZHxBKltDiyfAIKvKel/YmA7JF+z4:uV+hBCp8xBMMVYHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178901, "uuid": "9ccb3ee5-4664-4907-92a1-827717b971be", "value": 5056528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178901, "uuid": "d633c3dc-82b3-4e86-934b-5a42c93a88ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178901, "uuid": "7757477a-3228-4a4b-9413-4a940890c92b", "value": "b4d780466f9deb04216b42d6cef6cdf5efb0dc6914fa1b543f4d64ae0326d7a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358dbed9-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784212794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212794, "uuid": "8b440e14-aae9-4f5a-9870-6d9bb313c68f", "comment": "Malware payload (Gafgyt)", "value": "477ccfda1a2b7461a72a66d0ca6bed03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212794, "uuid": "6a37904e-60a6-4f6c-9b26-98a0a80670d9", "comment": "Malware payload (Gafgyt)", "value": "ce9898ee2445129927a045a4a8fd8bc2d73a068c221e3ca4cbf56d0b67911b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212794, "uuid": "fd5946e5-5dad-43d8-8d21-248a180d02c2", "comment": "Malware payload (Gafgyt)", "value": "ca1c67a7339b30a7235faafd55f2957b0c97bcf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212794, "uuid": "1e1daa3b-7349-4ec4-a09d-80ecb1ab8172", "comment": "Malware payload (Gafgyt)", "value": "c9ae1390ec0c16df9adef3cd9f9a63afd530e5a5c7bbce17159ad942355635565041284a8cea1597b3af06cd22fa2c01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212794, "uuid": "b31e4a6e-6607-4af6-8bd1-9b544f24e92c", "value": "T10FA32927F242C6BFC08752B52BDB99A19473B8F81B32721B73D47DB52B168C92D19B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212794, "uuid": "f1b4dba3-4a83-48da-87b2-0a25782d1cae", "value": "3072:0t9+V3oPXrtxswdkMjhMnficLwEhaOflUmrxppXFZYZrgo:4PXRXkM2fxta7mrxppXFZYZrgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212794, "uuid": "5cee3818-18c4-4800-8d4e-9c199c038be3", "value": 106700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212794, "uuid": "834e854d-e25e-4004-a2b5-ffd093f7c304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212794, "uuid": "42350aee-3bb2-4119-85ba-b9622d1dde00", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfae787-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784239918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239918, "uuid": "9567e050-61d7-4fb1-8b79-210d7175fb1b", "comment": "Malware payload", "value": "87076d81ce4cf658c130bf35efda046d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239918, "uuid": "73bf160d-aee4-4829-9900-728dbd010c91", "comment": "Malware payload", "value": "ceaac96b6574b9d38ef11c725d20037178e9ffaab3133f310e4e9fe1178690d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239918, "uuid": "a18f01ee-57ce-46eb-8424-d99a3acac76b", "comment": "Malware payload", "value": "7390f18c9c2365af4487f01fcd07bc1477988167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239918, "uuid": "ae53e180-4831-4bf0-bd25-2da9846ac593", "comment": "Malware payload", "value": "a5b231e17ee833870934d7519174ede0f6593cd16d959918490c42e76b270e89c16c36e83fcb6d8782acedb92e7a7582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239918, "uuid": "354b0bf5-7de1-477b-bb8c-16f5503ea3c1", "value": "T181934A07B58588FCC48AC2744A2FA936E131F45E13356A6B3BD4FF226F5AB10263DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239918, "uuid": "c796cf64-c102-45a0-8dc0-0467c2270853", "value": "1536:alUuunl/Q5Z7tTU9pq4dQkM8t5eCE1gF8ynQeU6wU7wHMKZs2J1GM9yz+IvTYCdg:alUuunQt94lM8t5eCE1gF8ynQeU6wU7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239918, "uuid": "7ca0af3d-04e4-4134-b8b6-5a9055c03215", "value": 90432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239918, "uuid": "a150c966-5f60-4a14-b92f-bf1fd5e43f8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239918, "uuid": "46f2b490-4dfb-4b39-a34d-56e75c8c12d2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba9fc16-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208429, "uuid": "57e38f5f-8aff-40fb-b68a-b935310d8435", "comment": "Malware payload (VeilStealer)", "value": "d9feae1e5ae84dcac52c558db0067b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208429, "uuid": "c25b98c0-5610-4e2c-a6a7-540368374dd9", "comment": "Malware payload (VeilStealer)", "value": "cf07f33f8727b3dc4b1d956b2a5e24a487470a8d74d2558c37249eca53976ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208429, "uuid": "f9fe911b-4d23-456f-bb8c-c5237151f99f", "comment": "Malware payload (VeilStealer)", "value": "7393adf5ea3d9d9629d8598e1e86d3b57754bddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208429, "uuid": "34f8de0f-3986-4eff-958a-dce7966df6bd", "comment": "Malware payload (VeilStealer)", "value": "bd3c1da3bd612e2a942c39e5b0347c81cf7502eeb503efedb83aaeb30378da234c56ad380866407b618e5b9754fe28a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208429, "uuid": "a24087f3-e98b-4105-a8c2-b3d9aa699b90", "value": "T184D65B87EDA605E8C1AED576C62691237B703C894B3163D36B50FA242F37BD06EB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208429, "uuid": "736511a7-8b6f-4bcf-83bd-e0e15217b046", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208429, "uuid": "853cd1e8-e458-4a88-98c2-c8406d5f255f", "value": "98304:uHHwSZAk9hQ4vudEVFlHYA4dzKDUpGu2zGgGvjicWHE:IXuk9W4mdEVAA472z99k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208429, "uuid": "42f9d1fb-bcb8-4504-9937-0c9f2a6f6b25", "value": 13826560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208429, "uuid": "9f7117ec-acbd-48d0-bc01-f3a60e9c3f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208429, "uuid": "1fbb4467-6132-4de0-ba8e-cd04c970ad6a", "value": "cf07f33f8727b3dc4b1d956b2a5e24a487470a8d74d2558c37249eca53976ba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed41a1f-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1784185509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185509, "uuid": "e9abe4da-eeff-4bf2-9bfe-2615cb190e17", "comment": "Malware payload (LxBaseRAT)", "value": "103d0a10227e7d97977d9bdab1a8fca4", "object_relation": "md5", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185509, "uuid": "e26ef8c5-8e73-4615-9ab3-7dab24d758c6", "comment": "Malware payload (LxBaseRAT)", "value": "cfdc3020b0b705fe04a7212c704f866971ee06636ee94e0d4a32228ad06c99cd", "object_relation": "sha256", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185509, "uuid": "dc97972c-7fda-4b77-a0c6-3888b86f41b2", "comment": "Malware payload (LxBaseRAT)", "value": "b579e90afcba40febf57680e016d0f7f511e9fff", "object_relation": "sha1", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185509, "uuid": "4b9a2b40-906a-4c06-b699-f2cc7d7ea705", "comment": "Malware payload (LxBaseRAT)", "value": "66d785a7dd15aba602c6456de599716af36ae1483b0ea17c458338c7cf3653f24ed702f2a8243f0740b8cebc08964a38", "object_relation": "sha3-384", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185509, "uuid": "06301c22-a577-4281-905b-55a5db8713b6", "value": "T18885AE433DBC260A5BA81E8C0B8681B2FFDC65DA1435F1A0DB185B6251B6F07B906F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185509, "uuid": "d7220dfa-30cf-4ce1-bc1e-e05f2d90e0e5", "value": "24576:sUCUeuOEreHQzLIT5ZZBjSbMMNHvcVByQB25gQJDSV5o5TTIYsxniPER4e:XLepDZEu9RQldvKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185509, "uuid": "829abe74-26e4-4f05-9015-e0e1bfde94c8", "value": 1749335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185509, "uuid": "116c422e-1c5c-4ab8-ac58-cd265422b678", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185509, "uuid": "81e1d249-15ad-47ab-85f0-70e0d460b25d", "value": "Payment Slip - Ref #8922.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cb062f-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185353, "uuid": "24d796fb-9aa1-4819-ae2a-0b0090b392d2", "comment": "Malware payload (Formbook)", "value": "644ebb0410fe4a2bd9d3f7ba1a1aee8d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185353, "uuid": "1cc0e3d8-7646-4c27-bf73-033bcac06a2e", "comment": "Malware payload (Formbook)", "value": "d05e6bf11bedbb889eacbc9af16df5fd2d1788e5f96df0a5aede934e7aa765e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185353, "uuid": "3afb9a08-d60d-40ff-8e2f-715cad0c0a00", "comment": "Malware payload (Formbook)", "value": "033ca4bcf35d3473d353f13cec03b7b1de7bae58", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185353, "uuid": "405ef14e-d852-4a16-9264-af530b33b5f9", "comment": "Malware payload (Formbook)", "value": "ca1ea8f23b74c5a1d87fb2e5019394d6ba4a27644546cec7c9d2a45b36874abc0f6b48d318c8b58e1d7b337806dc0650", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185353, "uuid": "ae281e0b-2717-47ae-861c-fcb6d3b60b17", "value": "T16EA5F1104F882FBECAAC1A15D07F1A6EF3E1468954A7BCCAEF637D456FAA70051131B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185353, "uuid": "4b9d1934-e462-4881-8c68-d72d82c76ccd", "value": "24576:gFL6Q/40Hj+Rz3xcJRIZE6JeSp80h3KfjIZiNuRHmKMeMIrrzxFwUDWYoboZBIFk:CL/ND+RzBy/0EAHBMcLDW3Y01N0SXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185353, "uuid": "0807f578-35ec-4d22-bf1a-1d21558fc8ca", "value": 2147762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185353, "uuid": "91bbf10c-913c-47d7-af6b-db61dd9986ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185353, "uuid": "e43703fe-af93-45d4-84dc-7633760020e9", "value": "Quotation Provision Sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6685ef2-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234592, "uuid": "343f7369-0abb-46e7-9520-42f877766be1", "comment": "Malware payload (Mirai)", "value": "7a7cccd34fb230bfa5cb656ef6cc64ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234592, "uuid": "5a6c49d6-151d-4d30-b32b-2dea380f7b52", "comment": "Malware payload (Mirai)", "value": "d0d813f3d5bc9f5937e44736e13a688dcc7d7d990d7b341504d9b02b0eec4797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234592, "uuid": "ee649ac5-a4ec-4062-b070-e74a1ee3eeb3", "comment": "Malware payload (Mirai)", "value": "890a34a775ee7f5d7f3465083d134e46e0b7e506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234592, "uuid": "78f2149a-cfb7-42b2-a9d2-c601d7d0e76b", "comment": "Malware payload (Mirai)", "value": "48583a7f9830f49cbca7dba90c20486119cd330fb75d2b88fb830be9db57eda2d4f794851f8e736b9a3f1d32cd7ecac1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234592, "uuid": "73afaccd-72da-4c10-a2ba-46d1bbc6e244", "value": "T1A433F181DA1AFD72F9F904BDA8780992799A58F490EF70A73C3409312D43E596AFCD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234592, "uuid": "03b0a305-d372-47d6-8cab-d3a982b67a8f", "value": "1536:1LIC16hZRyIjMQqeG9NX823gMaju/kj6QLI:1LIC16p1ceWNjgMAugLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234592, "uuid": "3b65b3f6-d8f2-4399-afb9-1108ccf26144", "value": 51880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234592, "uuid": "e1638761-c0d1-42c7-b01c-6b1e9c2e57ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234592, "uuid": "3499d094-748c-4f8a-aeb5-7ed09e8e1d88", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf820c5f-8136-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784220783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220783, "uuid": "1b7637e7-d55f-4f04-8312-ba7c261d4ede", "comment": "Malware payload", "value": "9fa67eb24a1dff4e350f4610ad5e82e7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220783, "uuid": "5d644339-9be7-46dd-ab33-68db6551c88c", "comment": "Malware payload", "value": "d1f855f3cd4f89c16b42e83700e94391b0d105fa9ddcc5e8b222471ae5a89fb1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220783, "uuid": "9ee59e2d-8bae-437b-8427-a21cf1c4784b", "comment": "Malware payload", "value": "ff15f0188b1ab8bed1f3529b92834ef832ea3e6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220783, "uuid": "f4415464-b16b-4e11-a84b-86139186d10b", "comment": "Malware payload", "value": "3ec2d839143164e8ba6bf6596a05e8c565bbddcf7107595b1589cfe9c84463c64dea9d6a6d11c15952e9db729ab8105e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220783, "uuid": "9eeeca8f-7152-42a3-a611-8d9af8865718", "value": "T11366014AF749AA6BC4F3423609354A6216074CAA8F83DB937904732C5DBB9C45F4AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220783, "uuid": "33f9d995-e2d6-4fb7-8f43-8ec54f2519a5", "value": "98304:FHEVrF2KuNbHCgkfZ3WamNWr8hlloklvQxErk7wv+9MiCDVCt33D83qSVbDIiVeZ:1EVroNtiZmQYltvCED+9CDtUdXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220783, "uuid": "b8d67389-900f-4dc4-bc3c-40975e804faa", "value": 6750487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220783, "uuid": "59ae732d-ec66-4533-b9f8-ee316a12eb2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220783, "uuid": "4860c1fb-6b09-4208-b8f4-a3534e1dec43", "value": "io.falcon.desk.hub.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330cfac6-80f2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784191315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191315, "uuid": "035c1901-e54e-4f96-a035-d631c2a921d3", "comment": "Malware payload (PureLogsStealer)", "value": "98ed51e4a5c819bf8a7f2979c52b16ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191315, "uuid": "061fcc4b-b5f1-4421-b2bd-a1fb288a28c2", "comment": "Malware payload (PureLogsStealer)", "value": "d2338a127bed46401ea37a76e83166276b4f73cc1c171594b6383001a3e0cb4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191315, "uuid": "ce907ca4-a62e-4247-8905-eac576ee58f9", "comment": "Malware payload (PureLogsStealer)", "value": "80712e817812528ef2ad04959714e21f9f0ff1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784191315, "uuid": "c94ca44f-5b8b-4687-8bb7-a6a493ffed1a", "comment": "Malware payload (PureLogsStealer)", "value": "cd37a48134e193b32aaf302783916a016948927c8d1d5299e802781449cb7a75d158795634a5165c55a33242102bc5e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191315, "uuid": "505aa656-31df-4381-aab9-6e0cc278ad23", "value": "T19205BE3B72918E22C24A5373C5C7590087E6554776ABF70B318813D61E873EEEA4B2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191315, "uuid": "eab007a8-786e-4688-a6dd-066cd4cf4cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191315, "uuid": "02882c0f-2f77-47d2-b31d-1a4550b5b0fe", "value": "12288:Oqf9FO4jYkmD2B4T25t7DKGGgPUbAis/1wg6pxQy4ZGPk:LjekmD2X5t73MbAis/6DTQjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784191315, "uuid": "90891fb0-4f96-4ecf-be16-14b826ad455b", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784191315, "uuid": "1d9600d5-22f8-4042-b71f-55b685981139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784191315, "uuid": "382dd122-0f24-4446-82f4-73c918577d25", "value": "SecuriteInfo.com.Variant.MSILHeracles.264091.67178738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a8e0bf-8110-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784204479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204479, "uuid": "649373ed-55ad-49b5-abc7-18ab20143eed", "comment": "Malware payload", "value": "b2e98f0e67b3f3c31acdfe13939b2717", "object_relation": "md5", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204479, "uuid": "d8cf264a-74ea-4045-a45a-a346c09b8689", "comment": "Malware payload", "value": "d2b62eee5728ff226066619e52120810d010d149e7424eaabd15fbbaf7a64813", "object_relation": "sha256", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204479, "uuid": "d6e7d493-2b37-4efa-b65b-bf6acf4e9900", "comment": "Malware payload", "value": "34fb3147e9ad4d6e616a853512b840b6bbbd8b98", "object_relation": "sha1", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784204479, "uuid": "b8ec30cb-7145-45f0-b0ad-38ed8d7e9699", "comment": "Malware payload", "value": "cc0adbae415134115337fc11b94defc9c4cf5d6b61bc07280af3485fc2443ce8564da4380d0f3116f9299f6a51db54e2", "object_relation": "sha3-384", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204479, "uuid": "ad7121a0-d97e-47c6-8d34-101a12841497", "value": "T1EB768DFA7400C14F7A3A89FFFA9C1FD554849E1BD5CC9B4481A8D86DABFC10A26184DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204479, "uuid": "d409b2e2-57a0-4f51-8f9d-f8ffce3d1526", "value": "3072:jZk63hzYKAhEqqC0B8XrbEftngiHvIKy3m1TsSFruJY1H8vhtptmQRAZZndUT2AW:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784204479, "uuid": "f1c80e19-9b1c-47fc-9cb6-61881f73606c", "value": 7513571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784204479, "uuid": "4647e615-530a-48aa-81d0-94d1811441e6", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784204479, "uuid": "dba2cfba-9a6a-44a8-ab18-c7ada5e9aa11", "value": "Privacy Policy GridVision.msc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31cb1e5-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784185168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185168, "uuid": "5534dd7a-4bc2-4401-94d4-5a9e5b0dcc95", "comment": "Malware payload (Formbook)", "value": "3d5d57127992708abdcf252c49c2e367", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185168, "uuid": "54801d6e-103e-4fa6-a447-82e44f7bee8c", "comment": "Malware payload (Formbook)", "value": "d2eddef5ba0fdb55dc5422ccbee60d219dd23f56f22b446d9a65ac934c3ce2b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185168, "uuid": "076eb803-f7bf-41e5-a7a2-2e535bb69b11", "comment": "Malware payload (Formbook)", "value": "52e7bb286f38365cfa574f5011baf597c3c7cc40", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185168, "uuid": "d0974aa4-5b20-42eb-a42e-9dd98a8f3036", "comment": "Malware payload (Formbook)", "value": "14192df399c3c3ce5cf19142979fdc3e9b6ccc873c34ea04b62b2ad98db2773f000b6df745d8f31429e181ce872a5586", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185168, "uuid": "f9295348-04c7-4da5-9158-b203aab2970d", "value": "T11064654423D0B9D443C75B7BBA2FA9FDF56A6CC572844487E204F960F8B6206EDE1A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185168, "uuid": "a4fef101-c1d4-4a0f-9f0d-daafd0b5b7d7", "value": "6144:otND5R73E20zBbEIMnaxrbXnQUtEUyTsU66LHt1+cF6BO4YS+ObkgTpU+65roJPJ:k5A3uUNENP6+Ht1+o6BO9S+ObkgTpU+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185168, "uuid": "3024c702-9987-492a-adab-f50bb7878a7d", "value": 334526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185168, "uuid": "bbedbf34-0fdc-4d1b-a2e7-2eb0affa9399", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185168, "uuid": "8e6dccc5-32a4-4197-9d87-ca62f5b6ac2e", "value": "USD 184,724.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3096737-8119-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208387, "uuid": "3a6c53b9-6e40-46e0-b8fd-1e4f3deaf1c7", "comment": "Malware payload (VeilStealer)", "value": "615782d18cacda3c9433313572540237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208387, "uuid": "42f0c581-ed5f-441b-92c7-b73263511a38", "comment": "Malware payload (VeilStealer)", "value": "d302ba5778fac5bb12d82810958c2136d2b86c0267499075e4d947c97b4940a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208387, "uuid": "9e426115-c6d0-4306-bd6b-28efd29c708c", "comment": "Malware payload (VeilStealer)", "value": "fc2ded85e8118dd7904878d63c5f42f2a0ea9501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208387, "uuid": "52ac54a1-27d7-4a3c-9914-25fa7e9e1854", "comment": "Malware payload (VeilStealer)", "value": "3c45478515cdf455d1453acd38b2b898d447e193d27db63c54a9d8514c25267ebd0d104f292519942c031f3ff3c2fb27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208387, "uuid": "37b02dd3-cc23-4aba-a360-c4f2bad35b15", "value": "T1E6963807FDA919E9C0ADD13189B292137B717C494B2127D32BA0F7242F76BD0AEB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208387, "uuid": "912aa8f2-acd7-41d7-81a1-c80a033628f8", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208387, "uuid": "746ded2f-7f3b-4ca5-8bf9-4148e0dfc5cb", "value": "98304:nWBQFTDUs0YEq/ZKK6ovD+UflpfX3WW0EG:WCXUs0YiKZvD/dNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208387, "uuid": "6791de98-6222-410c-8e12-a074e8020f2c", "value": 9142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208387, "uuid": "56308873-5d10-45df-9465-51cd46ec6464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208387, "uuid": "c36c2e0e-7824-4ef9-bc31-ef495dee90ab", "value": "d302ba5778fac5bb12d82810958c2136d2b86c0267499075e4d947c97b4940a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4947c77-8142-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225999, "uuid": "98257b18-7fd3-4444-b9b5-04e1e7ad17b2", "comment": "Malware payload (Mirai)", "value": "01aad910b2ee8edf3a55cb58309d3b5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225999, "uuid": "cef08be3-97b6-4e43-952a-5ee1b8375d6d", "comment": "Malware payload (Mirai)", "value": "d30c75d307fd5f7b9678e74b3704dc2a5529d0ce84311cf4aeee87ecfee39174", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225999, "uuid": "62693c12-573a-44d7-b576-56f3031a0af3", "comment": "Malware payload (Mirai)", "value": "03f37b76b7f6efbf9853d017fab97472ae6a502a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225999, "uuid": "1112da53-565d-4237-b7c0-8e8e6ed075d9", "comment": "Malware payload (Mirai)", "value": "7def6a1f8ce22cdd27620af93ef753cc36e02206de43f16d6ed0bd2a081b5ee2aff3f29e0a09c6c14f314576f8406245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225999, "uuid": "2c928dd6-a76e-4351-9b93-7d05809445aa", "value": "T19AB32B89F841AB20C6D226BBFE5F014E33534BA8D3EA72129D245F7477CA95B0E37605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225999, "uuid": "851881b8-3bbe-48c9-b133-0f8f7ab64932", "value": "3072:xsQrDDN5qDiM22kUiMHLfT2JzP5waTzMkJKaDOSMcQHf3wR:xsY6DiM22527WaTzMkJKaCSQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225999, "uuid": "2d5552d4-4e67-415a-a8cf-a855dd1740c4", "value": 118128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225999, "uuid": "c5df7f70-ad26-44ee-b507-b83b8fd84f4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225999, "uuid": "57daf7b2-2c7d-45e0-8d56-796514b48c89", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39663898-810a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MeshAgent)", "timestamp": 1784201633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201633, "uuid": "fbe5be75-a0b5-41b6-9a7e-8df737fcd76a", "comment": "Malware payload (MeshAgent)", "value": "6eea0708eb348798610bf6324caba37c", "object_relation": "md5", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201633, "uuid": "50080eed-994b-4a14-9fb6-427adf3f883d", "comment": "Malware payload (MeshAgent)", "value": "d43c2eb968eaefcb8d5dc0574b562de391f5c5e025d118842bc7cc65f402909c", "object_relation": "sha256", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201633, "uuid": "c36466fe-b8be-49bb-aa39-92c89bd2481c", "comment": "Malware payload (MeshAgent)", "value": "97b8d970dfe25cc67e0ace71a5cbdf086d3b9bd8", "object_relation": "sha1", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201633, "uuid": "2c705931-2b2a-4f17-a98b-889b2537844b", "comment": "Malware payload (MeshAgent)", "value": "2328ba29022c02870ffaac88cc64be54101ed3fd4a7b0b7d1dc6f47aef6b73da2eba330b8b9f108aa75ae904c465d746", "object_relation": "sha3-384", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201633, "uuid": "01571844-0f66-4fae-9c46-6fd5cfd07644", "value": "T1C97633C0CCBB1793EF58D409E3B22A2A7F620D1516479D2D616E76362FE32E481276DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201633, "uuid": "737d4fff-ca0c-42bc-870e-d1123ecadf18", "value": "196608:5u11MftV2BNhzY01mQn1uJhAYBUxSVHjLkoM2HcaXhU:k1vThznL1urBB8on2EcaXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784201633, "uuid": "2463dad6-22ef-4840-bf2b-0ff703e44e4e", "value": 7528125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784201633, "uuid": "f4868a10-df41-4cb6-8002-14693a6dd215", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201633, "uuid": "82182c53-a508-4d5a-b635-d729ac04d0c6", "value": "Installer.55-98-2-28.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e90b4e-8137-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784220893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220893, "uuid": "04909768-9440-41a2-b1f9-e969baa6fe37", "comment": "Malware payload (Mirai)", "value": "0561552e7bec2a800b2ea68e58f885ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220893, "uuid": "6713527f-b53e-4c6f-ad63-b585be669502", "comment": "Malware payload (Mirai)", "value": "d566f2437e12fa4f460dbc8dabfa6faa6a1ba8f13395e333778a0de443140cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220893, "uuid": "552df92b-c64b-4d54-b0a3-f6c955cbd02e", "comment": "Malware payload (Mirai)", "value": "efacb4d69412551120833d76db99556393cf6c47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220893, "uuid": "99209390-e192-43a0-baf7-c93aedc75da5", "comment": "Malware payload (Mirai)", "value": "47523359582c5b8fd0fc0077d8c85e954751c1e2727155a48d86cec94ae9ad48297e0c27bfa5c63a573ccb5f678e9874", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220893, "uuid": "a4ec2400-e215-4d0b-af21-b05fafde907c", "value": "T17333F10C29851A97CAB91C37EA6D8180251EFFB4F1E7B2EB704195D8B6B314E36A52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220893, "uuid": "3647721f-e754-4cdf-a4b4-cdc6938e8f27", "value": "768:1J2K6szpHhmCQ99FUxrkN5bRcNvNGgRocE/LoC2msiOFOHGdLKmFYFCWKdos3U0W:1v6stBmf4k+PGgRLOJ2XtLv7Of5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220893, "uuid": "93f755f5-0107-41fa-95bb-6742e120b22b", "value": 53312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220893, "uuid": "5bc785fb-d7ed-42bf-8d2b-891835210eb9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220893, "uuid": "9c06f5fc-63dd-4fc0-9097-e1471cf9dadd", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21326ff2-8172-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246260, "uuid": "1d581562-b02b-45a9-b7d4-e71f818c4de8", "comment": "Malware payload (Mirai)", "value": "c17df48a5acebd237b924e51f8435d07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246260, "uuid": "f416060e-e691-4c3b-a6e2-f19db3737644", "comment": "Malware payload (Mirai)", "value": "d5f9274b2974147a1bcb86fe6568e05302880dd9c6c71d2c77cda32599ec68aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246260, "uuid": "948cb63d-5c90-49bb-8b98-3a9e427f3fb9", "comment": "Malware payload (Mirai)", "value": "dcffcced3518153c20bcd06cef4bc27f801abe4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246260, "uuid": "0afa7521-31d1-4cd1-80f6-ce1da156ca7c", "comment": "Malware payload (Mirai)", "value": "7f382d9c937a1186e08b573769e7fe5572f8fa04e47f9c21a021cfae7443636d5d7b79ffc0f9978f5d7923cdb6d76846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246260, "uuid": "a459434d-8bd8-436b-a475-6ef29bd422b3", "value": "T110C32BC0F98B81F6C40B88305166F73FDB7198A95123DA9DEF999F72DA73582912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246260, "uuid": "a91dd8c2-daa3-417e-97de-e4b4e40eccfb", "value": "3072:6FjlzYNVoZXRgn4c30tItERjnDBBMesWrhK8HY:mYNVoZhkD3OItYzDjw8HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246260, "uuid": "dfe82ba0-01c6-4f49-b5b6-bcd66a69fd8d", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246260, "uuid": "e4dffec7-ef8f-4e70-a451-fb367c9e3baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246260, "uuid": "68f8718d-abf3-46c3-9eca-3b3f70ce9327", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e49619-80d0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176762, "uuid": "9a5c919d-8365-48a9-9f37-e711996084b3", "comment": "Malware payload (Mirai)", "value": "282cbda306fb19491010e4d171c77ff1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176762, "uuid": "f69b5c5d-9dd2-4e1d-9f3d-672377709df8", "comment": "Malware payload (Mirai)", "value": "d68eb6792a0a9839ad25dd0b5ff346e535746a2f653547f64460b32ad858cf69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176762, "uuid": "bdce080a-8c70-4e39-b322-af9ccbdf5cc8", "comment": "Malware payload (Mirai)", "value": "3e91b53c6db3689ece34b2c015d9844892edcaa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176762, "uuid": "18cb21d2-729e-44f8-806d-1d0db4da5c00", "comment": "Malware payload (Mirai)", "value": "1b867a860116495232347ecbe9fd0e338779805168ae81a27e441ef997f82365b391a16e376341fb0ebbe96502666700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176762, "uuid": "b1ee597a-9a7d-4e63-8faa-a1ce7c5de104", "value": "T102241906770D0E03D1432DF4267B0BE14BABAD5138F9E681750AFECA57B1DF2644AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176762, "uuid": "f457bb9a-7a45-4eb9-aba8-7c3ba47c2303", "value": "3072:bi0aZs5F5OIibQWe8Qurs4xfMe7tbf8DB7raUnTEtjDvnGiM:bB5Fib/t9xUe7tb0DBHaUMjdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176762, "uuid": "d725a438-dee3-4e69-bc3f-49bc14daa05b", "value": 221992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176762, "uuid": "d3decb25-d7a9-4a12-b431-93e1ad0fd39c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176762, "uuid": "3b7743c3-a64f-41c6-abf3-72f322ae4b20", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03323615-80db-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784181356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181356, "uuid": "5c61b5a8-0cb7-496c-bd13-ac7e2dfd172c", "comment": "Malware payload", "value": "2641329e975494ca1fce43358de3af10", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181356, "uuid": "17ce5fd2-faba-41e6-a57b-044675ac561f", "comment": "Malware payload", "value": "d6c6f1db9586df9cec5332dd0b7155314a2f439f0eaebecda501f5524576f25c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181356, "uuid": "6dcb382b-dbc5-4cee-b2fe-b9c848679b5c", "comment": "Malware payload", "value": "98997afa1349b957a9908418149ac003ad462d2a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181356, "uuid": "a9e35ddb-e518-4853-991e-8044638988d2", "comment": "Malware payload", "value": "6a5afbec89ef0a9bc51a195051b0410f4a1d0a69968770c64b7f43e5258ea84ce882555efbd30c0eb92bc9f53def82ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181356, "uuid": "ff1d1cde-c8d2-4b67-95d5-b674f838c9cb", "value": "T1DFC27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181356, "uuid": "90154164-0292-4650-a84a-9279fd2522de", "value": "768:q8vCB+25j6es8Rm9FYpMSUpi+20qUpi+20YQX:q8l25JQd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784181356, "uuid": "4794e0bc-cdbf-477c-a306-beb7205a606c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784181356, "uuid": "359fc256-4148-4e35-9f8f-68a42d13c182", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181356, "uuid": "ab13fe58-4a5b-427c-9374-48959aa8aea7", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bf8e82-8114-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784206130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206130, "uuid": "2c17f5df-a578-4b87-a608-540d56ef33b6", "comment": "Malware payload", "value": "4fa126219b3b9b6a2c0191810f1897c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206130, "uuid": "8465f7ff-d79a-4816-af9d-fa644bf8c947", "comment": "Malware payload", "value": "d724ee0385b08924226bfde7474116921e2631477a9bc2e32dec585a7fdc29fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206130, "uuid": "d5927934-04e2-45ee-acd2-9306614dfc61", "comment": "Malware payload", "value": "d13c1fcbec60d2c0015537386fdb5592d658d040", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784206130, "uuid": "23fae82e-a33f-44cd-a5c8-2487a67a0cba", "comment": "Malware payload", "value": "5fadc8daa3636bc1d5cad57368757b86e0c36ab0e4b4544b16d5c6eb5b90daae7be6caac3ad0b47b1d8bf506719d5bad", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206130, "uuid": "119b6cb5-510f-4db6-8519-412367b1f49c", "value": "T15B11AFCA81409C5410E9E65D36975068F821C3CE1D4A0F65BFAC6E3DEF98C04B076F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206130, "uuid": "bba4f74d-f7c2-40f3-920c-acd46745ae34", "value": "24:kXCKysE2hi0ziQvZohaRWj6D7a3Fq1glJIX:e9Qp+MsRC6Dm1QQJIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784206130, "uuid": "aed61fcf-0e22-4319-969d-16ea874a7d06", "value": 856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784206130, "uuid": "2e6825d8-a27b-436a-b638-ba391c6da67c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784206130, "uuid": "f9d7949a-a4a9-454e-899f-89636fcaccd6", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992cf07f-80d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179890, "uuid": "dab0a9c5-28bd-419d-919a-c07545f99811", "comment": "Malware payload (Mirai)", "value": "396fb5f65f997abb6a516e170270f6d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179890, "uuid": "dc636269-cdaa-453b-88ed-15ce743ef1f7", "comment": "Malware payload (Mirai)", "value": "d8386b4d4511178d320db001a434c8bc4bba485e985869b8aaaf3d72eaade87d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179890, "uuid": "c945a16f-37a6-4c59-b79b-4c80ae8dee55", "comment": "Malware payload (Mirai)", "value": "42767f742d86b24420ec57d673339255b274f0b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179890, "uuid": "b404650b-b408-4b95-9440-4a91ac0fa6b4", "comment": "Malware payload (Mirai)", "value": "ed3e66fef13ccbb4a86addbc085dd05845c889ccda43e390b0e6a1729aec7611f92856eda3bde0bef57c7183f8418553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179890, "uuid": "f5d76699-29e4-4d15-9e08-b8a612d232d3", "value": "T19BD3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179890, "uuid": "a0a419cd-d42f-42d9-82da-82cad32eda08", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zb6:xOFgpOEoVv3MXL5NhGOb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179890, "uuid": "f7048487-cb24-472d-93c8-e5a66abab809", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179890, "uuid": "37675e22-28f4-4e56-adf3-774877ddddeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179890, "uuid": "efc84f6b-10e7-40c1-89ae-254c60e7ba45", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1e5382-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784227975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227975, "uuid": "eae95652-28f4-44fa-8cdc-d5a7181efe43", "comment": "Malware payload (Mirai)", "value": "7260b12d89ee9e37e5d052d7cb4dced2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227975, "uuid": "2a04fd29-a435-4d88-ac30-7a4cf9b41910", "comment": "Malware payload (Mirai)", "value": "d8691848aa46534128d0458531fd029797c263e4a0f7c0f424a3a4fb74919fbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227975, "uuid": "d6964bdb-478e-4892-8cf8-bfc0a44cc4a0", "comment": "Malware payload (Mirai)", "value": "390f44edd28e7874406e975f3858919b213a5d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784227975, "uuid": "7468596f-6dcb-423a-b682-662d7a137d05", "comment": "Malware payload (Mirai)", "value": "bf67001e5aadf28503cb28b0108628dde01f0f38d9f07705f8faaecf647b12b63cf217c434ef497b1ccbfcd41fa159fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227975, "uuid": "0f96c923-bbb2-4659-abd4-20f91ff25e65", "value": "T17E148D01FB181953C5931DB45B3F0766E379D88318F8E109190BBB961733EB79987B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227975, "uuid": "bf7fd209-deda-42ba-94a0-20c9fe849206", "value": "3072:HqC9BBot6hZY0xPcG6/yMyI8chAkrOpOyoFleHRZ1DroXJ8:b9jotAY0xPcj/7PVAkrOpOyoFlexfQXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784227975, "uuid": "316d4287-38b7-4b4a-b9e4-b7c2a3995d8c", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784227975, "uuid": "85b9d9ef-6d39-4f67-b9ff-945e406ecd60", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784227975, "uuid": "4dbf5e86-58be-482b-a91b-0eb5e5de4794", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1a0fd3-810a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784201562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201562, "uuid": "7510e9d1-c8ab-44d6-840f-afaf62eaad7f", "comment": "Malware payload (Mirai)", "value": "6010dbf6c83675e3a6568c4d4d17b4b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201562, "uuid": "ae72e46a-54bd-4c72-9ef6-0882b46e5241", "comment": "Malware payload (Mirai)", "value": "d878272de0ba7e8dec60071a0f43c6ee534d1b43fdc48cb1c7de7f4ca247f9a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201562, "uuid": "dc6e11bd-c927-488d-b332-99a257ef2cbf", "comment": "Malware payload (Mirai)", "value": "bfe64b1d3588e730f213476de1b8a923a835bf2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784201562, "uuid": "1a402e73-342d-4da7-8570-8532c7282d33", "comment": "Malware payload (Mirai)", "value": "9ad4d65bc0856e3658e54c0a95581c6e471a182366c7085ba3fa1a9f988c39a3a955dbb4903528b4c2409237be5bb784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201562, "uuid": "037e4039-71ab-436a-896e-5b835c7308be", "value": "T1CB53024216BCF83ACAD3D5390E2881E786CC59A45897901F43CA7DF44A05C7CEAEC6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201562, "uuid": "2b2f86f9-1fff-41d7-a589-149b2fb7a1be", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/41Wsyz1AQN:IaHJgMo8FwOA4zUFGUO3Uh2Ms7QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784201562, "uuid": "03f5dc1e-26df-45f9-a2f7-40e56946ece0", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784201562, "uuid": "a137ae86-3b44-4b45-84e2-58ada6043da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784201562, "uuid": "0a08f3aa-3b1f-4075-9cd3-83e151849a4f", "value": "d878272de0ba7e8dec60071a0f43c6ee534d1b43fdc48cb1c7de7f4ca247f9a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3187e2-8113-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784205688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205688, "uuid": "5c6d5cb2-0812-460f-96fd-71e1b41b0615", "comment": "Malware payload (Mirai)", "value": "4ff5382ba0dc7c8035cc5c833a43f390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205688, "uuid": "5187395c-b445-46e7-b0b5-14aedbf9bfb9", "comment": "Malware payload (Mirai)", "value": "d8c3080005482e74669131fe1a1b149205fe732284fc799cbc6b843a71cd174b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205688, "uuid": "d7e12293-81d0-409b-9e17-ed1d5301d7f1", "comment": "Malware payload (Mirai)", "value": "a55af282009b50a5f7d284bf8f0b0205fb4aafbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784205688, "uuid": "b00c4b60-958e-4b04-bf52-f1e03ff92360", "comment": "Malware payload (Mirai)", "value": "6ad50ce716d0fa7a284e15e5e4119fe6c1b80da79f9312f3ae34d5fe09aac0754046a565cf2b1d109a5e4f6944a5d262", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205688, "uuid": "07a407f1-41ad-4c3a-bcee-830e8d6587de", "value": "T18F5302455DBCE83BCEE2C4380B6441E94ADC59B86492501F53CE7DF48A06D68EED8BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205688, "uuid": "c40ce632-4ad8-4f75-ac17-04128eef71fd", "value": "1536:Idcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/fSlAQT:IaHJgMo8FwOA4zUFGUO3UhZtQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784205688, "uuid": "1b4b5f97-da5d-418e-a8a0-637d571ba005", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784205688, "uuid": "9d60a66e-1aef-4a1f-823b-2f942698ca8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784205688, "uuid": "d2c0a680-59f6-41db-bae3-771f85b1381c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437ad45e-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178887, "uuid": "ce54cf03-c497-42c3-94ae-9f3274e4c009", "comment": "Malware payload (CoinMiner)", "value": "1bf206f8f0d7329fa27df1adb6efdeeb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178887, "uuid": "7ad0384f-9067-46ec-9201-2aa4b52d2d32", "comment": "Malware payload (CoinMiner)", "value": "d92102f338d5d8a1fa4c00104e2ffd6c6cd06c2c800023f3fa53dc9d98986ddb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178887, "uuid": "a645e618-4bce-443f-b3e6-ee22aeaef252", "comment": "Malware payload (CoinMiner)", "value": "c8927c397f57f0a4742bb9b3a0bf6c7cb509b1df", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178887, "uuid": "1ed918b7-96ba-4a53-bfe2-4b8e04b9968b", "comment": "Malware payload (CoinMiner)", "value": "0d4a49e0467e4c7dfbd13173ca797777d65019571e21dd41106fa6b10e1fc6b3fb4dfad8cddb2a124bfccce747c3445f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178887, "uuid": "597e58b9-f6d2-4d26-ae27-61420b556104", "value": "T107065B81FC41CF52C9D43A7BF66E828833130779D2EA70069D255B7467DF99A0F3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178887, "uuid": "0ae084cd-8782-4177-b964-b7a021e26577", "value": "49152:QA6c2wSyiVkyYifDp38o+9Nd7dQcTau1gN6pb:QnFVkg7p38ocfGu1gEpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178887, "uuid": "5051dc47-2e31-4cf4-a250-d97e6e14e955", "value": 3900176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178887, "uuid": "2f243673-e3a1-45bd-aec6-39fcbad7d9ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178887, "uuid": "3707325f-bad5-4dfd-a4d9-3671177d6370", "value": "74ed8d57566e1b44f1594555727813c93f8850b5d7bd7f10a707d519b4ff95da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00beb490-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208410, "uuid": "6b41d7a7-32dd-496b-96cf-503c7f243d2b", "comment": "Malware payload (VeilStealer)", "value": "e95080155d83fd6ac3e5f255e66decad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208410, "uuid": "508c1a46-fba9-46e8-b80a-f64426556a58", "comment": "Malware payload (VeilStealer)", "value": "d93d3701b17598fdf244e0eec2a87a13902baadde7c2c9253d60566215ef6df2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208410, "uuid": "11c701b9-bc93-4d80-b024-e110d3006b0c", "comment": "Malware payload (VeilStealer)", "value": "57391a5a6479e6f56223de33c15b8f880b83d0e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208410, "uuid": "d0421e84-d2a5-452b-a925-9dabab34f0c9", "comment": "Malware payload (VeilStealer)", "value": "6db5282eba19cd152348977ee3728dfd950d290159dbb8e5001ef88d29afc234ee0bd8bcfca1dd77e834449765269ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208410, "uuid": "135c0330-64fe-4256-aa4a-fd4fa25dfb73", "value": "T1EDD64A47ED6505E9C0AED575CA639517BB703C894B2063D36B60FA292F37BD0AEB9300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208410, "uuid": "cfadad2c-1ada-40fd-9768-d9e8e7adf289", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208410, "uuid": "75c9e8df-6108-46dc-9ba0-6f1a01899174", "value": "98304:gDrE3NIuJy6cw1N5eIIOhQbgne22tdSVH1ajpEz:+CmuJy6cw1B9e2UUajqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208410, "uuid": "0cae976e-44aa-493d-aead-bf68d61ffd37", "value": 13152768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208410, "uuid": "69eeae0b-b9c3-4b5f-8336-4b324186332e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208410, "uuid": "a4db71af-1d08-45bd-9d66-23ddaf2f61ba", "value": "d93d3701b17598fdf244e0eec2a87a13902baadde7c2c9253d60566215ef6df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b86593-815d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784237331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237331, "uuid": "39fa8669-b17a-4f92-a5cd-fec9cfb943bf", "comment": "Malware payload", "value": "5da549025cc99d8598cbc6630d7e4ba0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237331, "uuid": "7479fa97-6098-4a6e-bb9f-9385e139adf8", "comment": "Malware payload", "value": "d943792b4ded38c0e11cf94b717f9469431a7f0c570d1a05488d981bad1f41d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237331, "uuid": "7f7ee9f9-0caa-4480-bc2c-2e1e254688c0", "comment": "Malware payload", "value": "e94dc6ce61b7342328f1c3892a9c5ee6210ffc55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237331, "uuid": "7a5ff030-7aa4-4ac0-9940-a15a356f1b04", "comment": "Malware payload", "value": "6c329e8df1d2d98cf2083fe1acbbcdb87dcb8a469873b1503d3027f5f3e1065d2d2a1efd742d2e948f11ed71136841c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237331, "uuid": "999a9fa5-fc26-47b4-b8f7-80ac425d0a8f", "value": "T15373092ABD419F05D4D526BAFF1E538933535BBCE3EE7102EE142B2527CA95B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237331, "uuid": "305ebc30-4be2-48c2-bee2-6fd25f6c28f6", "value": "1536:xrnKEUNv+8OELNAqphLACuSDrKGq82dXkR+TCZdrsNl1LiHkXEh3p:UEUZtcpqxq82dXk0TCZ6xXER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237331, "uuid": "8a8fea21-8519-44cd-99d0-ed4a26f2e71f", "value": 75572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237331, "uuid": "8bccbb14-a79d-4e2d-9825-645bb9b69599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237331, "uuid": "5ccfe4bb-c331-40ca-a7c2-309f947ec45c", "value": "4Ij", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e81ee14-812b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784215815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784215815, "uuid": "7a6d24ca-3b7a-484b-991e-84b93adb3b50", "comment": "Malware payload", "value": "25c093e39a9d4e8e34ac2108134b82de", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784215815, "uuid": "a967d902-45f4-40a3-814e-a952ac71c579", "comment": "Malware payload", "value": "d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784215815, "uuid": "a268e15c-120f-4c75-8805-b456eed28955", "comment": "Malware payload", "value": "32ebff75e5cda98c9ea78db26de4f09aec185c4a", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784215815, "uuid": "99a209a4-faad-4d65-a9bb-669ac3d15451", "comment": "Malware payload", "value": "dfc366f7f4f75fd52d9e13dccc2671400a715f6d899f4fd032f333a889a7c47a72da25bb2ed1be7ce9c6de4c2e399ffd", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784215815, "uuid": "2a2ad85f-4fa7-48bb-9e60-adc7da24df29", "value": "T193E423C4DDF94B33A6E9F016FB2E86A164E217E124BB0BD4B3A79EB3B42D0D90150475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784215815, "uuid": "bae47443-4dba-4f23-9551-6a43e525f260", "value": "12288:yR7o/CAJwZGBQ5CqOBHaZBw5VD1OgyKC2vbQl+b4IE+Bo2rtStux:ypo/CeHSUqO9KByVJRNj6+bjE+B+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784215815, "uuid": "9f776c86-af69-41ae-93b3-99a21d25b363", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784215815, "uuid": "2135d700-6cfd-4318-9b81-a2289ea2c2ca", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784215815, "uuid": "0f2f2967-2095-46bb-947c-702b2bd969c1", "value": "d97be816c15abfe736c18844cfbc70b33cea69c94fd767378cfade1c9a32c411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20aa5ec-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784186052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186052, "uuid": "afb70364-4d99-4a92-9fd0-9c71d546740e", "comment": "Malware payload (RemcosRAT)", "value": "f5d910d571ad93461f47111872f79c82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186052, "uuid": "72703df3-f619-4e58-9700-2a02e13c4973", "comment": "Malware payload (RemcosRAT)", "value": "d9a134ec20968e062390b5cc4a99cd5be2f3d41725d1945a3b7c602dbf0fd35a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186052, "uuid": "b912cad9-01f7-4378-908f-6db2b748697c", "comment": "Malware payload (RemcosRAT)", "value": "389b9fe0743d14aee15e6301238bb5375833196a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186052, "uuid": "211200e9-df91-4e64-909a-1129801e9e29", "comment": "Malware payload (RemcosRAT)", "value": "9d2f6da338bab1496be3eb0ab9094bbdedba40b45819e6ca9fa2715e91b0f9e6e69ae2148f2942cbdb65fdb23e906bd8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186052, "uuid": "6495bbc0-cd23-4ade-947f-a8f97b861dc2", "value": "T1A207D267108F3D05D1DF2417AF1E9113CB36B6B38839C39622B6AC44EDE1D82796E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186052, "uuid": "b37c636b-246b-4cbc-8d44-237a6e863c4e", "value": "768:jFbZNydN633Ni4y4H+tk4LWJ6IdJFZEQokF1ler25PCQW3YU+PMu8cJtXhkWlhgr:SIT8hUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186052, "uuid": "19589e3e-2296-4131-9f64-076cfbdfe59a", "value": 16820782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186052, "uuid": "91340d6e-4f7e-40e4-bce7-a6c305ba53f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186052, "uuid": "dc22a518-0517-474e-8c08-cf9ff2a2e3b8", "value": "AWB no 530526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11b1103-8147-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784228060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228060, "uuid": "f809b07c-67e4-4ad2-9b24-323da7890411", "comment": "Malware payload (njrat)", "value": "7abc3944fd54c084e246b372bfd897ff", "object_relation": "md5", "Tag": [ { "name": "AnyRun", "colour": "#348F37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228060, "uuid": "4325adbb-87bc-4974-a456-5f7616810ee3", "comment": "Malware payload (njrat)", "value": "d9d61360f2a56e3f54573dddd201b482e99fe2b0bd9f943cf19c0b3e5c463475", "object_relation": "sha256", "Tag": [ { "name": "AnyRun", "colour": "#348F37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228060, "uuid": "db58a7e0-b3ab-4de5-99f3-19fb198a3346", "comment": "Malware payload (njrat)", "value": "5988b59aa5b167e9f8f2163050c8f21e9728b561", "object_relation": "sha1", "Tag": [ { "name": "AnyRun", "colour": "#348F37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228060, "uuid": "dd906aa5-a3a0-4857-b866-eae93a28e6fd", "comment": "Malware payload (njrat)", "value": "0f2e7e957727b40e3d1a8d41c87af1e268ffde5f63e0b019521f24a0d3e15e6d1e02fddcba10abf91fd27d700e484326", "object_relation": "sha3-384", "Tag": [ { "name": "AnyRun", "colour": "#348F37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228060, "uuid": "1c84fbc3-da00-41b5-a8d5-1e6347dce269", "value": "T12624EA98FB847CBBC25C9E1E969AB736613E85DACC4AD5C1014CF3B028E77419E39C02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228060, "uuid": "8ac04300-b15d-47bf-ad2b-2f8ee37d22a2", "value": "6144:e1Q3pN+5mbE6xxU4KGKSB9HMBsR6jPlq+YIaH+Ntpa:e1Q3pN+QbE6xxU4KGKS3sBseq+YANy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228060, "uuid": "8789b749-cd80-42e8-9352-22c18fe90541", "value": 218336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228060, "uuid": "3fcb3ffd-e43b-4302-9e76-7f58c686435a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228060, "uuid": "f0594eb4-ac2b-47ef-b0ca-97342bda2bb5", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606a5cfa-80d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179794, "uuid": "631c9022-27da-48d0-b3e5-d545eb8c89bf", "comment": "Malware payload (Mirai)", "value": "40845c9b8545d4db4e346d0352dbba45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179794, "uuid": "bbb9edc3-8ac7-4f5c-b8ca-2a12dca3e25d", "comment": "Malware payload (Mirai)", "value": "d9e0d83bb66e126c2cf71be4cac1b8ad291486d77df9570050eabae817b8a901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179794, "uuid": "fe0765dd-da1e-4087-b10a-230b684d8156", "comment": "Malware payload (Mirai)", "value": "376e0f43c7ac47aaad484f8444ed4a5e2f2813e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179794, "uuid": "a6b9de57-ff58-4ff2-b065-62fa1672ec5b", "comment": "Malware payload (Mirai)", "value": "e7f7e6936b793aa95211525c4ea2850007ee2710a25a18eb0ca63d7f09a3f0d47a1d8ed44ee23022c5b572235dceb668", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179794, "uuid": "389590e7-404c-4987-958a-763d9e2705e0", "value": "T190144A63DE25AF8AC516A1F0A1F18E384F52BD2649570FF9A472E9F04143DC9F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179794, "uuid": "26db38a0-27b9-4f0f-9011-4ce49ffc12b8", "value": "3072:mu1KJv7bxWvG7SHjtzI2GW2wCy3gpvz3WUMSHfRc2yyrjQ7nGqP:mu1KB3xWvGeHjtzIjwCvvKaHfRM4ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179794, "uuid": "74caa73b-ee90-4ab4-afa8-097999066b82", "value": 193228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179794, "uuid": "7609a5a6-e54e-443a-8369-a8800824f156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179794, "uuid": "c540c34a-a756-4941-b30e-e797f3ddc195", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df5bf34-80f7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784193615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784193615, "uuid": "11e48684-0a43-41f9-beaf-48442ae1ce2f", "comment": "Malware payload (Vidar)", "value": "99ef6205cdbbc6e0b227f9997d3bfb10", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784193615, "uuid": "badaafd2-d203-4002-8882-c1b127c19a51", "comment": "Malware payload (Vidar)", "value": "d9ec5f7ca76f9c0b26680f935de9377dfece17479de9f43fff81e5b530263d51", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784193615, "uuid": "cd7e5090-3fc7-409f-99af-27494d568e27", "comment": "Malware payload (Vidar)", "value": "10020288e40d3606968d2d79b618db46a589a967", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784193615, "uuid": "808a0e19-5258-4b8e-8723-cd458b92192f", "comment": "Malware payload (Vidar)", "value": "b823c9b9fb61ae07208c92fe06e4a68dea81feedb8e88919b0cb5749043067f169ebcd991e612dae1d0f0c70698daa4d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784193615, "uuid": "5afb055a-f304-4c10-9ce7-c6928ab317a4", "value": "T16075339BB74295A3C43047F7176F102B9C9D8229397C21B71F41C10426AABEE8EE7779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784193615, "uuid": "835fd9f5-99e9-4fe2-a9d1-904160ac567d", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784193615, "uuid": "8d302469-6549-492d-aa9b-bb2f0e1a2145", "value": "49152:q8ZYplmjEHK2RwF/oFy+1mnhLdS++gR+eNXgT+oZ:q8ZomCRwKFyjZdS++gR+eBoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784193615, "uuid": "9ce4d9e4-7354-46a4-8024-7ef10ce6f47b", "value": 1656418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784193615, "uuid": "e28e63f2-bcf3-42b0-a693-3523988f9188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784193615, "uuid": "3a91bce0-16b5-4349-aaa2-a221c79c4b9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acd00ca-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178819, "uuid": "e048e9c1-7784-469d-ba05-80d6157ba64d", "comment": "Malware payload (CoinMiner)", "value": "69177fc9f514ff4015ade97b4cd1e030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178819, "uuid": "229a093b-f5e6-4a9a-98a0-34cd29b23cf4", "comment": "Malware payload (CoinMiner)", "value": "da876a12b32267fcb7f43ae01636016b6bce497cc6773c3318072d387c883a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178819, "uuid": "06d6a3cf-37e3-4e3a-b17b-8b8968f6ca85", "comment": "Malware payload (CoinMiner)", "value": "3752ba3373977900e3bad0739b04ec134bd03bcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178819, "uuid": "b3a0647d-e45d-46dc-8c39-337afcedd8b9", "comment": "Malware payload (CoinMiner)", "value": "ad89a3cdf94ac7fac01623fc6caefad453a1b1626f8f59da4938f117d4fb8f4576088c9d1a81251ec54496257b34995c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178819, "uuid": "78641cf3-8349-454c-91b6-8ece74d570e6", "value": "T1D97533652D1CC850FD929D35338A7DFC5213E9336DB4F118AA5A37E830D8819AB2D4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178819, "uuid": "9cd7995f-f7f0-488e-b094-ad72b0064c52", "value": "49152:2IdeN1iwL3acqUMCrqd6npCByHGvESjIdX:2ziwLKVcrxyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178819, "uuid": "0a4aaaf3-2682-4044-ae61-b63151925979", "value": 1682008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178819, "uuid": "3f70748b-4a5a-44ee-8d8b-e5e954323aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178819, "uuid": "7de4c2d7-78c8-4d9f-af07-13b2e767c181", "value": "da876a12b32267fcb7f43ae01636016b6bce497cc6773c3318072d387c883a95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17125bd-813f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784224598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224598, "uuid": "28e5a5aa-e07b-4782-86fc-04a72dd2ea0d", "comment": "Malware payload (Mirai)", "value": "63dfd97abf7e799da577593a26daf279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224598, "uuid": "47287ea0-406b-4ce4-b63d-8da6bf6820bf", "comment": "Malware payload (Mirai)", "value": "db0c20379b9b03ccfaebc7d076f679f2f23c46b60a24de56abb0c7a23c5a1f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224598, "uuid": "cb28e9ec-4f85-45c7-8962-b58185cee601", "comment": "Malware payload (Mirai)", "value": "f837a06ea56b6634ca461b450c2cc5efb438729e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784224598, "uuid": "526ec56c-0409-4035-9761-532795229b06", "comment": "Malware payload (Mirai)", "value": "3543486d3b13683013c3cc99c3cffc5362abb813dd05d57f6a020ca69ca9032594fbdb148ecdc60b0fd6b362ae4f00f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224598, "uuid": "85fa9725-2194-4259-b333-595544d066cc", "value": "T109146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224598, "uuid": "b6d3848f-0503-4d30-b909-8e423a351cf9", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTt+:BZAyFzQSdS7IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784224598, "uuid": "46e19876-5d3d-4980-b4ce-5d72bce684fc", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784224598, "uuid": "30943493-d050-468c-b2b6-db072af9588e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784224598, "uuid": "cd7d2136-aa7b-4666-909c-e248d176d45f", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b088eb-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784184883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184883, "uuid": "e24a4c6b-8633-4f22-97a3-fbe1463f8519", "comment": "Malware payload", "value": "4cab813e2894bffb6198c7d60e86b425", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184883, "uuid": "c73f3129-7841-467d-9dc4-5aac3c55d5dc", "comment": "Malware payload", "value": "db9f371944f479149923ae63235942953a2b6388a4ab2c29d7bf7dd144c9a71c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184883, "uuid": "35b8ecd5-a3a7-40f9-a3ab-6975279c8c02", "comment": "Malware payload", "value": "5478d96e676953d2e5acc7711fc82c52ae2ed2f1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184883, "uuid": "fe49cd6c-85d9-42c7-96ed-d86db3f194d1", "comment": "Malware payload", "value": "a755a9ff4ba196a92eae15c94e4aa72b2e90566f89f18f6e1609939a485deda3f80315b49111c6adffcf9df31c9cdb99", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184883, "uuid": "c9573383-33bb-4e95-b796-48504ca7b54c", "value": "T11CD29212B2C9CE1BF16251724ED7C6D6B229BE1D9E12C70B33547F1EBCB4AB08621752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184883, "uuid": "4eaf9715-c2c6-4cbf-aa29-b837ce2e5a2d", "value": "192:wTeKa88ZEvA+6/6rNavrgYjk+4bWl/gkMZ3l1DxtkR8na50jnJAtts56Ka:wc2iSwvxjk+t/m1P2RAa50jn+ttf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184883, "uuid": "c6a1b87a-4a7a-4ccd-814d-fa5d6692a2fa", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184883, "uuid": "1b0e383c-e415-43c4-bcb7-82c9bd3b6bd3", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184883, "uuid": "c321d7b0-1764-450c-a53b-19a11c585395", "value": "Order Statments.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ca8767-80ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784160874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160874, "uuid": "7602cd7c-b3d9-4c0b-a364-adb6740a9229", "comment": "Malware payload (Mirai)", "value": "b6ebab8f38de2b781f1d91bd766beac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160874, "uuid": "1e821693-2249-4e6f-b48f-b7e03e7aedc9", "comment": "Malware payload (Mirai)", "value": "dc28e187522f7376ae4414ac017bb317f88545b602c657d5c7c4eb028248dda0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160874, "uuid": "4ee14e0c-ef7f-48fc-b051-51b13f8ee22a", "comment": "Malware payload (Mirai)", "value": "d45f1bbeb826f2f0d2a10c1f0bb2da6b103814f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160874, "uuid": "5dd8de63-9022-4dde-b3ff-68a30c68d7b1", "comment": "Malware payload (Mirai)", "value": "7e003d9e925fc85acf6a950b60ce31a45034fec58584a48f503cc740540ac9ce16785f79f2e8d9ab8764ec7b361d9ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160874, "uuid": "71af821b-2ffd-43ce-a26a-a14bc04dc659", "value": "T137D3E60E6F258F2DF3B9C73487F74E21A79873C626E0C649D1ACE5111E6028D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160874, "uuid": "51e81a5d-0250-43eb-8455-6f901853b3b0", "value": "3072:TpBaETS2ZtcwSlE4bMdcGmikUvbxoeEf+gg4Q0neZOm3kRGm+n5vq:TpBc+gyV1UFYvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160874, "uuid": "f23662ae-f5ea-4fc3-a7ad-29be5152148f", "value": 135080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160874, "uuid": "1c421393-c1e1-483e-abdf-bb9f5b4d4fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160874, "uuid": "044fb5fe-5d8b-427e-80cd-ec7d9697158a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45813ef7-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784212821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212821, "uuid": "ef487b04-7a9b-4334-9161-0f4140229d6a", "comment": "Malware payload", "value": "bdd9811d3c7a33691b1d8b5ad931a5f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212821, "uuid": "4fe1f486-bf44-4c3b-8867-be058272f48d", "comment": "Malware payload", "value": "dc4f25b2247cfdd6fc96848db30a178baa4419a4c854e86e315b465836102d14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212821, "uuid": "b68b3390-7554-4aeb-ab45-f6ab04eeb6a4", "comment": "Malware payload", "value": "653cdcef2f062ae6ff01363c1221d4f2ed456401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212821, "uuid": "681e1b57-b4ef-48af-811c-2342a48a7b4b", "comment": "Malware payload", "value": "5bba8a0324f85abac53f8eba65df2c5e42e6b9543aa299953a73b6b503a5e85472c0975ba7976cb48e5b95f1564a69d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212821, "uuid": "56a76970-a462-466a-b079-96c0e33a7f65", "value": "T1BA934C52DFB80F9AC0BECE7046AE410B015149D296D6C17A627C4CCCB6EE7A64BC7D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212821, "uuid": "ffeee477-1638-41f9-b795-6ecbc723bd32", "value": "1536:5FjQQ7+B2orrwoXb6FIPE9X7uwFHbw/L0h9RPH6dur5:5zoHE7RpF7Asz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212821, "uuid": "f5f12c6b-eb04-4ed1-9d79-a9b3ada263d3", "value": 95304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212821, "uuid": "64a70a81-366e-4f05-9155-69f621c17cbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212821, "uuid": "9a852100-86c4-4ba0-a514-026c42297f86", "value": "158xp5u9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65913fbd-80d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1784179374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179374, "uuid": "154d3aca-509b-425e-9d56-2071e9174e80", "comment": "Malware payload (DonutLoader)", "value": "83e0aee07a526f99351c635782899c4f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179374, "uuid": "0d7a96fd-06fc-4646-ba9b-4584d5ff086c", "comment": "Malware payload (DonutLoader)", "value": "dcf964e5f926d82bb55b81dc5f21001b28dea9fc2a1f0508c9e07e391b0bd1d6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179374, "uuid": "807d3a2a-9ea1-42ab-b911-1d0ce96d1721", "comment": "Malware payload (DonutLoader)", "value": "88ac3b1190d0bf3bbb2c798d7e5d06e99c443471", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179374, "uuid": "856b0836-d98b-430a-8002-59dfc665b160", "comment": "Malware payload (DonutLoader)", "value": "2f5aff3f5a84a037ed2882ccdf7c5e82618413552d3091eb7681c462d4d73bbae44e5ca4e7b13432bc5b6735e8fd03ee", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179374, "uuid": "7020176a-bf9a-48f8-b70f-bd504dd8ef98", "value": "T15E04AF29A3A220F9C11A827956D753F2F933B8311721AEBF03A8CF761F54D90776D225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179374, "uuid": "1d471522-7369-4c40-8e16-19b108826c72", "value": "1fb0eed2c796a39f69cd3e32fa4f1b70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179374, "uuid": "3267ff24-aec3-406b-89e6-211f520325f8", "value": "3072:GK1PMv6M3JMBrQhWh8zezFlWeZgW0FFXkLFuNf5krpcyn1ZN8islfd4DW:Livz3JMBrQh28WQeZQeuNfApjrslfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179374, "uuid": "ad55cf2b-9023-4bbe-8875-893435b231d7", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179374, "uuid": "e5789b93-272d-4ec9-81c0-31cd08048364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179374, "uuid": "07c4af38-0ad4-40ce-a5eb-c9e9838aad42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbb3e7d-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185400, "uuid": "53451a34-c3e5-4b2c-8a32-20d92f9adecb", "comment": "Malware payload (AgentTesla)", "value": "f2f457c5db0c6623d687d0f445d7189b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185400, "uuid": "cb1a970d-4f10-4233-b7c2-89bf7c3c6cc1", "comment": "Malware payload (AgentTesla)", "value": "dd3c857fe1e186c19c7571bb9c0c42747fb2f053b6661e717141d077a1923d9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185400, "uuid": "dd30ad0d-1a57-46aa-9158-ecf7fd68ea61", "comment": "Malware payload (AgentTesla)", "value": "0ef88470c999956c70dfcd278726effb9bc58cf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185400, "uuid": "ee4a00a0-9eb7-4f5e-afc1-f463132c7e33", "comment": "Malware payload (AgentTesla)", "value": "ebce6f0b9911438ae8d43f6d59dba8caa5f7040d61853a4999c4a145333412f09090244e5283bf163ee9ef350f576ee6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185400, "uuid": "6840b4f6-1ef1-4348-9a34-74e2bf931a29", "value": "T1D3E5E7119764A133B720D7AD5736DE3C650EA00328EACF44315FD628B95ED8BA358BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185400, "uuid": "e4b56ff4-6a35-4db2-8054-022b6d69578e", "value": "98304:bKzurinlXyl1yPCrsqnww9hU/Egko4BUB/t98/RYVoWpdUNjrov:eCx4GUpB/t98eVok0jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185400, "uuid": "3ad829e1-669f-4b48-8b07-8b69eaf74f6a", "value": 3291847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185400, "uuid": "f2e7f90f-65d9-48e8-889b-b07bc45a8ac2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185400, "uuid": "8fec6fc3-7b5a-4167-9e6c-463c4800b62f", "value": "Pago de Transferencia.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0b701f-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185157, "uuid": "cc4c1574-ba15-4a98-aae1-9640cfa4dfa6", "comment": "Malware payload (AgentTesla)", "value": "96f5700cec79755f7e2093b343f7aeaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185157, "uuid": "6380b5b3-0bc8-468c-ac13-f48cfcee0326", "comment": "Malware payload (AgentTesla)", "value": "dd926a72da2310cc937a836fff17d4e8904d8cae232cfa2690bc942f8a8ea950", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185157, "uuid": "6e6190f1-ae1b-4396-8ff7-71ebf6908802", "comment": "Malware payload (AgentTesla)", "value": "1d01e16944067b27c53169452f22b43f99f376d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185157, "uuid": "137d286d-8e1b-4afe-b409-5d6e65f9c8d6", "comment": "Malware payload (AgentTesla)", "value": "4a0384058ad5a14afd3a9c5d85d240abc5cb400ccb5b609ea18cbd87a41ab441e5994ce18eb8d1f58c61472d2dfda496", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185157, "uuid": "09e65f91-338f-41dd-a95b-8cf421626f8d", "value": "T18AF53A41D328A8B1A52ED32DD136AF9C0A4D2003359DDF2D39BD1634B66AF17A35C9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185157, "uuid": "52365576-410d-4947-a210-f694c4cf15bd", "value": "98304:aOn9yo6k9llWws87sWf4fLmTs+5PWABJazlp:r939PWD64jmTs+3Xwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185157, "uuid": "3f833385-0e2c-4140-809d-a403a002366f", "value": 3471310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185157, "uuid": "44f8c3f9-aae5-47c8-8181-be3b9a5f1c18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185157, "uuid": "864af4fa-eac7-4c0c-845c-a7387bd06937", "value": "RQF09800.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841b6419-8136-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784220656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220656, "uuid": "eb302c26-c8e0-4aeb-ac10-73dfa524204b", "comment": "Malware payload", "value": "d66eb372c3b6304768e7f3ca235adc01", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220656, "uuid": "9f9e0c78-6ed4-4651-8410-12e70f610b3e", "comment": "Malware payload", "value": "de03765f80b44dd56bbf59154d399dda0b7462a44986719f57d9666a611bb08e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220656, "uuid": "cd64107e-f914-4461-88a4-cc3a7d97bd08", "comment": "Malware payload", "value": "01429eca89c83962367914feee0a1b2eff4700cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784220656, "uuid": "a23d0ebc-b576-4313-a8fb-20538b0c5c6f", "comment": "Malware payload", "value": "a0236139d6bbde657c0b6bc25473df956f68908e654f9f42e618c66054e87073d3682738465ac7e80f539ce79de19fc2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220656, "uuid": "e41699cc-63b8-4c6f-8a6f-12b022bbc0fe", "value": "T18821498F135586B1874D48BEE79689E6D6034053409BE895F7DC5758BF30098F18CBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220656, "uuid": "f81af87d-f07c-403e-97bf-a40d5fddf7b0", "value": "24:vP/iqghBgaU0dQtFw2AALFR5sAlmGsPsqs1l2GXsilDsZlsK6vllu/s6Blwya:vLCBC0dQb9AALf5sAlmGsPsqs1lpXsin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784220656, "uuid": "de8e240d-ccc3-424e-8014-83a2d8d0604a", "value": 1426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784220656, "uuid": "e8b12a4c-69e6-4cab-a7ae-9c2345ca1185", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784220656, "uuid": "4c47452a-92df-426b-aa48-9277312d54f1", "value": "de03765f80b44dd56bbf59154d399dda0b7462a44986719f57d9666a611bb08e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07857e00-80de-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784182652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182652, "uuid": "76cf6ee3-cc18-447b-80c3-6206ec3c5a6b", "comment": "Malware payload", "value": "e23c489ad4000744f6efcf2bee1e412a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182652, "uuid": "ab9a1a8c-f856-4568-a2b4-dc7bb5b5b08b", "comment": "Malware payload", "value": "deabe96368cbff4c2898829ee5941955137f22c56bc3349abc5567484e30ee92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182652, "uuid": "8a839ab8-fd41-419d-ab9f-e4800d3c12bc", "comment": "Malware payload", "value": "edc5d1fa6811f0eac46efacd7d13df1005724de0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182652, "uuid": "3a500724-3739-44a9-b4b9-21a05773d6bb", "comment": "Malware payload", "value": "0cbf8f162798b646fe87efea34fb0f6876c2d33bc9f5d56d4ee7822185d7022d6b762f9f9cd075e041bb0e0cde20b1b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182652, "uuid": "ec413935-94ea-47ea-a961-663f3078a5df", "value": "T148236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6ACA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182652, "uuid": "ea46df81-f4a8-42c2-bf55-5cce9d475ac5", "value": "768:Cr9NyXsZztCl9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:MHusZ3cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182652, "uuid": "6c0b3175-e5ac-4d85-b4e5-0bad2fdda487", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182652, "uuid": "f698fb08-c4e0-4b7f-aeaf-26c965ab11c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182652, "uuid": "4fa805a0-3fb9-49ef-a369-beb7925cf86c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e07731-80d9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784180552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180552, "uuid": "a8224e82-0b08-4638-8b38-c11cc6b92b9e", "comment": "Malware payload (Mirai)", "value": "a02f2d53923fbd5f69b969a88f4fc81b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180552, "uuid": "3e496999-a797-47a0-9287-01f80430698d", "comment": "Malware payload (Mirai)", "value": "e03eafa0a6b96ab822eaf4a01f3fcac091d5c4918f2a3661fbdc9fc6963751cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180552, "uuid": "505438cd-058e-45f5-91ea-949eadada2ce", "comment": "Malware payload (Mirai)", "value": "799633d7719d99a64a26fae377fab2ec64635493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180552, "uuid": "8ba05126-8530-44a7-8f64-24dafec87183", "comment": "Malware payload (Mirai)", "value": "7c917a7adc7db69006db478d0fc6be6cdf0dcddd3e56505e79fd25435e8008ce539651334107b7ba826a828ed2ebe1f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180552, "uuid": "db2ac397-49d9-4bb9-a432-8ac01ffbf713", "value": "T13464C50A7B519EF7D45FCD3306F98B0128CCB45335652B7A3670EA5CB61A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180552, "uuid": "2ad3d6e2-38ac-41b7-95c5-731243282829", "value": "3072:3hpR0vKVliZzYzd4wAT0DGE728ENYjzhnGGC:d0vql+YxrAr78EKjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784180552, "uuid": "e63dc9de-e8ef-4a41-9b57-c07ceb0239d6", "value": 309108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784180552, "uuid": "53fb52c5-fd91-4360-bbf7-f225ac79ae7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180552, "uuid": "0a171997-6b3c-4483-bd94-ef663bfbf509", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f5a493-80bc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784168201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168201, "uuid": "ab42a982-eb9c-4816-9008-78ab16cd84ff", "comment": "Malware payload", "value": "b11466c37917ed4b0537cfa7d425de6c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168201, "uuid": "65e6ee51-43fa-43bd-9d45-94382979bf41", "comment": "Malware payload", "value": "e07e535830825db953ee7b0231139a4eebd8333ac7e36383a196abd4038f757e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168201, "uuid": "899f1a56-035b-4b3f-ab53-b63024434ce1", "comment": "Malware payload", "value": "15c6d129bbd1eb8410321159d0ff1276c9b6b31a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168201, "uuid": "f5644917-c6eb-4cfa-9efc-078e39c20d1d", "comment": "Malware payload", "value": "07d7bada7b2c8c9f48ae6449e809cf7ad69bb11eccf5935860be0301a29a3c3a54b575084e7f4c6c47ebeeade88d9938", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168201, "uuid": "17476416-ce2a-4ba0-b595-38080d6c4d7a", "value": "T1610148C64A40B910406A9A5E22D762A0B811C3CE459A4F68BFDC9D3EFB98914B027F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168201, "uuid": "90d95a58-a51d-425b-9751-1d27682e455b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkan+CosuVCN7Q0FCy/qks11CdTBECM6NauD:kXCKysE2hi0ziQvZoha+Rr0FD811fY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784168201, "uuid": "a9fac7df-699e-4996-a0a3-21a93d097f40", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784168201, "uuid": "966c6a44-65b6-4cbb-8375-2795bd834b04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168201, "uuid": "343cc72f-287f-44e3-b937-4d2650dd8bcc", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb4ad15-8168-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784242334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784242334, "uuid": "37f0d3c5-b2ad-4dac-a5c8-5ee46dc474d7", "comment": "Malware payload", "value": "6d654ff7d5fe7ae5039144d634471777", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784242334, "uuid": "1fae4fa9-121e-48f3-ae2c-8feea4178d20", "comment": "Malware payload", "value": "e08f40dadc8149249e559bf08d2506a67ca843783bb674a0d86858adf5d37ac9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784242334, "uuid": "a1d5254b-1cb8-436e-93b6-c696c8089840", "comment": "Malware payload", "value": "9b855b07fb91d17e6406b5dcf39d525ed851b402", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784242334, "uuid": "20f4b03c-fdad-47b5-aafb-57426719850b", "comment": "Malware payload", "value": "7ccea2193b0d0f1bb876401e31f21cdae86ca6ad6abb9025e3d3533181e15cb5f4b01d0f4c07b3490a55137f2d6b16fd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784242334, "uuid": "e0e47764-fd1a-4456-bd54-d2341e63cfb6", "value": "T192E633143ED501DEEBB7813CF9E19656D4E0B8B40B31C5DFABA45A93BD130D88C3A296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784242334, "uuid": "5517c292-1ae1-46b3-a86f-fbf033488b09", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784242334, "uuid": "225b98bd-d4ea-48c7-9007-28ec97250610", "value": "393216:uwTxZ5TkWzwRxrWoIRXMCHWUjXdFcuI3/PGTAI:uwfGWzwnao+XMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784242334, "uuid": "d52da4c8-2916-4fe7-bca6-d3a5b0549356", "value": 14309804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784242334, "uuid": "1f470458-f201-4b3e-a0d0-c354aca336e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784242334, "uuid": "3b91c058-a81c-4a7a-a67e-cd8a524d7bcd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b1f196-80e7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784186917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186917, "uuid": "3d6b462f-0f64-421c-b4a6-e1815ee03faf", "comment": "Malware payload (Mirai)", "value": "d862eef931a3114d552a2cfc910ecb35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186917, "uuid": "a20c5e07-9f87-4113-b3db-fda409d4ba01", "comment": "Malware payload (Mirai)", "value": "e0c521df789a821405414ed3b0a6e081af2a0d3c26e64d002aa631fd19bac0ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186917, "uuid": "6b71de58-7c6c-409e-b9ea-4a96e798e73d", "comment": "Malware payload (Mirai)", "value": "ed0af2cdc0a0a79514cef1139576fde07476046c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186917, "uuid": "7bbd639b-d228-4467-8f94-42ba7a4f75e1", "comment": "Malware payload (Mirai)", "value": "fe48764d416e681ccc3f224bcc4274d412c392f320f75f50d5decaf02fba362fa08dc7955354cf3dbdc5d3da70bb05ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186917, "uuid": "5a5fa12c-8273-4286-bfbe-5c8eda3b7cb6", "value": "T1C1040642E683CFB7E55310F101F787211A31E83A6D66C442E7B9BCF4AD61AD1A61A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186917, "uuid": "e34d85de-0ff7-45be-8f98-6ca5de9d123e", "value": "3072:r1slP5mBZDif9UoNz5I3Alm6NiDFXt3sU/asmlIfplp2O:CbUZDiVDrlmh93FynSf52O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186917, "uuid": "a39f3e9d-b217-48b0-b630-731cc3ad6cb9", "value": 188956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186917, "uuid": "587fa12a-c7f5-4e86-8f9a-7f6baebc42ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186917, "uuid": "9490f391-164d-4341-b4f8-bf1e0365aca7", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddeb6c81-80d8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784180434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180434, "uuid": "7e92b02d-364d-45ab-a859-a0c26945c7ce", "comment": "Malware payload (Mirai)", "value": "47a36051ffeca33d9942ea1e09d9834d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180434, "uuid": "8e803c68-157d-468e-b5f6-3639a2671d9a", "comment": "Malware payload (Mirai)", "value": "e0c914622584ff9e317ed2485bd1edebb9fa8bebea298b9563717ecb4b32f95b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180434, "uuid": "0ef08c01-0b76-4306-b380-af44810eb259", "comment": "Malware payload (Mirai)", "value": "654d52bdbb9ed24e7be0f5b05ad9af2bdfd19f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180434, "uuid": "bdf06337-0d53-4bc2-9a43-ea7e02898774", "comment": "Malware payload (Mirai)", "value": "829dff2abf46ad19073e8fb5c08776a52ceb3ac645ee5f1c06bb5f209dbb475b4d55eb968a896dd3b65908cac2ae541a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180434, "uuid": "5373c978-0314-43f9-a587-d376e3e02915", "value": "T138648A1A2E22DF7FF66D867047B789305A9872D63AE1D584F16CD60C1F2028E641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180434, "uuid": "83292db6-b498-4597-9e1e-acbbf4710410", "value": "6144:TGLtUg/hUcefgegN5WK+DxKXsO1bgkgiirjnUR2:AUceO/WNKXsNjnUR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784180434, "uuid": "7072bfab-8e24-42d7-b2b8-5f3c7b5a204c", "value": 309076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784180434, "uuid": "0e69bb2b-e0ff-4e0b-aeab-c4d64ca091a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180434, "uuid": "99e85a12-8242-4b6a-8133-b333680be335", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6da28cb-80e8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784187268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187268, "uuid": "9dc8e4e8-287b-4a81-9832-51b8f2e3da7d", "comment": "Malware payload", "value": "9901618613f960e1081a467db9ec9408", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187268, "uuid": "4d9cbbbe-b086-4c88-8fcb-7b47a939f2e1", "comment": "Malware payload", "value": "e0fc5081765004587b52f138877494585239c7516affb3eaf530a07ce8bbbf23", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187268, "uuid": "10da30e2-8068-4324-995e-b3e72018a670", "comment": "Malware payload", "value": "66c3cf918d9a591505b5c460d1cee49aa7e73515", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784187268, "uuid": "27f39251-12be-4be3-b4fa-2a522895d317", "comment": "Malware payload", "value": "3d495b1234df094ff105b25857f35e57dc66a50d5b09a1cefbdeddb5f5da2115f7fe2c0f702c099ecc766e7c9d6973d0", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187268, "uuid": "7fbcd070-f645-4d1d-a038-c024ed655f13", "value": "T1C47533DB5EC64107E64808F121A478E0DFEDCDE26D6C319AF907AD2CF09964D06E962F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187268, "uuid": "0cdf7462-4fb1-4d26-9df0-e15b0ce2109d", "value": "f19f888c5c0d6f50f7a879abb65862d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187268, "uuid": "0a68d544-b069-4855-adb3-6f96168c3a34", "value": "49152:13s0SDMxwePLQdzXtGftaxQuyZ/skt2W:13qDM+mL8zUaauyBsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784187268, "uuid": "7f5fb5f6-eb3d-4f89-b834-0c1f2bfa8b0a", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784187268, "uuid": "9f58aad2-d951-448e-bc8c-bc9584cd0eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784187268, "uuid": "ffe3f3e9-e1c1-4b08-b3c7-bc302ac1e2cc", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae36759-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185503, "uuid": "96694d43-0c38-4b76-95c8-a3210c95224f", "comment": "Malware payload (PhantomStealer)", "value": "d5f1a48ca987e882ee0e1d308faceb8c", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185503, "uuid": "b6038519-051a-4249-bc98-68c370bab2a7", "comment": "Malware payload (PhantomStealer)", "value": "e1e9123b78f8079feee58629621283a7a971dbd5c3e56c76988c31f5a4c27bb7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185503, "uuid": "fdef499c-300a-47c4-a367-0fbbf2a124b6", "comment": "Malware payload (PhantomStealer)", "value": "03382451df1ed7a503339b0239a4386e92636514", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185503, "uuid": "c3cb27f6-8569-4afc-963b-cdd7ee16bc63", "comment": "Malware payload (PhantomStealer)", "value": "2ead84261e470884ed2b77c5bf63bba1e24e00202fa03e8037e32e0fea257feb1f04003c9174ccb17a92c6decc9f27b1", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185503, "uuid": "b05c5e9f-045c-47cd-be24-1912144b01d1", "value": "T1C982651688058BF0DA693665A57F5437D910C3A1B43C28CAFC8FE39C3B76BD48BD50A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185503, "uuid": "f533de27-bab2-47e8-a8c9-4a1607b2adcc", "value": "384:Ka8/0fZAo9f+aZbZXfooyvPPxUy+y/vFHmDQI+Af/ubSNSHrU7A0:KFs60fl+xdc/Tkb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185503, "uuid": "149e479c-fde2-40a2-bc02-338a99d9d106", "value": 18967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185503, "uuid": "624a7cde-1ffb-45f4-b1fa-bd2b7d015e0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185503, "uuid": "57f5da2d-0105-46f5-acdf-0cd1fcef1765", "value": "BK10560228.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f011d58a-8117-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784207523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207523, "uuid": "4a93f8e0-c11a-4e34-9f07-c84c4f331d6c", "comment": "Malware payload", "value": "539e8efb812e73c3988329281e94cd96", "object_relation": "md5", "Tag": [ { "name": "trinitycertificadora-fun", "colour": "#0EA713", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207523, "uuid": "2c3f77be-0f0d-47b9-a4fb-e06e7740c350", "comment": "Malware payload", "value": "e22bdb25a2d6a380bd38b3f34b90fcd34563308808c97f807bd8b2ea376cc5dd", "object_relation": "sha256", "Tag": [ { "name": "trinitycertificadora-fun", "colour": "#0EA713", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207523, "uuid": "57c5f1d3-e2f7-4418-b16b-900ec77745bf", "comment": "Malware payload", "value": "2899d9e8934c1f9f336481a274c4772732627bff", "object_relation": "sha1", "Tag": [ { "name": "trinitycertificadora-fun", "colour": "#0EA713", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207523, "uuid": "6d3b5489-124a-4fe2-9caa-586ee2dfa377", "comment": "Malware payload", "value": "12bc11e1acff44f497ef55597239d3b926946b3674f1e8b0fa647dd3044d891be0db10a4846947928e3e30bcc96a8d71", "object_relation": "sha3-384", "Tag": [ { "name": "trinitycertificadora-fun", "colour": "#0EA713", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784207523, "uuid": "7e226f6f-6e9b-4a37-8ff7-81af6954462e", "value": "T1A7C2CA3DCC7C013FC2B7D22DC98E8A07E9925D1B672CED4660D7739A5A13143B89226E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784207523, "uuid": "2bd6374f-adf0-4ab5-9d0e-00c6ceea2a94", "value": "768:sUnwkoIvJg8ib3IXFXX8tAZTYxL5LG4nW9OBlSwaDxdxflhgbJWmZDsIWZiPSrj4:sUnwkoIvJg8ib3IXFXX8tAZTYxL5LG4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784207523, "uuid": "160779f0-3ea3-4806-9bc2-586fc2a2fd8b", "value": 27878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784207523, "uuid": "ff44e730-1bb8-425e-9d0a-c69dd50450ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784207523, "uuid": "edff46be-cca4-4889-ad39-65795041d260", "value": "NFCe-gtin_0f42965a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beb54e0-8142-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225609, "uuid": "1c7dbeba-b234-4e58-9e57-588d598a8f6a", "comment": "Malware payload (Mirai)", "value": "f0f941a53a2e761d4d066e74aaf9210e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225609, "uuid": "9e4166e2-ece5-46b1-8227-e85891928eed", "comment": "Malware payload (Mirai)", "value": "e443f459ac9a3c2882d26aee682d4608893df1c4a59f782687236100ec0eeb11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225609, "uuid": "1c599be1-7b96-494d-985b-6271321f8c9f", "comment": "Malware payload (Mirai)", "value": "1f706712992ffb43256e6013ebf432a03e5a17d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225609, "uuid": "680c26b1-66d7-4b2b-a24f-eb09592c3b43", "comment": "Malware payload (Mirai)", "value": "71863e04c38d4de7253e684a0ddb7ddbf074d9af8b9fa1f8cd30c04e52e5699ec6e3317e307c6e2a8f7c45662e890612", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225609, "uuid": "fc3f3368-28ac-4584-b821-5e6c2db84c29", "value": "T1D7D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225609, "uuid": "b9326dbe-cd0a-4be9-817c-4dec2965863f", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zp6:xOFgpOEoVv3MXL5NhGOp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225609, "uuid": "c2700890-6ad3-4d40-92a4-63f88b7dad61", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225609, "uuid": "348ae989-0348-44d1-9e99-8649b472e3de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225609, "uuid": "942e0417-af56-43d0-8faf-acd47062b681", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74675a2-80e5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784185953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185953, "uuid": "863bca3d-e86b-43d7-baa0-fcbdbed4855f", "comment": "Malware payload", "value": "4b56c634c89eb7b1d198fb6f078a59b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185953, "uuid": "313f3cef-647c-4410-88ef-00348ba84e4b", "comment": "Malware payload", "value": "e58f10dd738c95b94b7155a80e1deea959acc2ff23488648def4fc17d4e4fe28", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185953, "uuid": "8e43b914-16e8-40be-9e94-751f914a5df0", "comment": "Malware payload", "value": "984bd00761113e6b91eb2c6721ac18b0e13fe7a3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185953, "uuid": "3d850794-7b8c-4a1e-9085-e882e6e97982", "comment": "Malware payload", "value": "9c5daa176841471d8bfa91e23141191e5b752c42c5b08cb5e79d1e918d75ebfe55086d99bf9a9a56b966e2053f026c02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185953, "uuid": "510a3e56-abf3-47de-a46c-145bae107833", "value": "T12CC28E95AA867C44BDC94B3E4CBD2B0D6DF4C3D1324942AC3D8A3C719C16FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185953, "uuid": "e01f3ca7-b0f2-404b-97c6-0666b798ae67", "value": "768:O08vCB+25j6es8Ri9FYpMSUpi+20qUpi+20YQX:O08l25JEd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185953, "uuid": "500e2a8c-fa28-4862-9402-650eed53789c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185953, "uuid": "861b7c71-ea7b-4ab4-9a39-7e6a40428057", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185953, "uuid": "cd0f0e61-1d75-410c-a657-48add8a2ebc1", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d5fa2-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234585, "uuid": "8be6bb38-ac9a-4503-98d2-aadc1d559ebc", "comment": "Malware payload (Mirai)", "value": "36bf4b74082ec8621f9624fb74fae045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234585, "uuid": "c7b078da-7fcd-45dc-b99c-003ce0de2395", "comment": "Malware payload (Mirai)", "value": "e61dd55f7b1854cd5b6a002116da3dd695631d86a17c0ce67e7e531f4df4be99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234585, "uuid": "bdbec22d-5132-44a0-808f-0135d154fef9", "comment": "Malware payload (Mirai)", "value": "615b2e8986813400cae34e9fb6004c9ee79f3b56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234585, "uuid": "a5505155-998a-4f93-b66a-83316bd74300", "comment": "Malware payload (Mirai)", "value": "b3823774f080e1f67ae81f037d25c5909e2710f5ac1708941d5ce907daa897f2b62ee1bd2cd9964f13f2f858163e9920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234585, "uuid": "48d1b382-a5fb-4430-aba3-e08709543fd8", "value": "T1EF23F1B0414169A5E3754D3AC959C9AF920A8F78F67C276093CD531CAE8D60F353CAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234585, "uuid": "8daf0a5d-98a1-4f20-baf5-b60c159c0cd6", "value": "1536:QMxXNRIdJyCQ3jYuLNIeFQPi5IUewU1z2:BJIIs0VoOy/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234585, "uuid": "53c5291b-679f-4b25-925e-ff51f33e01a7", "value": 49280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234585, "uuid": "f15c9143-18ef-411c-9bcf-66cbddf79ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234585, "uuid": "87b0ec4e-b580-4cc2-8497-d97d5b986f29", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ba2724-810c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784202585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202585, "uuid": "7c83a594-e5a1-46d9-88d7-a4c016efb898", "comment": "Malware payload (Mirai)", "value": "a772abb8bd4e1b317c12a6bc6dd69845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202585, "uuid": "7f058972-c06f-447f-adac-8e793725ec23", "comment": "Malware payload (Mirai)", "value": "e674e67cf98b61890540ecd3cffdec84b8ae177fb5c05c1d62fa5e7cbc0ec47d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202585, "uuid": "3f64bacb-25d8-4aad-9dd8-f14f5ab9f2b4", "comment": "Malware payload (Mirai)", "value": "5441ba7d9f6d32947613ea96f02e7a86599b69bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784202585, "uuid": "32cb8805-1045-4cc1-9b5b-915684e842ef", "comment": "Malware payload (Mirai)", "value": "141a93ec52bc9be5fc2502f24eabcf909582adbe0229e256293de884281c00463bf25f19932ab9cbe582e9f1a5e69267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202585, "uuid": "c7dddec0-22e9-4bea-8e60-54a3d69a56ba", "value": "T101631257FFCC5FA8ECD927F803BAA5CF2661A032547341B80DE29D85806EDB2109788D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202585, "uuid": "ae759156-bc41-4b8b-9cbc-f5fedfbdefe8", "value": "1536:27MbwKNGjjH+Xq34n/q8Zu41zmX3sDgodeZXJrPL:27Mbp2L+Xqdfoz2sVeZrPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784202585, "uuid": "bfbef560-6c7f-4091-bb59-4e8b6b76728c", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784202585, "uuid": "f1a8b959-cb6f-4a2a-86b7-fc96fb239709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784202585, "uuid": "6a7255ab-e00c-469c-841d-55e6918bf5c5", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8156ff6c-8126-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784213780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213780, "uuid": "8ddc2a53-571c-4726-a09c-4ecb88d0ee27", "comment": "Malware payload (AsyncRAT)", "value": "2b46ed6e01f2baae933707d06704d14c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213780, "uuid": "3e845474-44f1-48eb-b6af-d91d4fc490fa", "comment": "Malware payload (AsyncRAT)", "value": "e6d51d45edea7591b826b2d703c20a426fffa27a022c0156916ae9c35245bd07", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213780, "uuid": "d443b3f9-7612-4e93-8c17-5dad4d4700c8", "comment": "Malware payload (AsyncRAT)", "value": "9b225681a471b474fde2cca61ff61498a7c7f9e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784213780, "uuid": "0d7dfd28-3425-4ee6-98f3-af6df73d4025", "comment": "Malware payload (AsyncRAT)", "value": "3ff07faa26ad0de55e21116daf4c1103ddf99d3349da68226fecae7a0ebf40fe880c9765adf2e50a3fe707d87a17325c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213780, "uuid": "0b77a703-123b-4751-ae79-b02777556958", "value": "T1BEC22B0833D8C672D1FE4ABEC83385009779E55B9923D75A5FC490AE29237CD8A18FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213780, "uuid": "bf2c4ba3-010d-4d3d-940d-61d7f05e87f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213780, "uuid": "02ea49aa-195a-4e6d-b859-37768d7fbccc", "value": "384:/gSVEEMiNPWmeOsVa/KFHbh0yH9qbuUscCbQxnCJfJBndnjJVKym:/gSVXFg1VDHF0wIb1BBiBnEym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784213780, "uuid": "6bb324e2-becd-4d3c-949f-c2d5d94c7305", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784213780, "uuid": "ebed2cd7-3d8a-4eb7-8264-cd3a5c8c293c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784213780, "uuid": "204757d0-9dac-4aec-b566-bc288a3968f1", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f741062-80bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784168626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168626, "uuid": "6ac8d4af-c995-4454-8013-08629bd36940", "comment": "Malware payload", "value": "4aa2449edd6e5a28fc88f8007144b059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168626, "uuid": "3c72ac11-ae31-4057-8b16-0ca9c35ac169", "comment": "Malware payload", "value": "e82f6ae11ddfaf06b82738aa2f499d4cb8476ec7914efd9aa16bdf520ef90539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168626, "uuid": "f52f8204-8f49-4ac9-a178-bffa8b187b20", "comment": "Malware payload", "value": "efc8c213ea63a6d534def60507fcffa14693b3c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784168626, "uuid": "3f9c60c5-93c6-4460-8bdd-a3ed5ae793ac", "comment": "Malware payload", "value": "5e29342a5f6c410d5182464deae222dbad05752baf9bae3a36e8f2e64ce3be03e6968d9599b80a9c932f07d542515c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168626, "uuid": "63b23d92-f194-432a-b4d7-d3fc9e3ecddc", "value": "T1CA273388ABC5087BC8D2727D69BBC952E3966C550B2188BF0B90273A3F774D58C3975C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168626, "uuid": "d65bff70-108f-4baf-abdc-26a228e9e924", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168626, "uuid": "5c80deb3-8ea9-4345-8279-5cc398203ab9", "value": "393216:AqzlNIZ37UJ32eivEoxy8etBnKurNtZq5Xm86A+7EdZHsxtEDweLEiGRlCo:AqzbS4ce2s7t3rNtZq5W3AO49wt7eL7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784168626, "uuid": "96e5f808-7c18-440b-bf6e-89a2ebe6cc6f", "value": 20876312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784168626, "uuid": "60a6480f-1656-412a-a1b2-d6a2307c5b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784168626, "uuid": "01a5cef7-14d2-421b-a924-0b5aa6dbdea5", "value": "Realtime Protection.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfa6c7d-8163-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784239920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239920, "uuid": "350f2730-ea77-43a5-831d-54f08af77c62", "comment": "Malware payload (Mirai)", "value": "8a7f6dc2f9d613539b63583cb943bd0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239920, "uuid": "c5a4d0a0-b23a-4f60-89d7-55b49493debc", "comment": "Malware payload (Mirai)", "value": "e83da6e7d86f4715200b84427a1aa7c2d4187f48af70ef0ee024caaf36428809", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239920, "uuid": "18ace28a-3345-4f35-a067-802e312b23a3", "comment": "Malware payload (Mirai)", "value": "443734b8be442aff8c5208741feb68ada2f0a55e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784239920, "uuid": "731615f1-3384-4b17-88be-18baa72508db", "comment": "Malware payload (Mirai)", "value": "90e62951de4bb9be5b9dc0248c2d35d7caec275624c8e8e525534a701cb5e242d3fa241fc0d6361c805ee63017e259ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239920, "uuid": "27ed4f0a-e7ce-4820-9c5f-5cc6e9ffcb82", "value": "T18E934B46B892CA56C6C562B9BB1F818C331613F8C2EB3203DD15AF757BC795A0E7B580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239920, "uuid": "02cd389a-a8cb-48c3-be90-34fd988da5dd", "value": "1536:cFYpbANKE2e1iMUcbHTAQw51LktwZWutXvrCYNRQVMxVesKJaXcm6EoqfQL1:cFYpbANKRe1iMUITAQm1QezXvrnNmyxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784239920, "uuid": "5da7e318-9841-4e50-ba4d-de0d1d5f5648", "value": 91592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784239920, "uuid": "a4b911e5-a0c5-4712-8046-d68976f59fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784239920, "uuid": "7648eb64-cfc9-40ef-914d-3abdaeaa781e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0e2d8e-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185451, "uuid": "e3e8511f-bcbd-48b7-afea-c8b043dd1971", "comment": "Malware payload (AgentTesla)", "value": "01e38cdfb2a40237f5f6657a638c35e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185451, "uuid": "e5e95b3e-c36d-4050-b0e2-057e6c51a00d", "comment": "Malware payload (AgentTesla)", "value": "e89471b2cadeac309aafcfd360adcdbe0c923599a0043307fab7128e55c092e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185451, "uuid": "ed19c6b7-8992-4521-9879-2e2632ea82bc", "comment": "Malware payload (AgentTesla)", "value": "d66853d20cfa89272814ea095008b1f385b52b21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185451, "uuid": "f4517ec2-b4af-4ef1-8298-71b1a458bf33", "comment": "Malware payload (AgentTesla)", "value": "d4046852c0228ec396634a756f0da7fdd1dd9af32b6804d933b11e852c50c57487b8d64634c9f06c92e1d65f8881d9aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185451, "uuid": "6a986c5e-a84d-4f3e-8422-ff9039404524", "value": "T17265F1244FC42FBE8BAD0A19D07E266EF3E146C91466ACCAEF237E456FBA7005117174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185451, "uuid": "5625e875-b1f6-4874-8ac2-1627fd88b475", "value": "24576:bFS1WO4Sjff6+pSMDUzJqm2HcjE6Vb2ipgTgyrCKQrXKe8:pSPK+7UDgc34QrXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185451, "uuid": "64b6ac5b-0747-4ec0-ac73-1971ad25166a", "value": 1500114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185451, "uuid": "6fc9acff-fbe0-494e-8e04-bb53fe39692c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185451, "uuid": "8fb82e6b-352c-4096-8fd9-a5b421356e7c", "value": "040 REQUEST DUBAI ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69cf4b6-80cf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784176476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176476, "uuid": "bb6653d0-eafd-4068-9c1c-c1772e304ab5", "comment": "Malware payload (Mirai)", "value": "b5f1d9365197d0956e95c03deb6817ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176476, "uuid": "b896022d-b0f3-4984-992a-e26cae950623", "comment": "Malware payload (Mirai)", "value": "e896eb9626843f02ee7190928f74f849d15bc0a4f92623b1a7f10164d9eb226f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176476, "uuid": "360f2e40-9709-49c6-8d69-b6d4a2c805ae", "comment": "Malware payload (Mirai)", "value": "9a97b8f337f7dc37c5e48874a51f73bff0eb99b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176476, "uuid": "cb768a3c-de6d-40be-b175-64bb4d9c991a", "comment": "Malware payload (Mirai)", "value": "4baadc05a3d0c013944940fb6cbc6dd1b685f8ca5547af0603e44d2f4cd14cc1662abc63551495cea0077332381822f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176476, "uuid": "28b6005c-decd-48c5-b2c8-aaa940dde669", "value": "T12C146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176476, "uuid": "f9814c41-8585-4e34-99bb-59fe027204e9", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtg:BZAyFzQSdS7IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176476, "uuid": "1750dd2d-c2a8-4734-a672-22668d7e1a2b", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176476, "uuid": "dade7375-7ab6-456c-ae77-1dfd2a3f3d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176476, "uuid": "a3896ce0-ce17-4a03-8be6-335823e4ac27", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4646a289-80d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784178892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178892, "uuid": "4b60c61c-60b2-44d6-88c4-a60095b3c200", "comment": "Malware payload (CoinMiner)", "value": "4d425d7077114c9ba107ad0fcddbbcf5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178892, "uuid": "b004ffdc-54f4-43db-9a0a-9102255542fb", "comment": "Malware payload (CoinMiner)", "value": "e89abc340823248d1b4cf2e51eaca79348516687f9acce270d1ca165c503153c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178892, "uuid": "6fade6db-f05e-43f8-80bb-6117ed4e638d", "comment": "Malware payload (CoinMiner)", "value": "8be95144c47a479ad1279ae94d60e46fe9737de5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784178892, "uuid": "314410e7-bd28-4dfe-8e81-be990401b8fb", "comment": "Malware payload (CoinMiner)", "value": "9c3dac38bf6b1d825312442a6d6bc1bfad682089ea9b1df415f06d4b5cd5359dbe51eb5dc14d484ab4f81743448ad92a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178892, "uuid": "a80232eb-899e-4c37-823a-af13b9a9de8e", "value": "T18C167C98ED0F3912F3C7E23CCF4A97E172173694E32390B279D2524DD59E9E4C6A2A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178892, "uuid": "bba48441-66fc-467a-8dc1-d8a86851dc0e", "value": "98304:Mlhy5oGJkjn1xFotmlBPTyYTgV1+XKL+IFaTO:Mzy5oGJW+tm3AD/iO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784178892, "uuid": "fc8b37b6-b7f2-46fd-a473-aee2cfcfaf2d", "value": 4199888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784178892, "uuid": "0dc00d9a-c6a5-45ed-87e3-97c4d5b45c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784178892, "uuid": "a2cf4fde-f25d-425e-8435-981c89b0b2e5", "value": "da876a12b32267fcb7f43ae01636016b6bce497cc6773c3318072d387c883a95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98099c3-80e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784186467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186467, "uuid": "ac077f38-1af1-4f63-8457-63d916e13c98", "comment": "Malware payload", "value": "19659624f5327852b451e55d42f10814", "object_relation": "md5", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186467, "uuid": "106b741c-54a7-4586-8383-5eb5e6a92d61", "comment": "Malware payload", "value": "e8a4f2026d5aac1b74acbf7033ea0ec626055d3dbf5d645c9f741a75ad17ea37", "object_relation": "sha256", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186467, "uuid": "8a124422-7547-4d1c-8573-ee7ff1b783dd", "comment": "Malware payload", "value": "fe41e0792240db27a1068884baf31d9f8971a50d", "object_relation": "sha1", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784186467, "uuid": "b1068164-c8b6-4c27-ae5a-ed5f1954988e", "comment": "Malware payload", "value": "74f29e07168f16c40d17972418eee8421b34325881cce078390671885c5d7214f67a18d4fd6607f5886ccaf0c965f157", "object_relation": "sha3-384", "Tag": [ { "name": "154-82-93-206", "colour": "#5869E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186467, "uuid": "d3706d82-bc6b-4426-8dc2-d8020ff6971f", "value": "T1AC15E01CD62D0D2EDA230EFDD07A48D6D12AA5E32AC7402737F589E786D3398508FE95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186467, "uuid": "a0e318e8-f93e-4319-9938-35becce561fe", "value": "ee6041d13476b06f8c7d1e541d5bd342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186467, "uuid": "53ddc1ca-332a-43f8-9f03-a7b03bf10caa", "value": "12288:zLAjMiKK1sILWWldMs9ZFdIW7NQCfaSUPinvmPFzLdJ5tMo2uaTcIoUX6mdJY9S4:zCRTNnaeQCfDJJuUKSJCSXUGQn4/uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784186467, "uuid": "0a25abf0-fb35-4adc-85b2-b104ec564cda", "value": 923372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784186467, "uuid": "2f33a93e-624d-4a8d-90ca-46e9d0c6ab5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784186467, "uuid": "41f5add1-58c4-490f-a6d1-0d86e4b012fd", "value": "netutils (6).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff55768f-80e1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784184356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184356, "uuid": "3ecab3c3-9f3e-45c8-a221-f84df6cee75c", "comment": "Malware payload (AsyncRAT)", "value": "fc8e887dd140b4b7775f1ab374de42cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184356, "uuid": "5c36583b-e576-4a46-b8dd-5937e2a005aa", "comment": "Malware payload (AsyncRAT)", "value": "ea326b9f3adb615c5b8a6c89288227ece1d29fc30dbfb4500d98c15c33bed6f5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184356, "uuid": "a58fa785-02fd-4902-a0fa-ff7f78cd8bb1", "comment": "Malware payload (AsyncRAT)", "value": "c8397dd8d76bd715f479acd5c745bbc741c6c760", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184356, "uuid": "eccf228f-a036-46d5-8a70-ed0c0d4d78fd", "comment": "Malware payload (AsyncRAT)", "value": "72911e369d13820d85fda9f431c3731c31c80cbeed0c99b49914919f6e89b71788333ab4bcb3e352333cc23fd6b388c1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184356, "uuid": "0a89fca7-7c64-4054-98bd-5ce549951c07", "value": "T1EA846DC791A69B527F0878CCCD0B67DE6D38B99D97C975F03EB643247614C2204AB8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184356, "uuid": "1b85a69a-ff46-49ff-85da-abafc91d3626", "value": "6144:DO0Ms9CFVmJ7QAy/zirFhFQlH1RpQgaQ2PakWr5QXHweR:6iCFcE/ziZQp9wQ2tK5QXQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184356, "uuid": "706638b1-01f8-4874-9346-5332d80b2a55", "value": 405550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184356, "uuid": "0621d667-8c9a-4068-a5cb-5f247b44cea2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184356, "uuid": "045c19e3-562e-4d5d-8984-a2bc50985462", "value": "SCAN DOC FILE PR 000100265.QB-.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37202bf4-80ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784162116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162116, "uuid": "634f28b9-aa53-41a0-b831-f1602d97766f", "comment": "Malware payload (Mirai)", "value": "1712b2e36a627bce50ad80a96d4c7e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162116, "uuid": "6bc96f1b-c8f4-4355-b7cb-846c7cb3b25d", "comment": "Malware payload (Mirai)", "value": "ea5ba796713da55899f9cc3dc8daae7b4425f2a73058b9abff60e9922af60924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162116, "uuid": "c5257efa-6860-4d97-8220-de66beafddf2", "comment": "Malware payload (Mirai)", "value": "e9c525a80ffd3ad877bdc7e6db707803c34b7e86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784162116, "uuid": "23f68cf9-c8b5-4dde-87cf-01970b686e6a", "comment": "Malware payload (Mirai)", "value": "0d1e96e8ffe1edfe04aa2d1b3e5cd7f25c79ac32d974deae9614ed5182f6da1d4697d32089372853651d51c813ebf424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784162116, "uuid": "ed8f6901-6952-4bf0-a987-d2964e372b36", "value": "T1F0C31995B8929A22C6D216BBFA0EB2CD772633E4E3DE7117CE145F21338755B0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784162116, "uuid": "17cae43a-f492-45f2-a74e-f3e65d90843f", "value": "3072:kHZ1GBF71ofGPWT5w+CKiE3Ecg0EAFnbA:kHZ1GBp1yl5EKL3E5ABA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784162116, "uuid": "dbfb6ef1-70f2-41c2-bc5a-858e3ed005e7", "value": 121108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784162116, "uuid": "e0471691-225c-40c4-8ea3-1e2ec6f572e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784162116, "uuid": "c44a61f6-170b-4fed-9f30-191d5cd9ec67", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf91a9f-810f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784203705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203705, "uuid": "44263799-77ed-426f-baea-de6c392ba790", "comment": "Malware payload", "value": "182ad537db5e1c178cdf56d1c5c9704b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203705, "uuid": "b69bbb70-e39b-4fcb-aa02-341796479db3", "comment": "Malware payload", "value": "eb733ac91dbe7aa60f5c355b1c1f895b66613a6dd9389fbf6b504c433bc2bb59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203705, "uuid": "c8c646bf-4a01-4733-83e4-a04ead47aa55", "comment": "Malware payload", "value": "e1f610a0484348b1c616b2b47d3769defb5876fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784203705, "uuid": "38e8f7df-9af4-44ad-8511-91d2dc8490c0", "comment": "Malware payload", "value": "08ac5277a5c5242926e9f8091c04eb19159db1290eca795f856301f252c8c045f13f471791e85bbf314e39f425a69944", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203705, "uuid": "1d206762-9018-4d2d-bed6-d41c073a3a24", "value": "T132236C6526857C15AA99C4371C7E2F0CBDAD43E6320452DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203705, "uuid": "ab3b3559-2b59-43bf-a681-e3984d02fd4e", "value": "768:Kcsr0a1ldl9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0h2cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784203705, "uuid": "a32f21fc-5f5e-440c-aeff-a4f0e0bdebe1", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784203705, "uuid": "5292b424-ff58-4dbf-ad23-b6e34e793e1b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784203705, "uuid": "819cd58f-fbbb-4804-be26-bf423bb04a36", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc7a7e3-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234581, "uuid": "770b0260-8f81-46dc-af33-5f10f05affcc", "comment": "Malware payload (Mirai)", "value": "2b1e72e663761a93b1e2170458aad311", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234581, "uuid": "2e7f93fe-0dbd-492a-8eea-c214b8e97486", "comment": "Malware payload (Mirai)", "value": "ec0f07264455354fd608b7c4e0244014b9250dea8b75458686692b37efa97fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234581, "uuid": "7643e409-9f30-4f86-9cab-33a37c166565", "comment": "Malware payload (Mirai)", "value": "a39b9a7eefbf88163eb21d0caef5fd42f997cbc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234581, "uuid": "83386502-eb6c-4b1d-ac6d-013476ac52ba", "comment": "Malware payload (Mirai)", "value": "2e01620ab42f8c0723a3d7804492852c85fe611b9e029b735f748fd5f08fe5cf747ef998c2cd92e1a7e7ab8018e90a38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234581, "uuid": "99d29f9f-750a-4465-ad12-9ca66747a21b", "value": "T17AE2E0A20E80DD94E7704C79D629C5C6235A52FE86E3377A1D3283A19BC0D8ED07D799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234581, "uuid": "85952485-fd69-4f12-a689-563526209f74", "value": "768:oZ+UYV6XVBdBxiVmndBBxDRKkdXTBUH7LVitmzs3UozRf:o267dB0mnjBxVT+bGz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234581, "uuid": "cec3f0bf-659c-4ece-ac64-a1145cb3bd4f", "value": 32892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234581, "uuid": "53099290-6277-49d7-a5f3-b574889d8786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234581, "uuid": "e1213cb8-899d-4cce-9fac-5315b9f5f23c", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ac496b-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784185227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185227, "uuid": "81dd5be3-3686-40ec-aec4-39fc48d11092", "comment": "Malware payload (XWorm)", "value": "040ce262edfb484c3480a2df167b5759", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185227, "uuid": "726b1688-0651-4097-985a-a395f039e572", "comment": "Malware payload (XWorm)", "value": "ed2589d688255e2edb8f2316a8bab3f8e2fc88619a8226041f800c1551dafe6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185227, "uuid": "a076bd48-d070-4682-9fad-7582a25c7c57", "comment": "Malware payload (XWorm)", "value": "6dacc5c04436fbba34981e551af607c92a979583", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185227, "uuid": "efa15f3e-c804-4fd5-aaf5-5b3a198c403e", "comment": "Malware payload (XWorm)", "value": "453bd7de79d57d02526ede48e94c9cd7aecedf727c482bfe8a207680ef1b7e37766adb6fa279b42627d58c8bb91d5dfc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185227, "uuid": "929bf498-a884-4a5a-ba5c-c7305357196c", "value": "T1A275BAEEB77A2C9644F9DA3F7E2B2114E6A804572C87097A7CB257C0DE3304846B6D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185227, "uuid": "29fde75b-6ec8-4f30-83c0-f1787dd6d04a", "value": "96:KGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGt:q3ki/bCqK+ObeCsbYPATvX3FX7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185227, "uuid": "9c31beb9-a34f-43b0-b182-e5e5fea5a690", "value": 1566561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185227, "uuid": "bc2bdb08-9042-49f7-8ef9-efaafe978f8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185227, "uuid": "55b38bd2-1d17-4acf-9bee-7d4bbcc35e70", "value": "payment Notice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8605cc70-80fd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784196178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784196178, "uuid": "b558f7ad-0e1f-47e2-bad0-4cb1b4236327", "comment": "Malware payload", "value": "8dc59182419121f3a82f5c48b813eeed", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784196178, "uuid": "5e6474c7-8fc6-45f9-b40d-46b35c9d5f37", "comment": "Malware payload", "value": "ed2c4429cf27e19aa6881d86bc5b42c21470525564fc53be688b9b26c83db766", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784196178, "uuid": "de990353-a353-494e-87db-b0f03993f370", "comment": "Malware payload", "value": "4113104171bc73542f5ef260d99cedb63144f55b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784196178, "uuid": "834c56c9-2afa-4d35-bb44-90cd08742260", "comment": "Malware payload", "value": "8954131572f07dd276aa540c9ae8075830fb8d0681fbc37d8b64fcf566e6b839d4b6e1389d041ac59edc0386ead469fe", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784196178, "uuid": "132f8129-e287-4b03-b70d-15060e7fcb39", "value": "T173215B3A0F036E2420176561C9BDE429C52BD96B0B309B453A8B3ECDB1CD1CDD5537E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784196178, "uuid": "fbfb57c2-4826-48ec-bf3a-0552ab70abea", "value": "12:wbYVJdofAAUfAAaNZj9ZrfAAffAAaV4UZjtAK/3zAWhpcjLn/EPC23RW+RWeK/3o:wqdKokNFjZk4UsI0Whuj4PlNIlWhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784196178, "uuid": "98466cdb-9e97-4b7e-ae10-6dbc6f1da89a", "value": 1420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784196178, "uuid": "a68009e9-7246-4728-9ed0-b6cb1886ba03", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784196178, "uuid": "b7aaf61c-1877-499f-8efb-7c127649ee75", "value": "ed2c4429cf27e19aa6881d86bc5b42c21470525564fc53be688b9b26c83db766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf06909-8133-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784219435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219435, "uuid": "dc1dcd71-e18c-4bd2-934b-ff05c41661dc", "comment": "Malware payload (ValleyRAT)", "value": "56ff460150b3ddeb5f1a01495ab44ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219435, "uuid": "c7a5bf5a-c06b-476e-9c8c-40cbd529493f", "comment": "Malware payload (ValleyRAT)", "value": "eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219435, "uuid": "897bc781-e2f2-4072-b2fd-9c06216067ed", "comment": "Malware payload (ValleyRAT)", "value": "b524c7848c2599868c1a39d57f4bfb261d194197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784219435, "uuid": "1aaeb1b2-7b0b-41b3-b478-a544dd9e69bf", "comment": "Malware payload (ValleyRAT)", "value": "087968d5e696d9f201397a449b773e635aaac93767120d8992d31c7417e81470528b0b2c73935afb4971678c81d19871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219435, "uuid": "476dd07e-cf63-4d06-9ba4-cce53d0e150a", "value": "T1B9E78D0172A54AA1FDA23B7186D81727EF3ABD3157B648973E0C2BF20F7A3154A27711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219435, "uuid": "fa73d211-7b7e-44f3-b5b0-56d6644b1380", "value": "d3f487c6c23e9d9845b2eca3fbdd93dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219435, "uuid": "392fc4bd-8cf3-4009-ac29-95520abb527e", "value": "393216:wyXTDculw3aURH+EIXBYNitrgaFa1305l/9CidVeJoqaQKiYq7eSdK0ngpk+HcMG:PQRErYd7Pt6oW2p5VyzIT9WAHN7AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784219435, "uuid": "8336e122-fb48-4333-98ca-5c9ec66f1c6f", "value": 67161922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784219435, "uuid": "384731f4-d331-4334-818f-c24093f549ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784219435, "uuid": "1d62f7c1-d8a3-4c66-abe6-569e4bb3d585", "value": "DeepSeek_v4_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657f62fb-80a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784160046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160046, "uuid": "b6d569f0-5b58-4654-9295-f7958c15c6cb", "comment": "Malware payload (Mirai)", "value": "c642753744083d1f4cc54769140d7b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160046, "uuid": "1b9ce97b-cad9-4936-97c1-626493aacf15", "comment": "Malware payload (Mirai)", "value": "efcf0e27b47bfd418d6ea526fbf7c2a7d4a0edaa6523b99b93f04e42a91ec9d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160046, "uuid": "fa9ecadd-7748-4599-9f23-6868727ae75d", "comment": "Malware payload (Mirai)", "value": "3615e260cf3798d5f0e1566b5027af56eaca07fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160046, "uuid": "33320875-4960-4354-87b4-9f288cad1390", "comment": "Malware payload (Mirai)", "value": "713f65c962b1595fe67a9ef25a3ae9c68dd8d226752f83444fb0c662320b0466a83c64bdfb12e87bc622dc68ba75d61e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160046, "uuid": "891b336d-57cd-4c42-9fac-f2e8451278d1", "value": "T1F9A31955F8919A26C6C116BFFA4F82CD372663A8E2EF3117CD19AF20378746B0D6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160046, "uuid": "362982b7-1b1b-4693-b235-f7b4927d90d1", "value": "3072:5icoQtNYGZUbQ50ruKxlAryJsQE8zIn55:5icoQtSyx5olAuJsWzG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160046, "uuid": "1e956111-b129-4997-a1af-c3f40b88ee17", "value": 101008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160046, "uuid": "e33ec3ed-7970-4818-96ac-c2e07fc18b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160046, "uuid": "ed89acfe-044c-4e6e-8956-a8ee38d450fe", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6feac60-8100-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784197603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784197603, "uuid": "36474b33-35e4-4c94-b36c-f492ff7aced6", "comment": "Malware payload (RemusStealer)", "value": "fe5a98f5cfbe505df9ae7d9003fa3671", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784197603, "uuid": "9da5d182-585a-4f0b-8254-76a885919f11", "comment": "Malware payload (RemusStealer)", "value": "f0239fb8b03bd25c4631c7f4d02c7a5c462c215477f0eaf721656e51e3d79710", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784197603, "uuid": "34cb7b5e-cd41-4f06-bf41-ddb7c3ab1899", "comment": "Malware payload (RemusStealer)", "value": "208c2e45f64ada6481f33d9daac764756e918602", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784197603, "uuid": "d7bcd222-bb2e-4213-9268-e1a96bda44c6", "comment": "Malware payload (RemusStealer)", "value": "ecf1f96672b7093fa03a807298eeaa0886790b9c31105380fd294d06fef11556b3b73b8013463f48c1c0107f4090b05c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784197603, "uuid": "4cf80426-da26-47ca-8074-d775e2e8e0e6", "value": "T179F54807BE9504E9D1AAA73189BB4242BA74BC4C4B3133E72E90B6382F777D16D35B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784197603, "uuid": "30a36c52-2ce2-4885-a4af-d8805d6e44e4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784197603, "uuid": "b6435621-2f58-4c33-b342-95591645118f", "value": "49152:nza/gD8NQmeO8phkMXdohRiKCY4KqlGe6PKVXubG6:nMhKJjlGVPKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784197603, "uuid": "fd1e5d66-2ed5-4b61-bcc8-0ce3d306306f", "value": 3610960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784197603, "uuid": "590b7c4f-a743-4979-aeeb-7345dedc94e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784197603, "uuid": "4b070976-beec-4941-8923-eb5b64e8af81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f938462-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185376, "uuid": "2897937c-9c8d-4da3-9c94-afaa6c3510ed", "comment": "Malware payload (AgentTesla)", "value": "169fb6b6cd1b6f29ed55fb13b9eb02d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185376, "uuid": "5bea58ea-614a-410b-885e-0b7408da306c", "comment": "Malware payload (AgentTesla)", "value": "f0ba3225ec62e636559a4f186f59ce1bd8b6621160eb859014471bc1fecdf941", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185376, "uuid": "48680fd9-948d-41cb-933d-f697fbf98e9f", "comment": "Malware payload (AgentTesla)", "value": "008ee40c961614d8e099f5facf7b36bee5cbda28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185376, "uuid": "31d65af0-8963-44c2-a025-78f6e7824000", "comment": "Malware payload (AgentTesla)", "value": "eb854ced51ebdd1fbf356f56bf14bba94cd7f5a23d5de9f51e4247fb3c8d788172c3f193f459221bb1d608403a7c183a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185376, "uuid": "1cda7f3e-4768-4b13-9214-208374c4a8c7", "value": "T1D065F1145FC46FAF8BAC1A15D07F1A6EF3E146891096ACCAEF637D095FBA3009227174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185376, "uuid": "cdce808b-805c-42e7-8162-4bf30f093fb0", "value": "24576:HyqZ67Zsb9PG20gWhMF5DXEI3Jckz8Hb9CwJsEza0NfmJ4r8:Hy2ZGu3zETkz8AEN8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185376, "uuid": "a9c12a79-805b-49d5-aaf7-9fff48871c26", "value": 1524462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185376, "uuid": "7bad0a53-131b-4b92-b5b8-90d2a81edd47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185376, "uuid": "6517e03e-b81e-4b3c-bd72-670c25162bd3", "value": "COPY OF PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a922f64-80ba-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784167383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167383, "uuid": "3d68895f-f4d3-40ed-aa43-76438fbee73a", "comment": "Malware payload", "value": "e771fdb94ca93f6f2358e1234617fffb", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167383, "uuid": "bdcbd0dd-5f93-43d4-8a58-ef20646e09b9", "comment": "Malware payload", "value": "f0d3c665335eda74c52e36348ca978fd021a08c39836029adfa68adf5a3e32f4", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167383, "uuid": "7aa8e0e7-d6b2-4f02-9d95-5a4f89eeceb3", "comment": "Malware payload", "value": "cac54f26ddb4e8760aaaa3286bac2c549e3b0007", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784167383, "uuid": "d28cb975-8874-42f0-9f20-973738184d25", "comment": "Malware payload", "value": "bc218a0c0fdf125f58f89a17c4c2d65ed3c772cee5c4616579783604db0f7881d45846abbd07b1d7ac6f85cb926dc5d1", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167383, "uuid": "65bb4b0b-9512-4ba9-b035-68f61a9e2984", "value": "T1AD2733D8729159FBECF395385D7AC912E3B271801F54C1BF07A85E290E3BA944E387A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167383, "uuid": "126b7960-f091-4905-b32a-1e8c5f865ba8", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167383, "uuid": "53e759b0-1d77-4045-91ce-a43f1f526317", "value": "393216:ulNIZ37UJ32eivEoxy8e6hPdDA54XEAphVtnIUQSg+1/i/zC+OstFLvF7gvpl4:ubS4ce2s7Kpq4RphDto+Ri/zFOsttvFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784167383, "uuid": "8655521f-652d-4bf5-9df6-8093891da447", "value": 20944465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784167383, "uuid": "ecba926b-4923-4450-8a91-784d6aa8edbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784167383, "uuid": "16d69b1a-0644-4fda-923c-82b3bd03df16", "value": "204_panel_tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7a0766-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784185428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185428, "uuid": "f512db24-a7c3-437f-848e-cd4478a0d2e3", "comment": "Malware payload (RemcosRAT)", "value": "1e54f131b7a744584c84d978f9dd1b74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185428, "uuid": "e5263da5-3bbf-4bd5-86d3-a6354ad17247", "comment": "Malware payload (RemcosRAT)", "value": "f12cc58a3f69a6ed7839464f5a507bda0797c22cf347a557380b31609f0cd0e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185428, "uuid": "64fcaf46-0748-4365-90ae-fa2d06912b99", "comment": "Malware payload (RemcosRAT)", "value": "639a7a6ec95e5e5daec31daa36773baf0879957b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185428, "uuid": "160fefa2-528e-473e-8453-cb4ea36ef9ba", "comment": "Malware payload (RemcosRAT)", "value": "2979fbc6841b12d398f3844073de26068ad0be1d7971d949a15a0cb33625aac4512c471b5c20b6a62bf7535790c02c80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185428, "uuid": "7d2bc33e-ab8d-4923-ab7e-42b12aed4d24", "value": "T1F7B57D6EC372543E388C673A3D7D87483A4C386D5704683BF6EEC92BA9356D4A5205F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185428, "uuid": "48f0e66a-cffd-445a-9c82-cd8e6c9ebc95", "value": "49152:U47/C9tHUmOZME+2j00nh2j9sq0etedR+R6iEGsSbFlwVL8CBnp1rFhqnMr6sLyr:+dOZVzf4jpkfpIw/zFcMB6t10uT7jNFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185428, "uuid": "aa2cca94-af50-4f3c-987f-5060d07477ca", "value": 2390688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185428, "uuid": "34e0b3a5-e4fd-4863-9f93-c44d49c3f037", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185428, "uuid": "f53b6633-8051-48b0-9238-f9af61766ec7", "value": "RFQ 394661-GTS-Q265556P.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960fe05f-815e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237866, "uuid": "fc4c13b1-9867-4133-af80-dfceeacb5341", "comment": "Malware payload (Mirai)", "value": "5c443ec69b18bf6e72cada55fe35ca10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237866, "uuid": "9826f8e3-9570-4213-a786-bc165ad5f900", "comment": "Malware payload (Mirai)", "value": "f230d90e5e6e88aeda49aa6b8c36ab89c66220fd98650c22f40e082ced588954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237866, "uuid": "001ad18e-3d6d-456e-aef8-f7ed2988e2d2", "comment": "Malware payload (Mirai)", "value": "3f0558f29460fae4d6add3211e05d721212befee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237866, "uuid": "189e3a2b-28d6-40ce-a36d-55f641a8e02f", "comment": "Malware payload (Mirai)", "value": "29a31a9ba9bdc611a0fbe1056e4d9c6f5da6c5ec58c2ff035f8b7ec3f453aad1cbbd6742537894b0bc3f20a1c7cdfd1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237866, "uuid": "eff6904d-060e-42fa-8b1c-a6fd7621e50f", "value": "T161D32946FC824A22C5D722BEF92D218E331317B8E3DE32129E245F6137C659B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237866, "uuid": "cb01dbbb-3145-4dcf-97e9-24800efafcf0", "value": "3072:whnw1dzzJI8WseDYgd7IafuDKxyCqiR/oHvX:+nAJI8F7gdMaEtCqUoHvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237866, "uuid": "47907ddb-aad4-4aec-9257-6034493bf521", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237866, "uuid": "a90b6d81-d286-4273-952d-34f19251ed81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237866, "uuid": "3b12db57-97f0-4524-bc3d-fe672bae1af1", "value": "SecuriteInfo.com.Linux.Mirai.9816.23301.1785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433c10af-80e3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784184899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184899, "uuid": "0a04d8eb-aa48-4a96-a618-37d950497b2e", "comment": "Malware payload (PhantomStealer)", "value": "b89182acb05bfe31ab491c6f30a2ea24", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184899, "uuid": "97551e6e-416a-4ad8-a1f5-ee6dcb6f502f", "comment": "Malware payload (PhantomStealer)", "value": "f270d78e8a506da20b7da57be1777ea6f8ce5c7d5b54e05a91ffd1b19150cbdd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184899, "uuid": "112dd3a8-07a7-4680-9faa-4f7a64e1a01c", "comment": "Malware payload (PhantomStealer)", "value": "180e00db53c818abb46b05a6e8c76144ed5af604", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184899, "uuid": "706cb79d-ba8f-49a1-8ed0-af78cbd9f9f8", "comment": "Malware payload (PhantomStealer)", "value": "7b91e6a8b09d7ebc29e865e79dada6f46b4f84ecb46c0c25243eed69a199fdc4739b2c205850b3fbbb9d17ded513f67b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184899, "uuid": "3286525d-a049-41cb-8b93-adf0a0e6193c", "value": "T15875A849F59BA250F6B8670D479C4C0099656FE8B94A8AF73CA40DF24EDF81CA8C1F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184899, "uuid": "72a4957a-b52e-4790-9fad-9ea9a60954dd", "value": "768:yMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMF:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184899, "uuid": "53e4591b-8219-41f4-8707-35d97430d623", "value": 1612427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184899, "uuid": "b02e6d58-f75e-4873-8a81-99aa2ad26d2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184899, "uuid": "e12da1ff-2caf-47ac-8a0f-a625f97d40d6", "value": "ATPI_Annual_Dinner.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53a9ce4-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246160, "uuid": "313571b3-9f4e-427a-9611-84346424f8a6", "comment": "Malware payload (Mirai)", "value": "009b2e3ee6e1d1ded153e62fe42d281a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246160, "uuid": "6aa00749-ad96-4e2e-9949-16e74630e086", "comment": "Malware payload (Mirai)", "value": "f2b7fc5bec0da916cad60ab71fedc56cfcf9e1f6a119aaa5fc3e856fa1d9ed1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246160, "uuid": "c55b3d42-7935-4724-8b25-8762c0acfa7f", "comment": "Malware payload (Mirai)", "value": "4715d405564ec405ed77425a75f961501bf9e398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246160, "uuid": "e4e9313a-0743-43b1-bda9-c80f8e7d0aaf", "comment": "Malware payload (Mirai)", "value": "17400e75bbb60ca2d257ea91ca2049bcaf94b94303e2b623dc9e9916b8c8bd38a2c83d6271b15bcd5648f51c165cee74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246160, "uuid": "d4048f7f-584d-4d0c-be8b-147f1858fd9e", "value": "T1F4B32A86AC814A11C5D613BFFA2E118D3313277CE3DE72129D205F2477CA96B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246160, "uuid": "c173b123-7ccc-4ccd-998e-550eda730348", "value": "3072:BfxGIfE1qVXbO4bnOfGZKKajrfjIbVva4qWXCfuaM1kfxG/:iIfvlDDOeZKKa/jIbtancCgk5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246160, "uuid": "2d3a3696-099f-40db-b139-8e7cb02aeaa2", "value": 116104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246160, "uuid": "c53816d9-e4f9-4afc-86a6-bcce1625875f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246160, "uuid": "9906a3f3-18ec-4e4a-96f0-139b74f7765b", "value": "nerv.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e45627-8157-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234637, "uuid": "749ff741-cdca-457a-a19d-9f96a358970b", "comment": "Malware payload (Mirai)", "value": "33e81965cc9e7b7ed589b6414f0ba95a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234637, "uuid": "20b265df-b0b7-4ebe-bc54-782fbbdc68ab", "comment": "Malware payload (Mirai)", "value": "f3868b4a79d0ac856bbe752c138201003224d1a4c7f59b4d80eb33e20410a5a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234637, "uuid": "81cbee8e-3c88-481e-a414-4585b7c98dda", "comment": "Malware payload (Mirai)", "value": "216e01f180f0bcfbb0a0c9f13708f5b04c6f2577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234637, "uuid": "406a6e76-5a9b-4b86-bf6f-ca403a444145", "comment": "Malware payload (Mirai)", "value": "c55546d3c4921a9b30280341d7bcda90e630e37d3e17ad36b305a1dec9c64e5af71c98166cbe4216ed87f3d4b0fa2f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234637, "uuid": "ae6f9457-6e85-4754-8bff-3c946dd2e58c", "value": "T102930781B8824A6AC6E02379E66E728E33A0B3F5D2CF3127DD615B11779518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234637, "uuid": "82bf3a47-d6f8-4351-b776-b1817bf97f14", "value": "1536:Fm4L9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthGDH8kZ8oD1H:F/Bq1BtD6wq5IIjc1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234637, "uuid": "331e190e-56ae-4089-9315-f6ef243b384d", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234637, "uuid": "92c7e533-7aa9-4c35-884f-fb49bbbb0a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234637, "uuid": "17f3fe00-6163-404a-955e-075812379ab9", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7c9851-80db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784181449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181449, "uuid": "bfd98159-a7de-49b1-9930-87aeb4fd0cc1", "comment": "Malware payload (Mirai)", "value": "fe13aa9f9b510499e4d7e1ef8001f629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181449, "uuid": "612fe9b2-79f3-4b7b-9dbf-0b2aade9d897", "comment": "Malware payload (Mirai)", "value": "f44cd4e704abd0e9b91d4008260deb06c5cb9df8a14c7d51785ab0a7f0c70a4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181449, "uuid": "6173f1ee-90ff-48f1-8f8c-af0d78c6113a", "comment": "Malware payload (Mirai)", "value": "ca18fd41a1a13ed025409df1dfc89ef7d643407d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784181449, "uuid": "5184af16-55a7-443f-8ccd-e44a0a17170f", "comment": "Malware payload (Mirai)", "value": "0c1585a8bc42711eb519d45046cf693157065accd874e06cf65081e62bc0e8a9af2afdb641b3b48c8f03b7ce937d2f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181449, "uuid": "4a8443ed-b613-4412-982e-7ed986453136", "value": "T13C14F70AB9919F11D5D221FEFA9F419933136BB8D3FA7101DD246F6033C699B0B7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181449, "uuid": "1fab2ae7-03a0-499f-8ee9-cd1648e9f10d", "value": "6144:TtYLYVQvltNveRyz6OZZaYdevT517iu5pPHiL88jz/f:TtYLYVGNm4z6OZZaYAT517iufKL88jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784181449, "uuid": "edf15ab1-cd89-420d-b0f5-956d4fd22d7c", "value": 202800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784181449, "uuid": "019faa54-fec7-4a4e-b716-2ad52104a8ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784181449, "uuid": "53a3ef3e-f9c5-4d9d-bb8e-b82f7a15c416", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dfd8df-815e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784237814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237814, "uuid": "5a3d0f9b-c86b-4bd4-a2cd-36b85404d2e9", "comment": "Malware payload (Mirai)", "value": "16f28cd54c19f2fceb305aa7d54227ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237814, "uuid": "33286291-7079-4eea-b3a4-f0adabf255f7", "comment": "Malware payload (Mirai)", "value": "f60bae0e9248a4a158e43ba00d7baf83a4a464c8e5b2a9fa6c831ab61f213560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237814, "uuid": "a9e3a2a1-fd7a-4c09-841f-196c51d5c481", "comment": "Malware payload (Mirai)", "value": "86b9fcb602c85eb9dbb8f1a18e92215a667629ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784237814, "uuid": "25f1e10a-a4bb-4017-919c-3cdcfba70016", "comment": "Malware payload (Mirai)", "value": "2204f246a87c99f69851c6a86e7390694e624474dd3c3b6281fca4da721f423d652121a41b2a6a71198a646f1b166154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237814, "uuid": "5c0e14d3-0ab6-4117-8c89-608987d922a0", "value": "T1A9731238D5277CAAA850B97799060FC0274B357CD0E5946BC6908214AC5CD997FBFDC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237814, "uuid": "9fdd97f6-ead5-4bf8-a534-6ee6b55b955b", "value": "1536:863v+lqi/A3n9OHtOuu1m/LO2FosZr5PKTi91mjMLcrAf4YfCOYCi9:ZvW/cQFB/Lf1BlKTi9cjMLc84pCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784237814, "uuid": "886bb106-6ff6-4911-b270-317d128b7803", "value": 74908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784237814, "uuid": "c63ef3cc-799c-4883-a5d8-4d5ada3bd9b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784237814, "uuid": "7ed1a077-c6a2-46cc-adb8-8b76f8f57464", "value": "SecuriteInfo.com.Linux.Mirai.9816.25803.16345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df395a6-8149-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784228726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228726, "uuid": "7ddfc0b8-4790-4f6b-85a8-3ebeff2c2904", "comment": "Malware payload (Mirai)", "value": "8e7838152288785565f210b01638b7b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228726, "uuid": "d436ebd2-2b63-4f9b-b889-04af72b470a3", "comment": "Malware payload (Mirai)", "value": "f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228726, "uuid": "8d6b9704-b787-4513-ab0a-9858fdd4f638", "comment": "Malware payload (Mirai)", "value": "22498c16b85de496e03fd72a3ea24526d1e7e557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784228726, "uuid": "d4e945ee-f25c-4d58-bac4-7dcb316aa166", "comment": "Malware payload (Mirai)", "value": "88450c69ccada4125a07b843264f60387dbdb7fc797082f4bec4486052449f7fc9fdb80b19d290895aca3e445c93d638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228726, "uuid": "c4acd5c9-5d05-4a38-801b-4d446536cf9a", "value": "T15EB3A41A3E219F7EF7A9C23447F74A25935823C627F0D685D29CE9041E7038E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228726, "uuid": "c0ffea56-68f3-4640-9a7a-0c55345f227b", "value": "3072:QWnWoqsDGz2E2eeP5lrOzdWAyLAf2Hue3in9j3sOFalvOb4GwG9:QWnWod6z2E2eeP5lrOzdWAyLAf2acOFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784228726, "uuid": "62d424e2-db51-4569-af01-ff88cd71f834", "value": 115264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784228726, "uuid": "1c2183bc-6a2f-475e-9cec-df5de9557d9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784228726, "uuid": "3be4f3b2-0b39-4c41-9e3b-41827cf93b76", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d230c13-813d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784223651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223651, "uuid": "655f241e-f5d0-4973-839b-3eba293a1a74", "comment": "Malware payload (Mirai)", "value": "5a1df65632b4c7c7025f8e7895029b7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223651, "uuid": "8e8df006-cd5e-4933-a2a2-39f680ba432f", "comment": "Malware payload (Mirai)", "value": "f7d15eb27019b9c7deb07ef57c0115a00f814234deda3117fbec169483261a07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223651, "uuid": "ffd1cca3-e288-47ce-9186-5c6811a1e6b3", "comment": "Malware payload (Mirai)", "value": "d1e4acceb77434e0196b5f140740975c8adb708f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784223651, "uuid": "55ca6274-7067-44a8-b51a-32096631548c", "comment": "Malware payload (Mirai)", "value": "b6bb6b96e66fe39c3dd54a9a9ce4ae7ec8fa515eee4b00d61e63f2b958c219041595be59db62d3e835cb38d7e21fd2a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223651, "uuid": "1de9d190-2d5e-4ff4-826e-9aee1eb1f1b0", "value": "T1B95302F694D87ECCC2964334060B0A433ED677B8A085693AB6D4F6594BF2704CBD8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223651, "uuid": "70e48576-aa90-48b1-966b-fe3ceb80724e", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAkG43Lkg4azHV:CM5az1Fy0oPgdZX6hTo8R4qLGazHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784223651, "uuid": "2a7852e9-7bf8-4b7a-8fc7-dc7fc0c7bcba", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784223651, "uuid": "50c9af4d-a748-4579-ba24-84a8b7245843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784223651, "uuid": "3099fbf7-11f8-49c6-8c00-f88d04c21217", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4fb025-80d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784179980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179980, "uuid": "0ca7a424-936a-46ff-8962-5c3ec51f08a8", "comment": "Malware payload (Mirai)", "value": "2a625a5389388ce255cfa5cfac9b14fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179980, "uuid": "3f905c46-8189-4ba0-86d0-6da07cd68f9d", "comment": "Malware payload (Mirai)", "value": "f7dcf6b784997842e9a5cc9827a6b06d4fae33fa438fb83446239c9f11ab18c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179980, "uuid": "ca1725a4-15bc-49d1-a4bf-ab09a543c139", "comment": "Malware payload (Mirai)", "value": "5206ec2aa4b58519a8c4f55166f016a96db3696e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784179980, "uuid": "4ebc0501-ca05-4a3b-89fa-7592c59ddac6", "comment": "Malware payload (Mirai)", "value": "7ec12707510700beec9bf9956f84ab2ab14a2e752b9dd2599d7f96d8671f7599dfe365cea0954d2c5b4583deba261ead", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179980, "uuid": "3dbfa7a4-0687-4426-8dfd-064003579dc0", "value": "T16EC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179980, "uuid": "f92bfdcd-9119-4a1e-9f90-1ec95e8307c4", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy/w:VoRNjmj1VGFVrRiyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784179980, "uuid": "7d3c1ea4-f3fc-463d-b21b-1d17fa665c1d", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784179980, "uuid": "799227c3-0bfa-4c51-82f2-e7aa6e4b2124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784179980, "uuid": "da4c1a90-bc2b-46c9-90ab-57008fd9b93c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48211cb7-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784185337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185337, "uuid": "f3d46628-58d5-44ed-8563-174def5bbe6e", "comment": "Malware payload (AgentTesla)", "value": "d6d02b4ce72cac7115d181b157c40607", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185337, "uuid": "028ddb3f-326c-43d9-b554-bcf593252633", "comment": "Malware payload (AgentTesla)", "value": "f7f9d118e6900e971941db9b8d89adc38b33cb70923f6e57a90cf33a24b9b44a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185337, "uuid": "1088d266-0b5d-4c2f-b32d-f043a5af452a", "comment": "Malware payload (AgentTesla)", "value": "81ff59d100230653f25d9804e4605bb3f17da00a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185337, "uuid": "37695a08-ed2b-4f8a-8ac0-60700a742048", "comment": "Malware payload (AgentTesla)", "value": "3b909b2fdc224128f51bc5b0f6e06fe2703d314fe6eeb389b2a9aa0b039d74b5a7372b98db0f43d1bc2a8f818b5eb661", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185337, "uuid": "44fc99af-d00b-4ac0-8a59-076cce505cfd", "value": "T111F54C4083286470A57ED32DD07AAF68054E7043218DEF5C35FE1A64BB5AF87A78D9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185337, "uuid": "ebbcbf1a-e481-408a-808f-84880ad20e91", "value": "98304:2AqZk6pjcKwqMRk4aLm4Ar4NcjjkDbtqFLCp48lr/8rDvk:2AmpoMMRk4zf4NcXkwFLCp48lr/Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185337, "uuid": "30474ab4-8912-4bb0-9e06-70b85b8c9943", "value": 3469494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185337, "uuid": "270515d0-55e4-40f9-baf6-f2d38ff6364b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185337, "uuid": "d220f76c-14e4-4a88-a1c9-984a063172e9", "value": "PO150726.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95d1245-80d9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784180910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180910, "uuid": "60b9ca9d-4d2c-4e81-a6dd-50462a7660a8", "comment": "Malware payload (Mirai)", "value": "5c6b4499f509cb3ee2c81a77c9bfac44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180910, "uuid": "388e6b70-7b26-4e6b-b320-d8b55699ccdb", "comment": "Malware payload (Mirai)", "value": "f80122cc684978399ced4bdeb5bfedaaa98691acfb246804cf7fc91857ba8c7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180910, "uuid": "ea4e68ad-ff1f-44c0-bf64-bdca732c65c2", "comment": "Malware payload (Mirai)", "value": "1454cb074d561f2e5b768717c4707dd81ca36e6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784180910, "uuid": "3161eb4e-4cb7-44be-ba2c-42994779897c", "comment": "Malware payload (Mirai)", "value": "df440a724e761fcd92c1c1753ea445f552438b58b262633ccb381e69821f527b2b0ae3c5ad80a24a9baecf72e82e72bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180910, "uuid": "c535461c-8062-4095-84b2-f392fbcd8ef0", "value": "T1EA242B077A81C9FFC486D1B04BEBA5319979FC6D0635315A7790FFF12A09EA12B2D608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180910, "uuid": "757be57d-ec6f-403a-bb05-fb5a002b478c", "value": "3072:9irwssEiasL4Q08no1o73sPM71NxSJru/uet8R2t1I1uO6Keizmy7ecrcJ84aeJZ:AwssEdsL4Q08nWo75wGt4SGrbmE5aso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784180910, "uuid": "a160a252-11a0-472e-afc7-8126ea55deaa", "value": 214952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784180910, "uuid": "9e128be2-4ec9-4766-b9b7-071db13d5fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784180910, "uuid": "0037bec3-d6c0-41ad-a924-faf72958c95e", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aad6b3-80ce-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784176119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176119, "uuid": "6fde2c85-a7c5-4a38-9c1e-957e85d8cd50", "comment": "Malware payload", "value": "10acf9dd1ca1f4d368ce0814791e3ad3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176119, "uuid": "ea4a6814-b1b7-4bc8-a7b9-52abb0065e33", "comment": "Malware payload", "value": "f8505ecdb2dea102e48973a66a771f82d35e8ae8034fd8fc592f36aab4c72a07", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176119, "uuid": "497cb321-c465-46d4-9179-c2f71252d496", "comment": "Malware payload", "value": "80e0fd139347d4798e44b06c985f7da179e94c8d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784176119, "uuid": "0344c2e4-c412-4071-955f-9a299ca9fe7f", "comment": "Malware payload", "value": "5e390176eca55649c16f04e29e2a54111fc3491a9050ffaa94cefe84032d802e7fb3fd37ad91f0570b74ebeeafb0a820", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176119, "uuid": "50d513d1-68f4-485b-85ae-2266bb4f0a10", "value": "T1D7E07200E6213E1426B5E90EC3C0930E523017F0B94CBEBD8AC6C6F10E640C3308DF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176119, "uuid": "33f85af1-74d7-4db5-807b-7ce3bed86f9e", "value": "6:UqLqhR47DcKULt1cK8MNIzXzGMNIcK8MNQkYcK8MN25FTEX3:UquhRADEt1VQXAVIVsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784176119, "uuid": "857029df-14a0-407a-a093-b87ddf688b82", "value": 295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784176119, "uuid": "3b8ff867-f5aa-47c9-93ee-902ddfbc63cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784176119, "uuid": "24680414-3f29-4e43-850a-bf8265b36ba0", "value": "301l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53932d7-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185493, "uuid": "e27f40f9-6511-48c1-83f2-d2bb60db30dd", "comment": "Malware payload (PhantomStealer)", "value": "eb595d742c987e04d7cff1b7ccb35a0a", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185493, "uuid": "9a43138e-f192-4fdc-affb-ac45a8ef4fea", "comment": "Malware payload (PhantomStealer)", "value": "fa3a3858721b0b16d3d62bb372bc110107eb6b58ed1250910dace89bf8c56822", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185493, "uuid": "98cf07b3-585f-4a5a-91db-51e8568426c2", "comment": "Malware payload (PhantomStealer)", "value": "e1cbad1a5145478ea318bcf35dd93e0a6d5b6bb8", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185493, "uuid": "2800c3ba-2fb9-4cc6-86df-2342ad04de9d", "comment": "Malware payload (PhantomStealer)", "value": "0de3ac79a6da66274a33649e53e5ff0f703a2fde9a480ffb5be253209427c7f8bcd060575d93c299192798c9fd9c7976", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185493, "uuid": "fd5f9e0c-2e2d-4eac-ae03-2f944b6e38d5", "value": "T1EB55823011B0BE10648BF6347629DC5ACD6517A0799ECBB53299F90C8F97BDAF399C02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185493, "uuid": "446f1797-3724-487e-b73b-42b68392aa26", "value": "384:P3PB57ZKX/YqX+KY3YJF6rY9vkkHYrJF6XYdXK5K8rY9uB57ZKX/YpFYgX8Kvkks:nhEs4zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185493, "uuid": "46dab14e-1c41-46f2-9686-b5e505919edf", "value": 1303803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185493, "uuid": "72426bc2-0ee3-4093-958b-dbd65c4e2b2e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185493, "uuid": "ef88d79c-3424-4936-84f1-edb001d163b9", "value": "Halkbank_Ekstre_20260714_082357_541079.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c8727b-80a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784160149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160149, "uuid": "5f9b1736-b9fe-4ac6-b1ee-dc6891c41346", "comment": "Malware payload (Mirai)", "value": "ddc78ada035159895b0b63c589fb5a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160149, "uuid": "43d7432c-bd7b-47ed-a83d-7a281da95a6e", "comment": "Malware payload (Mirai)", "value": "fab7ef5a1a6c3f5aafa3e6f4bb1fd2907275cd440159ddb6f29e607c54869e0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160149, "uuid": "8bd62c3c-2250-4236-b4c5-8bfa834a6e58", "comment": "Malware payload (Mirai)", "value": "c8a3687a600a69f1e6a78dc52f8dd0a3e413eaec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784160149, "uuid": "baf881e4-abac-4e8e-aa1a-6933a478d7c3", "comment": "Malware payload (Mirai)", "value": "78bcbda81b7502d89f6fd5a8fca8c0206edbb004128914fe7417f09ffc0ead5ffd3696ca9183849d1211da5772901672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160149, "uuid": "c36215e2-6f60-48fc-bc65-48c1785c93f2", "value": "T118E3C50E6E218F3DF779833587F7BE25A75873C626D0C645D2ACE9111E2028D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160149, "uuid": "764fb0bb-496c-430c-90b4-c0cf7a7c61a3", "value": "3072:W38FV1TvZS4RzM5u2PP2K0xXY3udpwDcu5xJTBwAYuRj/BFAvSPjYFInbxdsU:q8i4Rz+8YG0xyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784160149, "uuid": "d54aecd3-7351-4a06-a5a4-643a425add60", "value": 156928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784160149, "uuid": "40e3ec23-4547-420e-b4a9-66d48335cf79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784160149, "uuid": "91a65396-665c-4598-9fea-e1c5bb553891", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e909d2-80ad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784161763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161763, "uuid": "857eacd8-d470-4145-b856-1a92125d188d", "comment": "Malware payload (Mirai)", "value": "baaf6b65cac35f0f6f17ce658710725c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161763, "uuid": "d4b6e956-e2d2-409f-b0c3-2fc014fb9acd", "comment": "Malware payload (Mirai)", "value": "fc6a37d766e2c13eb68da8efa734978ae6dead2a8ec536b99793c422b1caa836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161763, "uuid": "1d6b1e91-5ec4-4119-9f40-217c6a17c452", "comment": "Malware payload (Mirai)", "value": "a8a7b1145aed8c212cca6e7a2f63c1250eeffa43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784161763, "uuid": "9170f76f-cc44-4066-83a6-0bab0cfde982", "comment": "Malware payload (Mirai)", "value": "14a3409b0937ad04120c9413c3cf67e9bd7dfe256011693b41ead5f59d00f17f7fddb4b25fb66475665afa8503051069", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161763, "uuid": "bbeb47ba-9aa0-470c-8cfc-ba9ad64f62c3", "value": "T18D43025647B8EC16EAFF1D72D89942A223CB271B3055C4C1678CEA91881D42EE679F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161763, "uuid": "d2402893-ea58-4ae5-9cd0-d3da478567e6", "value": "1536:rSfYEx2WqGKbQISxfA1p5gJ82ekm3LWt+xXjSn4u+qgw0rl:MYnWfmoxcEJ8Im3qtqXj44u+qgwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784161763, "uuid": "4a8d05a2-c530-4f5b-abe5-43ce75bf9151", "value": 60588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784161763, "uuid": "150dbf34-7f6b-4b78-ae32-8ab1acaa9e2a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784161763, "uuid": "dbcecd76-ea67-4e1b-80fc-834bfb557c92", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d18e0ff-80e1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784184164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184164, "uuid": "9daaffc6-a690-4e5a-aca9-b750c0d239b1", "comment": "Malware payload (PureLogsStealer)", "value": "6359a5acabcdabe63e38bc1c47f32690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184164, "uuid": "333fbec6-65c0-424d-ba74-31434c841d01", "comment": "Malware payload (PureLogsStealer)", "value": "fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184164, "uuid": "10c8e1ef-a842-4439-8b74-1c2db3632c80", "comment": "Malware payload (PureLogsStealer)", "value": "546431ea87ed5d55a437b5d1732a0b110ce6ade5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784184164, "uuid": "b5b1f8f3-3f32-4327-b5e9-cdd82ab87df2", "comment": "Malware payload (PureLogsStealer)", "value": "04370526873d5e256e1f38c4c0a1070d85f405c7ff29f2daa290166d22b2a53524932ab82265d373eb84641b466e083d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184164, "uuid": "90f01833-f051-4900-9ceb-f92ad13cb297", "value": "T19E752399524BE603CA4913324EE1F67423B94ED96053C25B7FEC3EAFBD32B555E04282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184164, "uuid": "e4c8c097-2b37-4bd7-9550-04a1883e6a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184164, "uuid": "54a65c89-06bc-4004-a720-30b341b57606", "value": "49152:mwIkI+gC8wdFqu0vXJdBZGXuMH5e2pXK:mPkdrbqzvXzBIXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784184164, "uuid": "9de84a73-75ec-4c74-8f96-e5c2a9f4f372", "value": 1612800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784184164, "uuid": "94aac80c-6d48-4ca1-9d50-5a2b7818d394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784184164, "uuid": "7416f36f-6c3a-4d95-ab0c-b52e956aefd1", "value": "57008369310.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0356e757-80d3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784177920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177920, "uuid": "570115c8-61a2-42f3-b191-6f95f50f3aad", "comment": "Malware payload", "value": "dd56ac285868082f3f4c97f5283f969f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177920, "uuid": "c50fa48d-7b1c-4df0-b6e4-eb5a0a50d834", "comment": "Malware payload", "value": "fcbf12f9e6b77e73ac64cf4f64f3cd10732f67d9c2803f46a2b4f789044c0eca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177920, "uuid": "42d0471b-c14a-4341-9c7f-127a6c047d86", "comment": "Malware payload", "value": "73f2af8f59c0d2c7bb8f2e6ebad47d5c6dbd1ffa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784177920, "uuid": "91944e9b-2143-4447-a497-9b60f4c01725", "comment": "Malware payload", "value": "bb9750e859370aeea3a1e8ef385bcbb43a6fe8b5886f77b7f1c8274cdb39b35fd90dd8be9f2ba413a9292cd4efab88a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177920, "uuid": "11bbcc26-77a7-4e5b-9834-79157460e23c", "value": "T164235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADD910961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177920, "uuid": "ca48642b-0d4e-40fe-8b80-333bcc28d29c", "value": "768:4JFWzZx549GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ukz/cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784177920, "uuid": "97fa4ec0-3f17-4326-9e4a-892f6e5b9086", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784177920, "uuid": "b25178c6-2f83-4b2a-ba26-a62eb9818358", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784177920, "uuid": "630dfffc-22de-41d8-beaf-6a2be0d2b433", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb7ccb7-8140-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784225025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225025, "uuid": "2f12bf37-632d-49ac-a907-7e2866944f6c", "comment": "Malware payload (Mirai)", "value": "1293e4b2c48105bc1d0da5105daeb866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225025, "uuid": "b56d265a-dbfc-4029-a171-ab3d9309677d", "comment": "Malware payload (Mirai)", "value": "fd3829e4ed748a4a117b7d3e0486d533a6eb196ac51241a0d29dbc8043dbe35d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225025, "uuid": "1c25bc40-a044-4152-8db4-e520540792d4", "comment": "Malware payload (Mirai)", "value": "8b85c2434769a4fe9467e92a569fda7446994c34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784225025, "uuid": "84930f20-1e50-427d-bfe6-5622d5fb9d48", "comment": "Malware payload (Mirai)", "value": "8322daab9ea2b55cfddd17b0ac94d7b26a6974bdb797df3a8a378629e0013489b99e2831f3240930ce058341b784f5df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225025, "uuid": "782e0242-743b-4413-bdcc-037b6a5c959e", "value": "T1EC936DC9D603D5F0E8525BB11477A3274E72D8364235EB85EBB62B72AC13F009A1BB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225025, "uuid": "3bc214e9-0a9c-44c2-80e8-312a079e1737", "value": "1536:To+6WTPmanwC0kL5JfYXIda1ghOqCbOEifYukHSghRrBU69yo:8+6iZwC0kLXYY+gjC6Eig5HDUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784225025, "uuid": "2e48c0d2-ddaf-41e7-82db-f411a558b884", "value": 95376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784225025, "uuid": "20ea183f-b0ac-41ca-97c2-1fd3fe5c598a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784225025, "uuid": "be29b814-597e-45e9-bf56-7abd2d93db69", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f638436c-80dc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784182193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182193, "uuid": "2765fdce-b488-460f-a76f-1ae0ab91cf26", "comment": "Malware payload (Mirai)", "value": "272039bed763463dc7d64c056005aa74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182193, "uuid": "ee9bbe51-6901-4de1-a13d-df9489abc9b2", "comment": "Malware payload (Mirai)", "value": "fd8378e69b9230e8b46a379ad6d579d0328663fff88ed8fa9180cec2282db74f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182193, "uuid": "8ca1cce3-7d01-4089-9d53-2ab932001022", "comment": "Malware payload (Mirai)", "value": "6bdfa7c5ab346e9a2606960127ad9808a0c2eace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784182193, "uuid": "b10d22f0-b931-46e3-a848-961f1a32f1bf", "comment": "Malware payload (Mirai)", "value": "f111b27b38bc03d7c7a99b69223979bfe7e93bf661a79ca0545930ef789de5a0bcf7e5d11bd73359718583c2dc1f94e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182193, "uuid": "ea6b0ee0-d858-455a-92c5-cd1e2f42c467", "value": "T1FA145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182193, "uuid": "8ebacb7d-bfdf-4e65-b996-72913ea09115", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXXUaN:HZ15BTYCrYq1QDY6U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784182193, "uuid": "832d7e09-599f-4da4-b029-09cd60b7996e", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784182193, "uuid": "493df28c-2410-44bf-acb6-43e9e5083051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784182193, "uuid": "be518d21-e09c-4cd8-b348-9e89e1b3d2d4", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dfa0a8-8171-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246156, "uuid": "355aeb8e-68c9-4a09-bd29-59a1e9dde16e", "comment": "Malware payload (Mirai)", "value": "4264ad00e1204af090326e7e44c3fc7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246156, "uuid": "36abb80d-b1ad-499a-8308-7e97c4fc2c65", "comment": "Malware payload (Mirai)", "value": "fda211282012512d84a383602f1b7bebd9bdc8f737da26388c5884c1e36e2920", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246156, "uuid": "50f93f4c-762b-490a-8821-74bfacec2f3c", "comment": "Malware payload (Mirai)", "value": "87494ada5c7a8b12323986b46887b92d3145a022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246156, "uuid": "c0674ea5-5e9c-4259-925f-60d9b5fd4b83", "comment": "Malware payload (Mirai)", "value": "0ca5cecbff70632d411f3ca9266b16f1748a03181706d0dfc0eebf59dca1f842e537d920ff4be1c0b64e1237a1565711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246156, "uuid": "ee61f290-f0e8-4fdb-acc5-ae745c32777a", "value": "T17FD3E71E6E218FBDF769C33447B78E25A39873C622E1C641E17CD6115E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246156, "uuid": "7a988dad-61bc-46c8-8364-281e5e48fd8b", "value": "3072:z0SBJcnFwP9oYCz0iL+6dw9BaFZnugZQeAgS1:vJoFwP7Cz0iqicp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246156, "uuid": "21a442b5-9799-4a15-a7dc-28f02f76f799", "value": 138292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246156, "uuid": "e9e7fbae-7129-4392-958b-784c33f4ef37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246156, "uuid": "8fcd8eec-167e-407b-9118-b46d4e14149e", "value": "nerv.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe62d31-80bf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784169667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784169667, "uuid": "457eb1ae-2fae-47a6-9874-2e929a2fc881", "comment": "Malware payload (Prometei)", "value": "9a5f541addb6f172c797389924d6353b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784169667, "uuid": "e77148d4-caca-4c45-9625-686a7a6a622d", "comment": "Malware payload (Prometei)", "value": "fddee8b3af76449d51c9d3dd5974055b2402a91d4fe3641b415cd4a2140ad57e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784169667, "uuid": "d88e36a7-b315-46a9-b0f9-3a499ff8be04", "comment": "Malware payload (Prometei)", "value": "83c717c730245572111eefed5bb347498f5bce87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784169667, "uuid": "88045ebc-d5ea-4e4c-a4b1-28789c1b8a95", "comment": "Malware payload (Prometei)", "value": "79f446d6ade1552a55fbf1fed0dd7bd4bcc0aa0bfe4a5fc32fcc964edd2fdd75cca95dcee7e6ebadec62370debb63e8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784169667, "uuid": "0abf687b-0777-40e8-81ac-b47ff252e31b", "value": "T194565B73905514D4D2AED974C6156213BEE8388B673863CBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784169667, "uuid": "d3e82a41-7ec6-41a0-b27a-ec458c940eaa", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784169667, "uuid": "55bb57e9-c6bd-478c-bead-60035d030ee2", "value": 6389760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784169667, "uuid": "91db940e-0599-4130-9765-89bbfcdac12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784169667, "uuid": "dabbdddd-d4d3-43ec-8cb2-b8a0d56a132d", "value": "fddee8b3af76449d51c9d3dd5974055b2402a91d4fe3641b415cd4a2140ad57e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e292be-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784185466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185466, "uuid": "7b938ca9-29f9-464b-96fc-91ff23380d8c", "comment": "Malware payload (PhantomStealer)", "value": "390a0b58bfac71b72edd1dbf18727062", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185466, "uuid": "369f3a5a-ba8b-46b4-963e-05bf7d9d61be", "comment": "Malware payload (PhantomStealer)", "value": "fef8ca610666f7e5d1beba16f2d6ed379f7839b76d62231abb74dfb417d48ba5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185466, "uuid": "db098c13-732c-4a6b-86dc-698549477ae0", "comment": "Malware payload (PhantomStealer)", "value": "6560415cfc796e0912d799683abb1987575f69d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185466, "uuid": "97ce8c08-31bd-4199-be0c-aa67f35a748a", "comment": "Malware payload (PhantomStealer)", "value": "004298ce1630f2135b5f1bd92ea73e91ad596d376d079e2e04a262c344fcfb43a366173fe2d5ccf939ca8b4b110006e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185466, "uuid": "d4559858-02b4-4929-9563-0d298b7bba16", "value": "T16FC512EB257D937C70AC11FB94490D1DC6011097D237BED67B64CA4A3318A8E0DBAA6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185466, "uuid": "62fdd5cd-fefb-4c76-a0b1-2a6f30af3952", "value": "96:6W4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4nW4r:gijPUiuA7ZZ4OyavC5yz3Uz+m/yz/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185466, "uuid": "5db99f21-361f-48de-af8f-327d549344bb", "value": 2523424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185466, "uuid": "6bc2b030-c74a-4867-a0d6-ba07f6ba222b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185466, "uuid": "c3215576-e247-4dcb-bbdb-a1ade3c0ea30", "value": "New Document Project June 2026 Top Urgent.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf417625-8117-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784207468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207468, "uuid": "3c9b9d47-d635-421b-a956-cedd332394b4", "comment": "Malware payload (Mirai)", "value": "29e1fb323286101797d2567477540d5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207468, "uuid": "d098303e-4e3d-4456-828d-95807db32a08", "comment": "Malware payload (Mirai)", "value": "fef98588c65089379016de0c357ed7aadf8487093acf06a9a5ded067493f015a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207468, "uuid": "1a36a87e-699e-4403-91e4-8d13e782b071", "comment": "Malware payload (Mirai)", "value": "0cb1ef515cc49ffbfe3e495f8232347e2369cc3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784207468, "uuid": "ac9909b3-c239-409a-9703-3eb114474daf", "comment": "Malware payload (Mirai)", "value": "ddcb7f009374d523742ed1acfd3d6ce5f6ca281eec1bc3615acaa486ea78e1f95aca02f2599dfbf9644698e7c40f126c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784207468, "uuid": "20e7d5c6-6b9d-4ed8-bd99-8a8b91a6caf7", "value": "T184B3AF87B1907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784207468, "uuid": "63904b65-6428-4308-b8ef-8ef0950d7e6b", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzV8rSR:t3SrlGWnKTU83AQB5A5Liy36f5USR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784207468, "uuid": "42725c43-f098-4705-84af-9d6d04686a29", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784207468, "uuid": "30e7b452-8db4-4b44-add8-bbffc1d0db45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784207468, "uuid": "254d2c9b-ca3e-4c07-addc-b64f2ee00193", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdb1d91-8156-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784234601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234601, "uuid": "46cdb3e7-ed4d-498b-b59b-d8780bc43832", "comment": "Malware payload (Mirai)", "value": "1af5ab022e88b5e5afaebcf8d15202fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234601, "uuid": "cf8e90b8-ac50-4a08-863b-4102b9cac853", "comment": "Malware payload (Mirai)", "value": "ff035abb5e0849ee7f54d39245bb3e892ab2093d3f6659e06cc67f14a2bc56e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234601, "uuid": "90b1905b-c523-4792-b3e3-dd01cfca50b0", "comment": "Malware payload (Mirai)", "value": "71ad33ed5ab7df088f1d972a84ec713d47bec373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784234601, "uuid": "2fe1f628-7e10-436b-9c68-4867794034ab", "comment": "Malware payload (Mirai)", "value": "a806034d5ec378001365e37693413050efb81771e5e21e611acd73815469b405f6b87f8964960aca7ff905ff2fbe60ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234601, "uuid": "cf0a6498-d501-4c40-8b6a-ba4b12d52659", "value": "T1DEC34B9AB4019D3DF94FD57B58632D1ABD20A3925183272A639BFD93AC321F47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234601, "uuid": "4860ac4e-62e0-41e9-a8b6-5bed46b7e273", "value": "3072:4jXiHb1ZoCPRU0rBlpUjeZ5JqieX8KJFdUks:KSHbPoCPRfqCZrquKJFdUks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784234601, "uuid": "82500553-a906-4ae4-86c9-8b88ab20bb07", "value": 125920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784234601, "uuid": "82673995-4245-44b7-9c0b-275fb8637167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784234601, "uuid": "d9db6b37-ac90-49d7-997f-e0908be87e7e", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dfa97a-811a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (VeilStealer)", "timestamp": 1784208442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208442, "uuid": "a6ee1f51-1f31-491e-87d6-613c96fbabd6", "comment": "Malware payload (VeilStealer)", "value": "71d21e10252a9a685cfa3e9642fa0d14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208442, "uuid": "92e9e697-683a-43c6-8eb6-941bce46ba2a", "comment": "Malware payload (VeilStealer)", "value": "ff99e0fbf4bffe07738630833155fccb0775deb29cf8e0d02a5019362072a9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208442, "uuid": "7c2862c3-e3f1-4425-980a-d027f031b756", "comment": "Malware payload (VeilStealer)", "value": "178fb80718cd70a96f424df0fc12c5f5d6ccd419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784208442, "uuid": "863aefa7-2d0f-4f77-a463-0698417f48e8", "comment": "Malware payload (VeilStealer)", "value": "62dff780a9f4157c95b9e24285f9ee1dab49c348dee1e8bc95107aada0f3f67df3b0ba81d1d2661b5cab9d39fe09af4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VeilStealer", "colour": "#4F4179", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208442, "uuid": "ef5b9381-7568-4e91-9604-c8d64becc40a", "value": "T181D64A87ECA545D9C0EDD135CA269517BB713C996B3023D31B90BA242F37BE0AEB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208442, "uuid": "364a8521-9b0e-4c30-b311-e60d44fa490c", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208442, "uuid": "8af05107-7201-40a8-955d-c8dbe2421914", "value": "98304:Z/R1iHF48305rVyyaS55kVkDf+febQFQGlGvjXMvbIEmE:FSl483055sMPifEQFQc1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784208442, "uuid": "0a56b30f-8e69-48f0-b983-442510f03177", "value": 13839360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784208442, "uuid": "c01b8732-3611-42c4-b65d-aae018a237d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784208442, "uuid": "9b3726b3-140b-4708-8295-10fb440f5376", "value": "ff99e0fbf4bffe07738630833155fccb0775deb29cf8e0d02a5019362072a9f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d74e1d-80e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784185550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185550, "uuid": "4b10ab14-0227-4c22-b0b8-96c18214e0e1", "comment": "Malware payload", "value": "12c659ac278e096b4698a6f589b1e180", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185550, "uuid": "7ce2c686-3819-430f-9e03-fb561db33f31", "comment": "Malware payload", "value": "ffa8db1dfd31ccc87915b520447e99f4a03ca193aa3cdd4aef452aecff885cb5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185550, "uuid": "e32f82b6-e3d8-4c74-adb0-9d99a8af0b97", "comment": "Malware payload", "value": "a0cb5c256b94450e407cee94af7b60f55cb30abf", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784185550, "uuid": "6306817e-c6d9-4b47-9f04-fd166e123215", "comment": "Malware payload", "value": "02e735f79cafd66d7ac8e494b75a656840dddad66f5217dd880b2e598aa3b77dff0b40eb5cf695e25a9c913ba5202ccf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185550, "uuid": "4bed450e-8e53-458b-ae35-1ca10ac6638a", "value": "T160F3AB3871F6014DF1F3EF716DF4B6D55E6BF7A26536229A2881070E0910A50FE15B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185550, "uuid": "94b11329-00ce-4063-b30a-08f42ce6f0c3", "value": "24:8d/+IdlPn6ltlZNyaWInZU8lvAlrg8Mk37DBEpmJL7rGvlxPlpYZ+/pMF0y:8l+0l6T/8anUlN3LNE+L7C9bAkpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784185550, "uuid": "a7459405-7071-4bfc-9eb5-c663a90380f4", "value": 164192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784185550, "uuid": "5cfa482f-a36c-4877-91fd-b6406a21d20a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784185550, "uuid": "12a56b3d-8133-48af-b242-e326e87511eb", "value": "works.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359122a1-80b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784163831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163831, "uuid": "f2f5adb6-e1cd-4fe0-83ea-b99b310663e3", "comment": "Malware payload", "value": "2aac605dc8f0a94211d699d0d62b5382", "object_relation": "md5", "Tag": [ { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163831, "uuid": "7232e02d-51ef-4029-8910-6e187133ba6e", "comment": "Malware payload", "value": "ffe04bc05a56f78b1273876cf17ded8df1aa3da5a15deb17dce99a3e206eb705", "object_relation": "sha256", "Tag": [ { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163831, "uuid": "ba99dbb5-0b7b-4a76-8686-9d6fb67ac397", "comment": "Malware payload", "value": "cc64bd95e150dd5ba9b9fc5fe49092b9d5445c50", "object_relation": "sha1", "Tag": [ { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784163831, "uuid": "670079e4-9e51-486e-821f-f9442800dcf8", "comment": "Malware payload", "value": "3299ac6f15fe69787605e038679b4ad5dd813727c0b5d56e32fcba219d3f13bd3f948f145141217c323803dbf0833346", "object_relation": "sha3-384", "Tag": [ { "name": "diicot", "colour": "#7ECB6E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mexals", "colour": "#E5480F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163831, "uuid": "49b7bcdf-d635-4f67-8048-412d12ce6612", "value": "T1521533C7B76EF5CA58BCD37725DE778CB09020BBD448A0172AD7E6A1C832D21A14A11F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163831, "uuid": "ab62bf18-8a11-43ce-9f0e-b38e9bbf040f", "value": "24576:BQwdeRylP146ElPOtWoEQzLGahNR2ER89ynytwvt:BBgRylPW6oPOwzQzLj2hMn2wvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784163831, "uuid": "489896fc-7a0f-4d54-b530-2cad677cc2bd", "value": 885324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784163831, "uuid": "a5c52911-0c20-403d-ba73-c4d07adcec09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784163831, "uuid": "b77cdca7-da82-42f3-b125-2dc036188680", "value": "diicot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36536f88-8124-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784212795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212795, "uuid": "f0e9aa79-67ea-4955-bcbf-41bd82bb7ce4", "comment": "Malware payload (Gafgyt)", "value": "7fea99d969bbefda84b769662175f856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212795, "uuid": "b1df1189-b124-4942-b494-18ef73518ecd", "comment": "Malware payload (Gafgyt)", "value": "ffe6327d7b7ce32541251777d00704daa870a47aa4ceef79b4567146ecd249be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212795, "uuid": "95c33005-8f28-4e47-816e-9a89da671051", "comment": "Malware payload (Gafgyt)", "value": "8caacc4ea51bb6236e4af6048c2178dab3ae838d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784212795, "uuid": "ae105a7e-17e6-4057-815e-07ae42a48302", "comment": "Malware payload (Gafgyt)", "value": "059680b989534149dc949164b55301049a702b0607182d93818a9a2c06ee2832bd638f397831fafe71d989e320c13f8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212795, "uuid": "e733949e-49ca-4635-8233-e1b41a8edf0f", "value": "T139C30A44F941872BC3E227BAE78E478D3B315A9497DB331569386EF42FC1B982D29530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212795, "uuid": "d08f31c3-f87b-4874-b98e-8fba6a36bcb4", "value": "3072:cmnezc//CSX3esb10hvnwbchrH5LFmbAAQVhPRtXJfo:J//CSX3nb6vnNzmbAAQVhPRtXJfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784212795, "uuid": "f2bee0bb-399c-4b35-8250-13357a420b0e", "value": 123914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784212795, "uuid": "c86f8e50-3678-4e2c-a65b-b437a45962a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784212795, "uuid": "593bc398-d864-4afb-b67b-9fe9b12c84b0", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }