{ "Event": { "published": true, "date": "2026-06-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-07", "timestamp": 1780876981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "83840e63-c86a-42a2-89f5-b5a060915e15", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b23e64-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845964, "uuid": "b916a0ae-8731-41b4-a7e3-85947a300974", "comment": "Malware payload (Mirai)", "value": "83018667989d17850864c5e525ec0ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845964, "uuid": "e1218690-e8f7-4119-a0ea-8595865349d0", "comment": "Malware payload (Mirai)", "value": "0065e848e80731fba2a1ca680b317fb0385f001174ddeaf8ef00ee22b93019b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845964, "uuid": "7e1bf275-dcc8-4f18-9a7d-f77b6d7fdcb0", "comment": "Malware payload (Mirai)", "value": "2ab96e4766306f429e39c52f315879dcb030189e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845964, "uuid": "93d952a1-07e0-4cbd-9269-dc50df11810b", "comment": "Malware payload (Mirai)", "value": "b9b172866fbd9f6abace1aea05f96371098624bd1485e29c0fe6ab5b244c6afc66851020cccfccd2c1d3766d5db602cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845964, "uuid": "c82af26b-8ad2-4965-9cb7-5e38c78f4594", "value": "T153635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845964, "uuid": "4eedcc8b-3d5d-4e71-943c-8f6011a3708d", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPk:zGYxpTGASC4XTfyyLpIoYPsPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845964, "uuid": "21cde6c3-973c-4d8a-81d5-4fbc6f6f1143", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845964, "uuid": "cc4c7dda-24e3-4ae4-902f-3289c1730339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845964, "uuid": "b43de2aa-2e7a-4f6c-ba3e-3f3c2e43d817", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0197916c-6278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780840298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840298, "uuid": "e10f0c6e-7277-414a-a838-642a36846e41", "comment": "Malware payload", "value": "48d5a622ed0ee850680d914667d1a8a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840298, "uuid": "98777371-f4e9-4c3e-b5ac-a2d4e65c42a1", "comment": "Malware payload", "value": "0136ff6bc34f3d104b3ae66ef3d11c01f9f964ba267fb1ed84a05cf117f02a35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840298, "uuid": "5d22ccc8-700f-44bf-bce5-5e6e2485b53a", "comment": "Malware payload", "value": "af280c37ab0283326af73f9b3e73eebaf88e4f97", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840298, "uuid": "93ea682e-948e-4382-9562-4e7a1b1bee9b", "comment": "Malware payload", "value": "5bc15d0ad7adbf39dcc8855b1c64c152dc1a8a5be10053f29439aab63cbccd29b327b92c2ae1e9fb2b218bc18e08c5db", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840298, "uuid": "4687800d-288e-4902-93f5-79724205073d", "value": "T1FB318A9B0B0939DD5141E99973A1259CF0A8E6DB30CFE7A4FF590C7EA3C95483189B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840298, "uuid": "71704f23-b1b8-4d83-9bb7-ee8d4525447d", "value": "12:5Xr91AdrK1rsZwy/q+Q7rMS9rbA9Pr4SdX20Ir05inVjYMrbytlncLrrLj7wmgCe:XIvT5inVglYb/JYTGZmHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840298, "uuid": "52e1fc77-f047-45e3-b44f-e8c9c52e1acd", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840298, "uuid": "0b9795a6-e731-43f2-b8df-88d4a31b5af7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840298, "uuid": "6b6bd4db-c401-4dc0-8ae8-6d23cb1c4893", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f3499d-62a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858643, "uuid": "fca48525-88bc-422b-b227-5fa9942a74bc", "comment": "Malware payload (Mirai)", "value": "778487e47676b59f8fdf180c4cf7af93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858643, "uuid": "c28a1e51-4402-4886-811c-961ab5c3bb8e", "comment": "Malware payload (Mirai)", "value": "019c25ad844c3aeadd38579ac237d255e174a03245e4d201f390908d15d5c448", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858643, "uuid": "cc3c9ab3-8abc-4009-8d51-2b69086f37b2", "comment": "Malware payload (Mirai)", "value": "1ec880eb41ebed8b4798317e9a035b66741f0f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858643, "uuid": "0023ded6-18cc-4b8f-858e-397f447ba700", "comment": "Malware payload (Mirai)", "value": "b89582b1c3f5f87e520060cec23f6b8db88e4f0ec16618279b68682bc28b292af00f0110a9f03287134e61b5a58a210f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858643, "uuid": "bf9d3cd0-9e27-4223-a252-0535d4f83553", "value": "T1D714B60E2F228F7DFA78873547B75E24A75C23D626E1D685D1ACD2112E2024E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858643, "uuid": "7d004f74-fe90-4d03-bd4a-54939922e81c", "value": "3072:s6A8mmifLz7H3QfJWvl9h8PHmNew6xnJQYISYed:bA8m/fLz7H3Qfkv+fYL6xeYvYed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858643, "uuid": "c49e128d-0e2c-4ea9-b6d6-72e627310df9", "value": 197732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858643, "uuid": "e31a1433-345d-42ec-84c0-6f06579499a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858643, "uuid": "6267482b-3339-4c59-bc24-9fe420c0f811", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf27df7e-625f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780829906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829906, "uuid": "ca33b227-290c-44ae-96c8-f00deb699e01", "comment": "Malware payload (Mirai)", "value": "e476769823cd3adc4e064dee67eb0dfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829906, "uuid": "c09c0af0-828d-4ae6-82fc-924b6051d5a4", "comment": "Malware payload (Mirai)", "value": "03b8c78901ec73c8f45b11e2f60cc909e463e6285ff658237e9ff95f3fee47db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829906, "uuid": "6f5277c0-a042-43cd-a78a-f8771d9e3a5e", "comment": "Malware payload (Mirai)", "value": "e4aade92d5e46a063b3d6fc88aee41026b9dd9ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829906, "uuid": "9cc38a9e-6364-456c-919e-7e7e80aa54a4", "comment": "Malware payload (Mirai)", "value": "8535ef8fb6827ff4c3b5ba9eeb97ddff03ff23c6c221a33d1b91ebe2fc0239fe95dbc1b24c4a19486a46f68be68177a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829906, "uuid": "9293ba94-da5b-4325-9b28-65c7cec61ebd", "value": "T1A3148E58FE4F78D2D2C7E37EAE4E0FA2702778748156C0B51E40A29ED5EAED489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829906, "uuid": "40e34041-b774-4ac9-b9ea-13cbec05958e", "value": "3072:nrsLbIHAK/FSeidjtxcIOZxUCGrqNezPx2:oLSjFSeidjDtCSbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780829906, "uuid": "664e2a73-5020-4471-acd8-7bb6b34cbae5", "value": 197728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780829906, "uuid": "5220a595-75cd-4ef9-869e-7de58d6d231e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829906, "uuid": "ad671cb0-e5eb-4539-ae42-8351b578f692", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a72acb6-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846058, "uuid": "9e4f19f6-c5bb-42e5-bd19-3f8e84a30f5b", "comment": "Malware payload (Mirai)", "value": "f4514ed1e035836d0753bdee53251a0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846058, "uuid": "345f3a8a-23de-4698-bd7d-abd33037a39b", "comment": "Malware payload (Mirai)", "value": "066a11bd041bd664fa066e3cdee5c77847d53033d7b96c918835f3fdaedb1878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846058, "uuid": "78d0b09a-f288-493b-9d2a-659e5e226db1", "comment": "Malware payload (Mirai)", "value": "efdfc10754302d21159dc5ed72850bd6f29976ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846058, "uuid": "f2c7d04b-85ee-4753-9d90-5f0bb537d665", "comment": "Malware payload (Mirai)", "value": "8399e43dd5d84c216848b38371e913e6171c854d95cdcac6cef79787a755ed68ff3cfa9e9383a9005654ef9b7c106e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846058, "uuid": "4d5f5859-40e0-4759-bf45-d8a8901554b8", "value": "T1B7146D46E6414E23C0D61779F6AF02493332A7A4E3DB73069D28AFB43BC675E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846058, "uuid": "649cb748-0b97-47ac-8aae-f0e2a6d1d31b", "value": "3072:mmEnp4cnSyz81FjSdfWaEfmp/jlVNn9ZD+iamXxn4PTUi/M/95OqeH:mmEnecnSyz81FjmWaEfmp/jpnv+TmXxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846058, "uuid": "b583fed5-7f16-41be-b377-c8a51a7ac307", "value": 196446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846058, "uuid": "521cb191-f9d3-4584-af15-f2499412cdda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846058, "uuid": "483fef5a-2ac1-463c-b70c-11cfb25e4b41", "value": "Mystic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deff4c8-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817126, "uuid": "4421b225-771e-4fe3-9170-2f38ac97f9d7", "comment": "Malware payload", "value": "f0e1dae2e14cb5e1cda4fbc585a4257f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817126, "uuid": "cfc146e0-8509-4499-9bd0-71eb6212eab4", "comment": "Malware payload", "value": "0727c8462f0a9db9a44b50bfc36a16e7775f7519ed15999322ce0f50f0057ba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817126, "uuid": "0d15ad68-da81-4267-9cbc-f2910bc62722", "comment": "Malware payload", "value": "f2a7ebabaa282b806f820b9190ce80b65f67223a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817126, "uuid": "45ea97e2-9560-4011-9b0c-40b0f954bcda", "comment": "Malware payload", "value": "f354737d3a135fb9570dffae5b4bb3dc8aeb0b0ab914aa31f8355984b74fac3b0595752ac5d5c1a3f66cc477301ab2c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817126, "uuid": "fa894da0-b3f7-495e-a6a6-f01152511c2a", "value": "T147455D06FF449FEBC0698E304CAF8316016ADD8226C6571B72BCF65CBE6A65D5EC3484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817126, "uuid": "a60f21d4-4a26-48b7-bb0b-4b315ff2bc08", "value": "12288:Pk4TS0xYwmy1uAwN8/m0cylqnoPAat7Q1twh7KHgbDFtu5u2wJN4gUfcm+od4eOq:RkoZrXIRPvRQPUYxajlN0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817126, "uuid": "1725ac21-81aa-46b8-a1ba-d40946fa8062", "value": 1192616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817126, "uuid": "98b4178a-b1c7-45a6-a574-f692864b3095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817126, "uuid": "c913e566-5b7a-44ac-ab92-6db48955867f", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d156eb6c-626f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780836781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836781, "uuid": "6e7bcbf1-123f-4c2e-9609-efebe22b1bb8", "comment": "Malware payload (Vidar)", "value": "b9953d1529763f5b3d0eab8f564a126f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836781, "uuid": "672a56f9-2875-4ffe-acf0-9bcbac85cb9d", "comment": "Malware payload (Vidar)", "value": "07312d5913b1bc94423008ac0dcf743fcb8d8b21ad3222870e3ec2c26a4ac92b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836781, "uuid": "17322dfe-d59e-49cc-89e6-77400d64c7f8", "comment": "Malware payload (Vidar)", "value": "60041cf9fce17115afe2d9736677c94547e9407d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836781, "uuid": "565aa846-3322-4de0-918c-c009fd38b8f5", "comment": "Malware payload (Vidar)", "value": "83bd614a945c36c98ea62da5de5112e7edea20713fc46f1e2c9b3f9cf98f9c855772c1abffa57a3840c027871d885be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836781, "uuid": "0b34db57-3a75-4b98-bb4e-b53a4887c3b8", "value": "T181379D0B7C9920B6D9AAD33289B112917B31B8990B3127C73A55B7F82F777D40E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836781, "uuid": "ad0eee16-df2f-4483-afc1-3357c790f950", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836781, "uuid": "94e7a6a2-9143-4b90-9c1e-0487f6a8fcdf", "value": "49152:jOKVfrLJVMi77V7yg9bOJi8WpdwC61Uu0OSgk0GID1/J:bpVMi77ltMgB7w5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836781, "uuid": "9d2bf729-7543-4bb7-a02d-6cc66f070ce1", "value": 23265480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836781, "uuid": "46ef7d9d-04e5-4154-9f78-cd4fb020bfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836781, "uuid": "82289265-bae9-4389-8c58-e33684c25fa2", "value": "Release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038e4de1-6272-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780837725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837725, "uuid": "10faae9b-def8-4356-bac8-00b0bb14ce07", "comment": "Malware payload (ACRStealer)", "value": "b3a00a3f8432a34f459614aa5dce55ee", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837725, "uuid": "31e76925-3f05-406f-890a-50685353553c", "comment": "Malware payload (ACRStealer)", "value": "0ab83feefb3ea1ba67dd9834bb489ca3c9ad311a49f3afa1e1ba9b72de22ef76", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837725, "uuid": "8cae9cea-da7a-4607-9169-c6de7ba850e9", "comment": "Malware payload (ACRStealer)", "value": "43da4180926c5fdfcc598b5fab2aa29d1ab8a71e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837725, "uuid": "0d303a8d-b40a-42da-bf30-1a854093a901", "comment": "Malware payload (ACRStealer)", "value": "babfc72196f0b687f2b8f29a3deaa3081cee2cf1f196487a4e8a248873df1a95b55f52cc9c9d7a7372b63b021692d1bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837725, "uuid": "1fac80a8-d57d-4f1a-bd44-0f40ad147658", "value": "T135E5331E919CEEE3E5C677F4F96ADC5361C134300BA944EA3278874EE874AF749B4680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837725, "uuid": "fb287be7-565a-49d2-b1f1-120ed900c519", "value": "1208a089df3cde2ba03d4b024b77031f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837725, "uuid": "4dab8fce-3543-4a0e-9106-48aa2585c01f", "value": "98304:vwgOv4UTgr0yKGviNz64TQIXQnMg1Faz01:YlvJTgrKGvi56QQnMg1FG01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780837725, "uuid": "f4fb0478-88d4-4ef8-aaa0-ce9ce4685220", "value": 3185152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780837725, "uuid": "92460dcd-c9c7-422a-89ef-42b0795b86c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837725, "uuid": "091f1179-2f0e-40bd-8b1e-12f1e766da96", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbd2b43-626e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780836398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836398, "uuid": "fa18916a-752f-4d68-91c7-fba445846e0a", "comment": "Malware payload (RemusStealer)", "value": "5d0496e138bae3e70ea9985cd9e4ecf4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836398, "uuid": "86fa0bbc-116c-41b4-ab19-20c69872239d", "comment": "Malware payload (RemusStealer)", "value": "0bd9d46a323470a96146724ac4a7d0c71b351033139f05b74db79560cb0f2047", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836398, "uuid": "821cf5b5-7035-4e63-9401-d920805cbd0e", "comment": "Malware payload (RemusStealer)", "value": "6dd40f3f28dfceadaf94cddcc0f69dcad0831e88", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836398, "uuid": "a68f6ad1-4071-4067-87bb-332ab35ec318", "comment": "Malware payload (RemusStealer)", "value": "bb24e7df886f18a332e76c5596af6cd773da60022d85405e377970c75afcdb45028f66661f1cd49fd2de2575b73890a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836398, "uuid": "479a2850-f4dc-4eb0-96f9-46510f7868d0", "value": "T1D1954B0A7CE009FAD0AA633289B762817B71B8490F7263C72E50B6783F776E45D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836398, "uuid": "47bd0b8b-c0c8-4cf9-b370-1c973c05c3a2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836398, "uuid": "7b986414-a4f2-41bd-b4e2-24d2394a3361", "value": "24576:6hMn7nLwTOeKsG4fBAUfFclZRZlVYMjXTfnBele5yK2tF65I27:6hW7LwVKsGcAQFclpDYMj0X4Ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836398, "uuid": "fa46323e-1b36-45c0-80b0-e02c80c428a1", "value": 1894528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836398, "uuid": "7006584b-f290-4b7d-b56a-ba5c7f646b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836398, "uuid": "25f850d8-d3ca-4c5b-b99a-23f0692c797e", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437ae847-6299-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780854582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780854582, "uuid": "9d544971-49de-4d42-986f-981956291c82", "comment": "Malware payload", "value": "daffa2c1adea2af5b4b9b66fd919704c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780854582, "uuid": "ce3582f2-4e79-4bd8-ae1c-660f42816ea3", "comment": "Malware payload", "value": "0ccd2aa23fedaec093bf4a8d8521fa605b768ffb1fbb91a585c7037f2a9931fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780854582, "uuid": "cd14352c-9b3f-4eae-bbda-307f982fc38a", "comment": "Malware payload", "value": "c15e24fbdd93bcba30388cfff99352c6740ce515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780854582, "uuid": "ee1a1aae-1d76-4c3d-8915-7fb44f240460", "comment": "Malware payload", "value": "d190b7747a60b2d4bdc4e418642db73d0cf532d778174bd65e0e36f6060c7f92a2057d64f0e2d06a9e664c6900e6b3a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780854582, "uuid": "d636633b-0842-4aff-8fea-d8618ca434cc", "value": "T1A9F77256B7058D9AF4359334848B0FA0B372DCB54AB5972323B8723C2FEE35C5EA2654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780854582, "uuid": "3f1953bb-2e3d-4614-8f1c-7eaa84dfc735", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780854582, "uuid": "34722a17-e538-4e68-b96e-6a549763155b", "value": "196608:E5VvXFaEfM3roDhb6Z/LzEnSQ5Ps6EgzCPpQrqNKE8CTpCjPxTjxTn22N:E5VtfrD7rqNKzapOxTjx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780854582, "uuid": "a74f1fa4-d04e-433d-bbe5-d5875cb17622", "value": 72563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780854582, "uuid": "00cc4a4c-dadd-4f83-91b9-116aa6804dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780854582, "uuid": "b05000a4-9dcd-491f-8e66-851bc8f1e737", "value": "z_insapp6535001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d169e2-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845974, "uuid": "c73130e4-8518-4e47-8c82-f5d3bd7042d6", "comment": "Malware payload (Mirai)", "value": "3827aea32723a5ff9312f104eb7e2314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845974, "uuid": "d282589c-13fa-4eee-ae4b-a98c015a755e", "comment": "Malware payload (Mirai)", "value": "0d7b4820d189f5a94b7854fc27e80dfca6cedbb1e8c2db610e046c247df8e22f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845974, "uuid": "98538e16-5d3a-4a78-a9ed-6fc6abdce534", "comment": "Malware payload (Mirai)", "value": "34d96208df7d11da6ec91e10004f86a59c9534e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845974, "uuid": "76163a7e-3ab4-436d-bd72-29dd65945eb4", "comment": "Malware payload (Mirai)", "value": "e5012906d2180cd14d497b4a43e5ba219a98db49ce1d27fb1903b50bdcc6b87e4c7625f10b4a63effa4897d98b817838", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845974, "uuid": "3ca08905-571c-4549-992e-7bbe61eabad6", "value": "T15C13E1A98EDAEA96FFE75C31AC55C8E55FA00B5B662E8F4238543B60411FE5070048EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845974, "uuid": "83463182-b1f2-4c8e-8eb8-c0ab495c7959", "value": "768:I7s3O2GiO9eNcJlgIvNUufS+7cqd70HPgWRy8Soi5J0vv/NlcB4uVcqgw09m:a2Q5rgWzcqdwlRJ25+XVlcB4u+qgw09m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845974, "uuid": "c3669c23-7db5-4978-959c-2274a189bed9", "value": 43152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845974, "uuid": "2aca7c94-d980-49e8-bf65-53a8db324193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845974, "uuid": "1aab9e59-e673-4ea6-87a7-f9730d34f005", "value": "Mystic.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fdcf9c-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861277, "uuid": "51cad398-f50e-4f0d-8e35-277c57c2037e", "comment": "Malware payload (Gafgyt)", "value": "2e17bb0f023999dd6d475103c41173fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861277, "uuid": "4af6420b-d2c7-4fdf-a9ed-d8ad7d604a8d", "comment": "Malware payload (Gafgyt)", "value": "0f217db7d1b1f1f0c389cc26eed0716d729dead863ee6494df5c4c0c5962ed9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861277, "uuid": "121ec2b1-dc39-4945-934c-fea7df90c628", "comment": "Malware payload (Gafgyt)", "value": "a104a1164c976899ee4e0210106ff55b0fca04bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861277, "uuid": "1ed5b76f-5802-41d2-a92a-3500c4f99201", "comment": "Malware payload (Gafgyt)", "value": "34e87b212a7d23325d6a9bede656320c7e9d94a767825b825f8f162c43580996716a28ffd5ed9c7e12b37d1cf68bcba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861277, "uuid": "0fbfd417-8075-4ee7-b61c-39eda79c97d4", "value": "T13AC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861277, "uuid": "0bbb668e-c8ec-4280-a293-aeca100d438d", "value": "3072:ekYPUfsgnsb0J2ag/VfqkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0qkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861277, "uuid": "8f9139ab-4eaa-4f12-8acd-a3e83ad703db", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861277, "uuid": "f7ba432f-70a1-4cf4-a180-509772e69ef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861277, "uuid": "d6254548-03c9-4b98-b4be-fc8720db7f71", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d98675-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "3323608d-df8e-46f0-ba17-2a495ef9754c", "comment": "Malware payload (Mirai)", "value": "4d5bb534a53fb90d981587164d35a949", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "02e5d8ca-9e48-4fc7-9812-bd42793fe3c7", "comment": "Malware payload (Mirai)", "value": "0faf2f54f5c56c97425b41ca66cd27d9747411dc708f52ec98f8756da41b9981", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "ba95610c-3509-425e-8f0b-43aa7a079f30", "comment": "Malware payload (Mirai)", "value": "c7860b43e321d507947b8b5ce8e14ecaaa63c073", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "9122bb72-86b3-4d05-8640-36782c410ba7", "comment": "Malware payload (Mirai)", "value": "1a4ba55c803ae1695cff4198239be4a1c7b8c427437f4bf1d2405e3e5f715b264177c643a3bac6d35c9086ab0b6fe888", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858953, "uuid": "cfadd94c-d676-498d-bb77-6e02f172e90c", "value": "T175F32AC7F800DEFDF44BE7764863080AB530B7A150921B37625B7D6BEC3A1990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858953, "uuid": "f12a2017-2623-4dd8-a847-705a2fe15ee7", "value": "3072:WCnhUY9PLBVZCZ0qfzDqStV4jbiZLn2oyy2wnptn:FlBVZ00mvqSLL8y2Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858953, "uuid": "142e8476-8bf5-4f55-a478-efbf9fe2e5b0", "value": 165516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858953, "uuid": "b4e7886c-eb50-4677-ab0a-02898ff831e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858953, "uuid": "9cc968eb-3a58-41c2-89fd-2518994d5163", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d0fd0b-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859202, "uuid": "431ec27c-072c-4dda-8521-5d796efef9b7", "comment": "Malware payload (Mirai)", "value": "57bcd8e6d32ceb8e0faacd8c2dc1fdf3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859202, "uuid": "af292275-40ae-4e0f-bf1f-edbac1f22c7d", "comment": "Malware payload (Mirai)", "value": "11e34b5802e385e33a7730d60496a950376bae5bca1dc0e2d1f63d141dea826e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859202, "uuid": "fdc5c1e5-3102-472a-976b-d4ae76d119f3", "comment": "Malware payload (Mirai)", "value": "ba4dfcaaf9db474246bd8e4e488c924aa10d7a8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859202, "uuid": "7ca858fd-7dc2-46f1-ae95-4452ca82f5c4", "comment": "Malware payload (Mirai)", "value": "694c9a006fcfd97092087ed1a3ac24221f8ada5a24f1a2ba69378fb19e4ccc7a1be1c173b97aa8cd723b7480e55fd544", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859202, "uuid": "4e3c9509-b8be-4046-8975-cc1c9c5e307d", "value": "T18C041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859202, "uuid": "93df5538-d7d7-4ca3-986b-c137e3318029", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMlEzvQ6WJ9G2/7ZiYlTBVmJTb:J3CTRdrD5GFnrPU+sNzZt0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859202, "uuid": "2a94e6aa-ca01-455c-9383-7fe31730c8f7", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859202, "uuid": "0c3a2cbe-2db1-4709-8508-f13de6858dc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859202, "uuid": "e1eaea5d-9e7f-40de-8d39-5dffac514343", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66426e57-62b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780864948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864948, "uuid": "e2299180-5225-4eeb-b38c-4accada68a32", "comment": "Malware payload (Mirai)", "value": "c5e80db161349cb1bdb43cd950cd637f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864948, "uuid": "2eafd598-22d3-46c1-b9e8-e66958a714ff", "comment": "Malware payload (Mirai)", "value": "12a2a8a090904c5c434b766b05572d95877fd297b16bf7aea2ca55d16adf96b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864948, "uuid": "00023f92-ca9a-4cf1-b3de-1f60ad203346", "comment": "Malware payload (Mirai)", "value": "50b4afe7f2aad66cd894ef65330a5dfec9455a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864948, "uuid": "239fb1ee-5b1b-450f-a28b-b24415501485", "comment": "Malware payload (Mirai)", "value": "376bdc20391e13d9be5c61992ea5fff6a3bf4eaf7ad140e41e47cc1d146101f5fcc5f88499829b7004348d760220bcf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864948, "uuid": "4362f3e7-aca4-48a0-8f27-b0ca9f6a7526", "value": "T1DCA3198ABC81C612C5E160B6FB1F91CD376643ACD3E67113DD18AB29775B86B0E3B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864948, "uuid": "8826968d-3024-47a9-b882-231bd925bfa9", "value": "1536:c8V02VpQuobbdhVjR1ghgfs+DOjiIFjtWGLnSNK1OP2CXm:c8VlTQFbvtRmW03nFjtWG7SKEr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780864948, "uuid": "44d8cb3b-f477-4192-ab48-90836a2eefab", "value": 105828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780864948, "uuid": "97bb5597-a233-4d18-aca9-0c4c9d3e2c5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864948, "uuid": "c5d6536d-87f1-485e-bda9-5bcd14d58bec", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0c3851-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847433, "uuid": "87eaf9b6-650a-4fb9-a025-387f745a408a", "comment": "Malware payload (Mirai)", "value": "89ec983fe5f0f4cbf6ece4abca43b83d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847433, "uuid": "0316f64d-899e-4232-9045-141a27cdabb7", "comment": "Malware payload (Mirai)", "value": "13237d9b0ea5aa0addc244351ce66b7491e2855bd286093571151b3f8d09d789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847433, "uuid": "f9954875-2e68-4301-9c1c-dda54de387ed", "comment": "Malware payload (Mirai)", "value": "1665643dbaf83bce8d8def8de324b901439d06ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847433, "uuid": "a07401c6-f386-41b6-9466-07859dd1940e", "comment": "Malware payload (Mirai)", "value": "d9f012db3acc3ff4e9d31fa94fbbcdc0d518ca0ec853487b48aa2335ee4771dc2849972f0fd025b212869395aba9af81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847433, "uuid": "1f798df9-482d-46fd-95e3-4802b6c0268d", "value": "T128938B8FF20B54A0C86246F01BCB9FCE3E6322A19E5394E73D6D167A18751DB1D06F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847433, "uuid": "5005fcaa-c05f-403d-a968-93ba8a984da4", "value": "1536:bIPCMbS5tIFluUfIq2vMXot9bBkx6aJQN1GgJqY/LWK:0BbS5tIFluUfIqkKaJCx6kQNIgJqYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847433, "uuid": "2dc3601f-8983-444b-9459-3cfbd87dc046", "value": 91420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847433, "uuid": "46ecad4c-df8d-4096-b891-95ce8d8f376a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847433, "uuid": "4659c214-4975-4d63-8a4b-f4a81b672236", "value": "CRY.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618d7435-6251-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780823709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823709, "uuid": "83394959-3389-406c-ab75-1ad9c8775cc1", "comment": "Malware payload (WannaCry)", "value": "ec2e1ed31515b722d88fa50838ff4d9b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823709, "uuid": "83a12fb1-3c7e-4dde-910b-db759b44d1d7", "comment": "Malware payload (WannaCry)", "value": "13bbaed58cd02d6dc68ab8e0b11ecb467848c7706ad51c739e82b465c3fdc8e4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823709, "uuid": "07e0580c-11f2-48bd-9302-bbc3519282ec", "comment": "Malware payload (WannaCry)", "value": "ebefdb0e01fc703b9127daa5e2675713d53af239", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823709, "uuid": "82991eb3-d32c-4b7e-a6e1-d3bd855e0f99", "comment": "Malware payload (WannaCry)", "value": "ac5059901cb4c91481b669745361b05949d9256753090d6011ce418d0f353645e2a94e0ca5d5de65d97c545775c30377", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823709, "uuid": "6bcbfefc-f3ce-4e3e-8207-e1b09e6666ac", "value": "T1E6B5CF14E5F86614E7F32FB522BA8B5416763E899957C28E02B0114F1C33F58DEB1F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823709, "uuid": "87bd06f7-88be-4fc9-951f-afc4f9b7091e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823709, "uuid": "af2384c7-10f1-4e60-8a89-198e675f0da7", "value": "49152:jnXnaQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SA3:DXlqPoBhz1aRxcSUDk36SA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780823709, "uuid": "ea8ae1dd-06be-432a-8f8c-d09a9d2100c1", "value": 2406400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780823709, "uuid": "ec2ad42d-d77c-4dfb-bae4-15a0b71c9d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823709, "uuid": "aa67fb95-4d0e-4aa9-adfb-74c4b2bfdc7c", "value": "13bbaed58cd02d6dc68ab8e0b11ecb467848c7706ad51c739e82b465c3fdc8e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3d9ec0-628c-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780848909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780848909, "uuid": "9b775c49-da08-4a27-bb2d-0407141786e3", "comment": "Malware payload (WannaCry)", "value": "6c1fbc66008a753f966412b451b79f2b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780848909, "uuid": "16c1c420-6e90-4849-ac7e-4d333d0d3014", "comment": "Malware payload (WannaCry)", "value": "16258f22ddef1dc390661c2df221f6246e1d7372036fb5dca12a55bfcc4d1bca", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780848909, "uuid": "94a57e06-e5a7-4737-9a93-4eb1a66301cf", "comment": "Malware payload (WannaCry)", "value": "66258bee9a5dd31ad9ad5193e66fc3a1ec84f12d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780848909, "uuid": "3a29d2aa-2494-4f2a-94c1-f46bf9df9785", "comment": "Malware payload (WannaCry)", "value": "4cc3dba627528aafdd678b0ac03c756a664f748afb53f531f4f0446d850b257644e33ef9757ec560319926e602971176", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780848909, "uuid": "778421eb-f750-40b6-9c39-f79df02c95ed", "value": "T14536234532AC80F8D5061674D8B78E15F373BC6A22BE870F9B5086261D13B91FB78B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780848909, "uuid": "6967dfd6-3dd2-477f-b7dd-f51d4aa9a71b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780848909, "uuid": "c7377cfa-48a9-48a9-8b29-a4130cdb0cf5", "value": "24576:jbLgBbLgurgDdmMSirYbcMNgef0QeQjGJASk+RdhAdmv:jnsnsEMSPbcBVQejJAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780848909, "uuid": "2b10335d-6b72-40b1-9312-78a72d0f1817", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780848909, "uuid": "3d5ca29e-c65c-4cd1-9d3c-9635e3f4101a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780848909, "uuid": "186454e5-4a02-4567-b0b3-cc2ce35cb28e", "value": "16258f22ddef1dc390661c2df221f6246e1d7372036fb5dca12a55bfcc4d1bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca81591b-626e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780836340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836340, "uuid": "86b8c66b-965f-4bca-a66e-ff1ed788cb55", "comment": "Malware payload", "value": "78b8479171168b37aaf66cb307992b28", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "zianiavocat-rosebaie-ma", "colour": "#BD27AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836340, "uuid": "a7688482-8ca3-44d1-be8e-17d19d3bdb89", "comment": "Malware payload", "value": "196f535db37f3493852daca439f45862c81d55ae42de3e63f6ee6dd35eb175d9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "zianiavocat-rosebaie-ma", "colour": "#BD27AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836340, "uuid": "aa3193bd-ecfa-4200-945c-685009e0ee69", "comment": "Malware payload", "value": "2665ae7eb1225582cb681e86703b38f94fd999a2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "zianiavocat-rosebaie-ma", "colour": "#BD27AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836340, "uuid": "11712585-8fe1-4061-ae19-0448ae798bc2", "comment": "Malware payload", "value": "628669c9b06bce2230498c403a247c9eaffc55c3db7385bee2e3f5ee873df0845080a62202f8260ce983cf5bb3c9f615", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "zianiavocat-rosebaie-ma", "colour": "#BD27AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836340, "uuid": "1c895214-b025-4d62-92b8-f537505c4acb", "value": "T1D8E533816647AE65F01C99F4F365BC386EE917511A3B52F3331CDACA416639CE820ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836340, "uuid": "a9ffdb58-7133-4e04-a619-8aa8efb9084b", "value": "852dd1cf8379c7649545be92d793e017", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836340, "uuid": "de6bae4c-3d2f-402b-96f0-2b703d72f897", "value": "98304:mbHojx6BqKxVzSimGtqcBlYdjuecW2DtS0:mY6VxVzSiZqKlYdyeSRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836340, "uuid": "815e928c-59b8-460b-bdbc-aa4c8f79c9c3", "value": 3194368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836340, "uuid": "097b0cbf-93bd-4e02-9d29-5a751d53ab44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836340, "uuid": "c5ddf813-8ae0-4490-b0b7-dec168bab723", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ef4ad7-624e-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780822377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822377, "uuid": "58239182-64c9-46d4-a266-5769bda0001e", "comment": "Malware payload (SalatStealer)", "value": "332714d41bba01f05836cb06b159f548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822377, "uuid": "418a2fe5-d88e-41ba-817d-d0711985243f", "comment": "Malware payload (SalatStealer)", "value": "1a1b4926c7489d80d31b434b0f2c85acc6ff9ba2060d4e7690f345485c917cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822377, "uuid": "d2a93483-4437-4b74-8d42-0615f1fbcb56", "comment": "Malware payload (SalatStealer)", "value": "d7bd77ecbc18af3d471879532db6308a88fe23e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822377, "uuid": "f9cbc624-4eec-4412-8b9d-d7d6a517194e", "comment": "Malware payload (SalatStealer)", "value": "cdc2b654244cbab1a5c0c125d8fb597e096d2fe658975e89fac6cfc31fa12f6dbbc30bce4ccf71103340e4e083378eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822377, "uuid": "0af0557b-5df8-4c7d-8a07-17dfe0dc06db", "value": "T12916231EE7F541F8E073D578CE464902F7327C990761E6DB17A8A9621F2B2A08D3D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822377, "uuid": "138fc273-6bb9-4b54-bbd6-6c60c8928f18", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822377, "uuid": "6b5bee67-f88f-4c7a-a292-23ec90dd1909", "value": "98304:92Zjl55PLzn4Ju0rH+ZUoPLvnpCquY5wzVEKjYP:eX4JVH+ZHPL/1yV38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780822377, "uuid": "2e46147a-9ff8-4cef-a2ed-b074f400f2a1", "value": 4088849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780822377, "uuid": "568df8e8-6355-4930-98c2-8f1346f6f0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822377, "uuid": "0e1bb286-c684-4010-8cd6-561e02acfb4a", "value": "ZapretFixer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf448a7-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846006, "uuid": "77d75b17-6c27-476c-bdc0-f017285b83b4", "comment": "Malware payload (Mirai)", "value": "5072f622ef0cd0cf6f3193c3b64bf3c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846006, "uuid": "f058eb6a-bc8f-4ef5-9e4c-666db2a26237", "comment": "Malware payload (Mirai)", "value": "1ab1b192c0b90bad603fc96e776cdfab100fe25050ac1d429a1433e6dfbd42d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846006, "uuid": "a34c9546-b5d6-4019-8d3d-a1291fa25e19", "comment": "Malware payload (Mirai)", "value": "135d7ece229e71b88ec17c40ee7616b0f2c6f863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846006, "uuid": "793d0128-b96b-4c92-9bfb-73c22404774c", "comment": "Malware payload (Mirai)", "value": "b334c50df1e944653bcf70b4da207fbdeda1f56861947e403ebd8482ae887e35c608609da55ad3c3ca3044ee20807bad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846006, "uuid": "9cda4454-d224-42e7-bb41-93739f5b19d3", "value": "T1B4C32986B8824A21D5C913BEF92D118E331267B8E3DE7223DD205F2573CA51F0DB7996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846006, "uuid": "881f1eee-e513-4caa-bc54-ec77d273c5a1", "value": "3072:LFEl4/6Kl88A6ZdJLwMaoIdwFpec4eaF5:LFEq/6Kl88A6ZrLhaNcecwF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846006, "uuid": "04b6c721-3595-44a8-953d-2fc51304c40a", "value": 120628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846006, "uuid": "d9d919c5-1402-4e8f-b7cd-2449f08b17d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846006, "uuid": "b9653452-d0eb-430e-a2c2-87f3af31555f", "value": "Mystic.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2031eff1-626f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780836484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836484, "uuid": "596b0570-a331-43ef-b62e-bc2b14bd58f6", "comment": "Malware payload (Vidar)", "value": "395ec704d4aa742f971e69846a954b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836484, "uuid": "7220e1be-8f86-4bbc-b3cb-ce154dbd85d6", "comment": "Malware payload (Vidar)", "value": "1b3fab72cb8c8d8ae3c62ab8655b527f64300c5aca929a8b474cab2240d527a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836484, "uuid": "eb665c56-f1e7-40b6-b0b4-bd481466c79b", "comment": "Malware payload (Vidar)", "value": "0721d24b9810fab7f186cab2ac81d6485ea5bf26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836484, "uuid": "ee8d9014-d183-4d1e-9630-1b2e0a8cec8a", "comment": "Malware payload (Vidar)", "value": "d8c8199b8609531de561e63d9149b81a1470af58ec9e77baa9415a209ecd220cc118e83e0aa7d937e6463df761f5ba10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836484, "uuid": "b7130f00-3eaa-43e1-9134-8e660cabd2a6", "value": "T181F69C1AAC9109FAC4A663338CB66291BB71BC491F3223D32E60B27C2F767D49D75705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836484, "uuid": "97785d8f-abec-461e-b408-73d221564a0b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836484, "uuid": "6eeee15b-d35b-435a-b1f9-bd60563af5ec", "value": "49152:HKb7BDMlU2ddV7AP8AwFdupEVvoZttkaW:HAC62OP8HFdsvZn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836484, "uuid": "8589b0a8-cb37-4fb4-963f-114272b7ae3d", "value": 15901312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836484, "uuid": "a0168ddb-f5b1-46ba-9627-605a44cf29ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836484, "uuid": "639800e4-359c-4c3b-8137-9ec47a696bec", "value": "Release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f86c086-6245-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780818605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818605, "uuid": "9138ac24-59e5-4edb-8b19-c4e7bf106e09", "comment": "Malware payload", "value": "9d268f6fe679d2764841418839c03497", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818605, "uuid": "ae9a3c1c-3834-424a-a91f-e8a23636bdeb", "comment": "Malware payload", "value": "1be54aed5cbd3f974e52ed5f59cc3d03aba8b0222d7bae7c3c22a93091245d7d", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818605, "uuid": "79b9f6e5-bbc5-4908-9d76-eeab63691c67", "comment": "Malware payload", "value": "9b8c62c9c96e01cbe100a2bab43cc7552b4274d3", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818605, "uuid": "3ecadb22-db66-4978-a119-ba307022cd98", "comment": "Malware payload", "value": "618ec2eb6fb6c365133451acf6f9d1716ec1fcc9626bb4467930ea79aa399c5d135634609c24a36be979236ebf79211a", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818605, "uuid": "12f3f977-0767-4708-aa06-bf6654245313", "value": "T149C5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818605, "uuid": "7904edb5-c6ed-4a14-a0db-b418dbffa3ae", "value": "19945200808424dd61e24be83a91ce50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818605, "uuid": "c669cf06-a7b1-4fdf-ac8f-cde939881d30", "value": "24576:NLksxYml5c6yiHCPc/5vXL0pCC0gePvqC:ZnYmZyHcWC4eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780818605, "uuid": "a79bf978-f607-40b2-bc72-0126dbb64538", "value": 2641920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780818605, "uuid": "8f200368-2ac7-4572-b27e-aac6b48068ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818605, "uuid": "161bc386-1a59-417e-8b33-db4dea448e86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c3afbc-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847426, "uuid": "54a2370b-df3e-42b2-a7af-5fe71e81548e", "comment": "Malware payload (Mirai)", "value": "c0a4f365604359eb6dfb94051376a8d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847426, "uuid": "52379bde-ed51-4d37-82da-e2849a7d5104", "comment": "Malware payload (Mirai)", "value": "1bf3503333a2fbb50bd4081c2eb468d60682385563190e2fdb4df8adb3e22f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847426, "uuid": "3925c0a6-1698-4ef9-9b7c-060048ac8948", "comment": "Malware payload (Mirai)", "value": "e1b77c5f90646e27fe4a4ad9f6a8dd61fdc1e19f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847426, "uuid": "2daf3fe6-7254-411a-bf12-c603f4f1b71b", "comment": "Malware payload (Mirai)", "value": "f8bf4f5dae825713eb65131401f5119f66a6855865f0bfe4750b729ab38f9b687dc2fba6bd22d212dda619ca2260037b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847426, "uuid": "9d7d74ff-de3d-4afd-8f54-e45fb900ad68", "value": "T142B31945F8415B17C6C212BBFB8E438D7B2A57D8E3EE320399256F60378B95B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847426, "uuid": "2f8717ca-2d8c-4c64-86b0-b6f6690ac901", "value": "1536:t6w2/VBgyx5y2mjL4Vc1OTgjfxI2/MmylqgdwywYN4HtnFj2ZVPWbYJ4Oxb+XFp:t6w2rN5yb4wOMjG2Uio1QYL+XFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847426, "uuid": "b9a4ada8-5043-47ac-928e-c529a37c3836", "value": 115040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847426, "uuid": "a46b61fc-8fdd-4c13-9e77-ecf8ad76fea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847426, "uuid": "bfe61417-94a1-468e-935a-4b039f881609", "value": "CRY.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53b7690-62c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780874637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780874637, "uuid": "40f10cc8-23b5-48a2-a8d6-afeac9b9db48", "comment": "Malware payload", "value": "5b7cf0e65afbbb1a9404c921cae859ae", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780874637, "uuid": "99c22e70-af14-4d59-b5db-f8a883cb22b3", "comment": "Malware payload", "value": "1c3eb8c84482fe454fab81b76eb4f332e351452813262a1b33286026a6abc142", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780874637, "uuid": "730d9f8d-af59-47f8-a9be-1c2bb9c034f7", "comment": "Malware payload", "value": "e0c99f4561a01ab18e7fb228177dd2900f0da152", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780874637, "uuid": "99eccee2-f9cb-4184-b1bd-dabe2af5198e", "comment": "Malware payload", "value": "564e3a055236ec279b66adf9237540578fb06ba131ba6d220201bf189611d5165a274606f3912cba5b7a07b51c43b119", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780874637, "uuid": "d705b614-ed65-41c8-9e69-4b563bcd07e9", "value": "T115231912EBC407742E4757BDEC842660A6B4DBB5513600FCFAA87348B10A57CBB3FA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780874637, "uuid": "fe5fcc5e-e3b4-4fd9-ab7c-b0b1104262cd", "value": "768:FPj9MBlLoxR58wIoR31ORiGvWPBpURmCWPQy3rT1X7f+QSD/:4nYjWi3b6+BpUR1WPQybThT+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780874637, "uuid": "f4ca6fb0-4875-481e-b29e-089f67f2d509", "value": 47595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780874637, "uuid": "07864cbb-64ba-4012-b087-f6d7b9ef86a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780874637, "uuid": "12197913-fbf1-44ad-bbc5-1c343d39a6c8", "value": "Commandeered.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027f12fa-6243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780817536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817536, "uuid": "5fd55f81-c319-497b-ac82-22798f9da266", "comment": "Malware payload (Mirai)", "value": "858cc776b3d7abbcf2ad1903626aa8e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817536, "uuid": "163c841c-fd7e-451d-be53-f07554c0b021", "comment": "Malware payload (Mirai)", "value": "1cccafa115636781e60fab004bd5192b150fc8fa11cf5d5cac38349d9b702f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817536, "uuid": "72fc1ec7-532a-4786-9c24-95cbf2e40cff", "comment": "Malware payload (Mirai)", "value": "828f932b6daf164468934152b5e38307740bdeb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817536, "uuid": "fd7de40e-f2cb-4afd-9572-a9420c6d8fdf", "comment": "Malware payload (Mirai)", "value": "2fc2385e88026fc07b22d63bb6b742805357b3486caec0f65c9eb492b9676ce76a8a563d501d7accb7f9119918fe1fd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817536, "uuid": "d6eb6fc9-153f-43e2-8619-27b94ec21fa0", "value": "T160633B157862AF1AC6C51977FA1E53493356A3D8D2EB7203FE126F6C378B91A0D2E081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817536, "uuid": "be716a08-aa0a-41e8-8940-f0f3b721ab31", "value": "1536:vV3raBiKESAjmz6tLAivyp2CLtV81XsNnFdNxn/5+/k0:93rjKEmz+vqp3LricdFdNxnA/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817536, "uuid": "ef5bf5dc-a8a2-426e-811c-67735f677f32", "value": 71148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817536, "uuid": "aae314ea-0d31-4ee5-b8a0-cdccc18f4c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817536, "uuid": "5b825822-95ca-475b-b228-47612e18a6c2", "value": "U8F", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dcf722-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861185, "uuid": "f36622b1-71f4-4db1-ae55-b54381b295c2", "comment": "Malware payload (Gafgyt)", "value": "c8a5e490615fe0708f88b6ff23445adc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861185, "uuid": "831600aa-695d-4098-88cd-4c567197300c", "comment": "Malware payload (Gafgyt)", "value": "1e3017a3448487fc0cd13271f3fc8636795251a37d4f7198e75ffced94432e7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861185, "uuid": "9d763585-5ef9-4716-8be9-9e2f1a4fcb2f", "comment": "Malware payload (Gafgyt)", "value": "d73b959f81fa8a931071f89ece345dd5aecb6e50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861185, "uuid": "78f66faa-3cb5-4846-8570-0cd852597402", "comment": "Malware payload (Gafgyt)", "value": "bbf68484707c74c19a335b0bcce7c2ddf50bec108cbdbd8f20e0340a04f3ecb9e7d34122df8e6d42dc06f83fae1747f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861185, "uuid": "8215e7b3-212c-4188-9cbc-01aad2d15de1", "value": "T15C833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861185, "uuid": "51c837e9-5817-4d04-a8c9-46bd49287b18", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC5dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JCBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861185, "uuid": "da0d0497-d308-43d1-99fa-1699b953671c", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861185, "uuid": "aa15d812-6a4a-408e-84a3-46da14968c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861185, "uuid": "7c72e6d9-1462-42f3-978d-ee4d56050cb0", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b93064-6297-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780853948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853948, "uuid": "82e7fefa-c096-482b-a65e-7228d4f8d769", "comment": "Malware payload (Mirai)", "value": "109e5ffbac69909df7ad9dfb59eac1f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853948, "uuid": "26e5cc98-d06d-4d26-9b4a-c42005befa26", "comment": "Malware payload (Mirai)", "value": "1e9bddb6ecbfa47df9c31065029ee428f45f312f12afcef6875b8a92ce3c8612", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853948, "uuid": "a63c5336-10c3-455c-911d-0257802ceba8", "comment": "Malware payload (Mirai)", "value": "3c070704478fab1a733ba5ac47cf5f40e83cd5e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853948, "uuid": "52a82d3f-6216-4993-aafa-2f35f2e5d1e5", "comment": "Malware payload (Mirai)", "value": "fbf72e0a2432d9593b5517d1871227a351138f9b29c7e66066af5b4e8c614dadf42099d57d337f9dfd9f743b0288bbe6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853948, "uuid": "256fea04-892e-4935-9af3-d8473b967ca8", "value": "T10B310AAF0B0A3ACD5109EA7573621559D064EACA209FE760FF8D0D7BB1885483359B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853948, "uuid": "4c4f3b5b-781c-47d9-ba60-90cc9e2d70a9", "value": "24:zmsE5QVDuKwi1MV0fV0/ctbAUsZTKIu7lSCWmZ+Hh1:75uXIsVZTKIu7lZZ+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780853948, "uuid": "d80de2e4-a6df-49a3-b1eb-8b3fadbf06ae", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780853948, "uuid": "5c8c8f11-3826-4eeb-8624-013a736ae148", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853948, "uuid": "edb0e759-612e-4cb7-a491-9515abf15a5e", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952229e1-62b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780867604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867604, "uuid": "cfaa8339-240a-4ea5-aea0-fd91e2d989ff", "comment": "Malware payload", "value": "d3d62f3d1d821ff6dd65d8c4b0b30169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867604, "uuid": "3c604a93-2218-4da3-9623-6e28c7fa7d4e", "comment": "Malware payload", "value": "201612fec18158cdfafe7eb09995c8b20d45ea7a8e38bc21662230d72fd81058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867604, "uuid": "14442fb8-82ac-4283-8af2-cf6ddfd99378", "comment": "Malware payload", "value": "fb2513d04e5857d95f3df08fcd98bcf9b80b1bbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867604, "uuid": "6e4cd56d-7fd5-4c32-977b-2108364f674d", "comment": "Malware payload", "value": "1a07b21031ad2237ad050bb212b3351ce3cfd6110f9f41dae6d60c4c6e7702a6887d33d7499f6f486ca2bbc01e221305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867604, "uuid": "d8eedc3a-a341-4c0d-a3cd-5d118849e6f6", "value": "T1E043F16EBDD6AF43C62D8DBD719103110F08850D60AFDB6C5B3B888DAB3651FB9A5038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867604, "uuid": "da2cb627-c98b-4723-8cce-dc46b01a336a", "value": "768:hYrCGBhJRli4bLPh92RJcE1+dnyiD/LlHAi6nrvi6vi9ISWJbfmmxW0:h0VfRli0LKb4XD/5HAiOrUtoDmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780867604, "uuid": "6318c6e9-0c59-4e16-a36a-f40109cb95f2", "value": 56196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780867604, "uuid": "ad975674-cb77-4991-ba57-5c60e5781902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867604, "uuid": "7bd2c8ba-6462-4b65-b98e-da5cc2e9ac8b", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798ed03b-627f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780843506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843506, "uuid": "f0df9768-b086-4b5f-b161-1873e628f7a2", "comment": "Malware payload", "value": "e4919a218b4793abb3a4c5b5ab74f082", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843506, "uuid": "aa12c641-76e7-4c5f-8869-963579ac6f18", "comment": "Malware payload", "value": "20b1c4eccc5e456c44921dea81862ee994c68fccfd425118e8d508bd32e5c91f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843506, "uuid": "a0c3fa7a-e25d-480d-8754-c5ae1f82f9ac", "comment": "Malware payload", "value": "6b2a5576471680fb2e6360c4aab3201d2425a2e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843506, "uuid": "86649a0f-f90e-4b89-9435-0575422e3494", "comment": "Malware payload", "value": "4086a6c634229194f1bffb99eb635862af29f723f811af82b1d2c3e8ab4e2fe4255699e32901423086e2b6484e08cbbd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843506, "uuid": "f4f28072-f407-4070-a849-8f0cca17f476", "value": "T1B0136C6526953C25AE99883B5C7F2F0CB9A983E1304491DDBF8A3CF18C15A9CE618B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843506, "uuid": "323b4096-0964-4ec4-974c-3742598bd402", "value": "768:Xr9NyXsZztCa9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:7HusZico", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780843506, "uuid": "4c15a97f-a6be-4527-a0bb-2b81322cfd62", "value": 45537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780843506, "uuid": "45aaa353-70e0-429f-9c8a-e10678e63ded", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843506, "uuid": "1c1f8e46-443d-4f5c-b499-a72be10abb9c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c913b-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817129, "uuid": "c64ed13c-40fd-4fd9-9e41-2b9e9df3df08", "comment": "Malware payload", "value": "92bb3eb29422cf863dd215f4f0884693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817129, "uuid": "28e43953-61fd-4244-8b0c-a8990e7b86e8", "comment": "Malware payload", "value": "238bb594d946125bcf11de128e0e1171afe18477e26f8a0053aaaa46f938a23b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817129, "uuid": "7549a5bc-a739-4abb-a63f-ef56b129ce40", "comment": "Malware payload", "value": "49ba60ac84f1f27d0fe73c6bab27f795c167025c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817129, "uuid": "5c2336ea-2c75-4a3b-859c-77eabee637fc", "comment": "Malware payload", "value": "b9e690ff20dee293395d9a988d6a5dbb0e799d01e8a508a8fbdb2ac57763ecace1f6c77837206579e96c6de44f1955c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817129, "uuid": "63eb79e4-4e1b-4dea-8517-db38388e77ac", "value": "T1BF457C5AFF5D3D43C28AD33A8E8A8374233BF990931392137945623CDDE6B98DE91941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817129, "uuid": "79dfc893-d308-4f05-b05d-97d20c747d86", "value": "24576:aOTS5c6hap7imVAVdOve0aysIVSf8WKk:FYhhkiasIVSfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817129, "uuid": "7a76eec9-bc99-48aa-ae6e-d8abea09ff59", "value": 1218344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817129, "uuid": "f825307b-50ed-476b-9339-a21e5331c7e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817129, "uuid": "62065596-7b7e-4915-86a4-2aed8ea5367f", "value": "bot_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b394e92-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847428, "uuid": "08475494-f1e2-4f81-9566-1866a71a5c11", "comment": "Malware payload (Mirai)", "value": "9b07d8f824634c10002795129f07d574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847428, "uuid": "f04698b5-34c1-479d-ab9a-9b0945892f02", "comment": "Malware payload (Mirai)", "value": "23d430020deec5cfb0fdb8c566e94f5c7e26be63866863156067685707ee9675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847428, "uuid": "7c1459b5-729e-407f-8528-b08f88378f9c", "comment": "Malware payload (Mirai)", "value": "a3f4de2df69258e0e81e5231936a2226979c43ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847428, "uuid": "6b60be1b-22bd-4bbf-b8ff-f3f57c7ef224", "comment": "Malware payload (Mirai)", "value": "a4af3c3ea30ef8dd3791d3868310286deeb220bcc5a65695e1ec79d6907a39dd8de1df9a919c199d071c4d0db63b52a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847428, "uuid": "eed89df0-1247-4c27-82c1-6572c1fd8d4b", "value": "T181C32905B31D0943D2A32EF4363F2BD1D7AF9AC121E4E600355FAA89A1B2D335946EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847428, "uuid": "e3cca18f-c04f-48a5-81a0-18373b731813", "value": "1536:xjU+jnHTZl9QcFxJ1FOfmOXnvwrSomTlQvAKeLruapzJqLs0Ffpa+p0:xjUSnHThhFxJDNrkTfKA0VM+p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847428, "uuid": "e7e20857-1dad-4048-8d00-6fa3e843e785", "value": 118840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847428, "uuid": "0de06363-3457-40ac-b6a3-daca1609e8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847428, "uuid": "34b42a49-2fd5-41ee-8a4e-09a877c6be41", "value": "CRY.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3143e71b-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845962, "uuid": "0abc110f-6177-4a9b-a74b-e3bd328cbf91", "comment": "Malware payload (Mirai)", "value": "b397bb4edbd4d60732158408e24ee14b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845962, "uuid": "2dfaa546-04e7-419a-8eba-85b975ef0490", "comment": "Malware payload (Mirai)", "value": "2439fc7ebe94cb24f947cf534199a665a340de3631aef282116b4461a9077ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845962, "uuid": "70b588de-1840-43f0-906a-baba7bfc207a", "comment": "Malware payload (Mirai)", "value": "f3e0944cae06f8e52f5ca693df0c62c841b5742f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845962, "uuid": "c8877011-7995-42d9-9d49-de6f2d3bea9d", "comment": "Malware payload (Mirai)", "value": "e79a83d2ac363d13a633dd6220c5362e89facec5e8554354d0ce38228fa0a10b1b1311fa1e5809bbc9eb249f6fab8d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845962, "uuid": "2524d429-9d15-4ef6-9e5a-edb7e2068289", "value": "T13E13F1E065E0CBD9D137823C8DF9B11F8D84F05DF04860F627BC615B9A7AA1A7D19392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845962, "uuid": "a4552f63-81ae-4db3-b499-041e51cd56d4", "value": "768:t3nImPwX+GiDxdYP8/XGDq0enPwm6MWom2+BUghdFdx1Q+xU6Zz6zXuUnbcuyD7F:tqXkxdY+WDcntKI+CoFh1wXuUnouy8oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845962, "uuid": "957e4112-ca44-424f-bc43-7d2088491fa4", "value": 44960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845962, "uuid": "77e7882c-cc60-470c-aa66-52bc753687e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845962, "uuid": "08cb5274-8472-4cd1-9d0d-db397dd47c68", "value": "Mystic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca8c881-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847430, "uuid": "2a868784-6ff1-4caf-9a5a-b4b4d765239d", "comment": "Malware payload (Mirai)", "value": "a08a99e07a7fcef4bf4296ef6b60e003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847430, "uuid": "9ec2ee22-86f3-47f2-b68f-bc60db751d16", "comment": "Malware payload (Mirai)", "value": "24598637bc80b2454b3a3f6675c495a94772ce8b3280d01aec91de01f783b9bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847430, "uuid": "d16f5eb6-7306-4eb2-b08c-53c990169e35", "comment": "Malware payload (Mirai)", "value": "f6a8f754ade403d49c9d66b89eab78b868a54806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847430, "uuid": "fe0c2c0d-4290-4bcc-a4dc-d5b774aa8203", "comment": "Malware payload (Mirai)", "value": "14fa01e456879fb115716540366bb18a4a8a2d011466d815ca3200f7d80b598923eb62d7118e5982769b4b7327bf99a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847430, "uuid": "55ddb1b4-1568-4748-8cf3-a8f6f153cbb7", "value": "T111D3EA46F8819B15D5C111BAFE0E124E77231BB8E3DE72039D246B707B8B97B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847430, "uuid": "7fcbaa5a-0eeb-40c3-b3f5-97f098a61446", "value": "1536:Wgnp0TiQhWvrf5nCaR1m8d4XyUtBFxFaZzTkc0iLiYOcY13p6SU51oyzs0m0SZU7:v0wEaR1fKXlDalOcY13p6JXoycYB+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847430, "uuid": "2fa11f47-a59c-48cc-93f6-6e90c269e887", "value": 132796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847430, "uuid": "59e5f4ad-b790-4b7f-ad52-04efa8270d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847430, "uuid": "619c7fdc-539a-4e12-b51a-06054d93fcd4", "value": "CRY.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c76a84a-627b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780841659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841659, "uuid": "7733a7e5-5a3a-4a22-90ed-2e21edb157a7", "comment": "Malware payload", "value": "22a6e8b46477627f4c2f6a050963fa8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841659, "uuid": "41c1637b-3a96-4cc3-ae72-b8d1d2f215bf", "comment": "Malware payload", "value": "24bc2f1fd02c3c7e96f9771658325c7e35c8021c8d8b973b46b336cde98704a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841659, "uuid": "b1079922-6d8b-4bb4-9694-95214ba2c695", "comment": "Malware payload", "value": "de82c6a6a2eec6ecfa240932ae05d337ad4c7534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841659, "uuid": "f6b74ee3-3ad2-4284-ad90-2d0cf8b4ed5c", "comment": "Malware payload", "value": "24f233f2ab74893d8cad273af351bdaa40521cee1d4afa7bcd2747da25601b1b98030f04a8d63b914cf72de52dc79d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841659, "uuid": "cd4b910e-dc85-4f80-acc6-43f3ec5bc67d", "value": "T12BF7334F182DC487C5BF9AFA75A234B6D344D8271AB4D42E1B0547FCF6E5E2210B892B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841659, "uuid": "32c5c460-b6e9-4171-a32c-a4a79e149be5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841659, "uuid": "dbf1605c-7b37-4168-bad5-4147bb8e8a12", "value": "1572864:Gt9IKPISJEoRWYKJImKljUoEkB9dNDsMLXgiMZrIuEtiZS87:GUKQSJEoRWjImKljUvOhLXMxIuy87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780841659, "uuid": "b29472bf-01f5-43ff-adb6-6e4a0b1fd471", "value": 76726391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780841659, "uuid": "13625f2b-ef9b-49b2-a494-1fcf6902919a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841659, "uuid": "373e2975-9e39-4134-b918-43e1357b5599", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1a466e-6278-11f1-a769-42010a9c0008", "comment": "Malware payload (ZigClipper)", "timestamp": 1780840314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840314, "uuid": "366bef59-3dad-4d42-8dc9-5be0a0fb03b0", "comment": "Malware payload (ZigClipper)", "value": "ce3efb77bb52246e20a690fa294b6afb", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840314, "uuid": "02e80d36-6a93-4a3e-9b5b-3889dab70aea", "comment": "Malware payload (ZigClipper)", "value": "25202fe6cfe435bdee3befa057a8618d7e6fee0309d100e04a5a0d3978bf0792", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840314, "uuid": "fc2e7c93-14f5-4d25-87dc-9e2cbbf9c852", "comment": "Malware payload (ZigClipper)", "value": "415d46f4d0b61ab55d7146266993579e51094d31", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840314, "uuid": "9b742eb7-157b-4516-a5a2-c8b89c4fa894", "comment": "Malware payload (ZigClipper)", "value": "8a145fd8431b90e87b6752486e367a485630266b076c8ad9cd14eaa52831bd8b985fc62bc541d47ef1c57f1bedd7e105", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840314, "uuid": "90806332-54f4-4023-9d4b-3d62a962ab5e", "value": "T1D182595303851BBDF6CD0EC5895A301720F2D927BD291299AFB36EEBBC3B9845434726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840314, "uuid": "09a4f050-5684-4442-975a-a7f57f6acca5", "value": "384:amx+KY0TMezUuF5uRx1XA3uluG3vvSs4eFf:Vx3Y0TMKn41Xft3XbBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840314, "uuid": "fd6050e1-222c-45a5-9eee-9c83173ee842", "value": 18396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840314, "uuid": "2b529611-17eb-4cb6-8a7e-88567299e726", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840314, "uuid": "304ca55e-0a56-4962-8f08-f8adb440a621", "value": "Reader_en_install_1780328114797.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0291872b-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "f76d5bd6-d584-4d92-a317-7f1fd2d15827", "comment": "Malware payload (Mirai)", "value": "675a3294aab1aafcacc43d884f6948b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "914b7433-16e6-46b5-a1d9-6ac2dd791694", "comment": "Malware payload (Mirai)", "value": "2532851bbd6a3a3cb9b39e644a015b83fcc11939937e91ae061da6a5c1f3b36f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "45ac9db0-810a-43d0-8430-c8350274c02b", "comment": "Malware payload (Mirai)", "value": "ecdb60f4a9cd7fa8ad8112f4151c6ef1c0a6cb22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "b94aa057-6435-4528-9116-546e04492b2d", "comment": "Malware payload (Mirai)", "value": "79cf33953c2782886eab67fb53301e8026508be2fb7a31615bf72cdf9d87fb18344a4e5bd8796dc2aa981e26491c4857", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859198, "uuid": "196e019c-48d8-4dda-9e03-2b397fdb4183", "value": "T1F5E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2577C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859198, "uuid": "943e9282-cde7-4346-b295-aa7004dbc656", "value": "3072:CotWnBLigk1Tc3mCC0DvZe1k6aU6zL6EiueCo2km:VWnligqTcWCCqeS6axIueckm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859198, "uuid": "f95d72e1-f25a-4691-8072-fe4c8764f2ab", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859198, "uuid": "a5ab558f-4589-4d01-8bd3-5037710a1d19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859198, "uuid": "b55d5b34-760d-4a54-8adc-4a085eac2328", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d5c387-6243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780817535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817535, "uuid": "6a224ef6-1e09-40d9-9734-780f712f6f05", "comment": "Malware payload (Mirai)", "value": "821a8c8ffbeb03d7220e2fa9e19cc8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817535, "uuid": "57a9a116-7ebe-4736-95d3-8430828642b3", "comment": "Malware payload (Mirai)", "value": "271edf373744cdabfe017a9f12c18311e68569c59311bf27aeff538107d15f7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817535, "uuid": "6fe8f0dd-b56f-4acd-8742-dc5f4de87d64", "comment": "Malware payload (Mirai)", "value": "6ebb3b8415122ef9cc1e1e402e3be4376a1ee96e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817535, "uuid": "a9de1a04-0776-4e84-b5d1-9db75285bbdb", "comment": "Malware payload (Mirai)", "value": "8a0aa6a11681c4d89d5397144ffdd697a17d763e92a5a01a440cfbec5b9b88e5385acbf6c8bde5864e4c38db82bd08b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817535, "uuid": "390868cf-76c0-4e6d-b162-8e94a6721388", "value": "T1DE93D709BF711EBBD86BCC3305AD1B4238CC960771947B753974DB1CB64A94B8AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817535, "uuid": "730758b9-8c60-4ef9-97b6-f3e61a165b7c", "value": "1536:fdxvnZ1r28DV/DHqe44Jq/ehg88Im63+Pk0KX:VxvX9HI/e2PlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817535, "uuid": "9a2d9978-ebfc-45de-b152-2cc5421f41d3", "value": 91192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817535, "uuid": "e7f10189-7e84-42c2-b306-b0d60bac1dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817535, "uuid": "9ac130ba-e281-42b1-95d6-13ab8939efbe", "value": "e3G", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07cfc02-6211-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780796434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780796434, "uuid": "efa9688f-405f-4c87-8b1e-9b5778ef5fed", "comment": "Malware payload (Mirai)", "value": "7d39d81cf718b2cc4a27a37cf88c8f63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780796434, "uuid": "33770588-7ce4-47de-b3ed-ccb651eeb807", "comment": "Malware payload (Mirai)", "value": "278e4f1ebc6ff4bbc02d48340fd6f576e69b14f0ae678c96b63fe3c7fd3b9b76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780796434, "uuid": "eca78a2f-92e4-4742-9d14-9341de9b3e95", "comment": "Malware payload (Mirai)", "value": "c96d5ab4efac6f353a28e68210c945a91c9d34b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780796434, "uuid": "2f87d10f-8c90-4515-984c-307ce8dbb0b2", "comment": "Malware payload (Mirai)", "value": "b93ef988aeaee6af612b3b5b08d2f066275867367f09b75fe085a884c428802fea607aa3949affbc3c7f2daf78ad9958", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780796434, "uuid": "59456b24-498d-407e-aff3-6f5532acf7ae", "value": "T1BF3109EB071D369E4401EA6973712558C154EADB304FD7A5FB481D7EF2C84883306B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780796434, "uuid": "351f7ccd-e90c-46eb-8beb-6a9131c60e74", "value": "12:52ir2s+vZWxrZWHYZ2rZmyAirAaIRXrRnAYJGhr3xhOJrfODCrrDe3TFLit5rgJN:v+hCXSqnZVAnxGPa3JLic/rt9n5tkq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780796434, "uuid": "00177de9-a66f-4851-9581-e4ede3ad5756", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780796434, "uuid": "0db4773b-b982-464b-8884-0898b19d5929", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780796434, "uuid": "7da249ed-3407-429b-b77d-cd4a14764b8a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0539dd-625f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780829656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829656, "uuid": "96ea8908-2c51-4979-bc8f-edb3caaac1a0", "comment": "Malware payload (Mirai)", "value": "f20a259415332f1dd86f29c554dc6a57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829656, "uuid": "f3936336-98b6-412c-838b-ef64356a106c", "comment": "Malware payload (Mirai)", "value": "281db967713247cfc3c2e186bdfde3a0f8d6d17e1e397a065fda74acd846448a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829656, "uuid": "bad6997d-51be-4792-8cdc-7cdc10c2246b", "comment": "Malware payload (Mirai)", "value": "cc2d9cf22c45a04cc3ed0915846f48de36b95574", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829656, "uuid": "b0f96fcb-9e5d-4ef4-b432-1bec5707b9b1", "comment": "Malware payload (Mirai)", "value": "8d7b9f4c17a23725665c873c07b21216897bb9b6a29cdba3a402ea68f56609ab743b30cf8c5ef3b85141a82c8e5534bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829656, "uuid": "db39b997-1e1e-495d-a5d8-3e0bd1dfa984", "value": "T15AC33B427C418913C5C6077AFA6F114D3322BB99E3DB7312CE145FB42F8BA5E0E2A656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829656, "uuid": "0ae54731-1e58-491b-970c-76ed73c63d8c", "value": "3072:zHOEVbhBl2TuPxVdc2YqphSPBctLm92+j6/2SCj:aYNBl7Pxj9hsKtLL+JSCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780829656, "uuid": "b079c734-e114-4971-a35f-3852284ff729", "value": 119061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780829656, "uuid": "885b8034-d10f-4df7-85e0-3ab3b433025c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829656, "uuid": "d9ded84a-3aaa-432e-b73c-746eaceacbd9", "value": "nullnet_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a17a048-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817120, "uuid": "32af0de7-f8f8-48eb-8d97-048bf8618a75", "comment": "Malware payload", "value": "b2f253d44f826130c9723c9ae061e753", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817120, "uuid": "5a87b816-fbb9-4699-9460-150cd468d9e6", "comment": "Malware payload", "value": "29b6330a3c216ea922195a0e46060a9a8d491976cba48c34ab1ff4e7e2143986", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817120, "uuid": "8e42f7a8-cf34-4c1e-b4f1-e318cd4c44ab", "comment": "Malware payload", "value": "2f9a04551a7435343f891c1e210434daa42d3b4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817120, "uuid": "b03a281c-8e4f-40f7-ac0f-9dbea685b667", "comment": "Malware payload", "value": "fa9de87fbe4a7bdb43e9c1346f16bf3372841030384fbe2229a51fd1e4e7f0ccdbcf73a721e273c188b584dcd11419ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817120, "uuid": "bf75e53b-3552-412a-b0eb-93ec39e95328", "value": "T198A1FDCA507C4A32D284CAC8F8F389E5630755D4E5E3DBF9E96D0E53518DDA4B80AE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817120, "uuid": "541a30cf-f771-4ef9-8508-bf5ed368a473", "value": "24:6nadKduDdp1ciBN8BMxBM/hyXrVcU1bhv2y92Yagt2wG6s6fUoEoWo7wgXgbgKrE:D1GtoEoWo7w6Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817120, "uuid": "6a44190f-caf1-40ba-b3c9-d092d03a64ea", "value": 4957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817120, "uuid": "b0e4ab2b-56e1-4fce-844c-b66e0c13cdd1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817120, "uuid": "b2d4c544-310b-4f6f-9995-63209bce55d3", "value": "peylood.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9208f671-621e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780801886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801886, "uuid": "89027352-8f53-4e8c-9c75-ddc4a7532d98", "comment": "Malware payload (Mirai)", "value": "7b20958aaca053161867b10a8a876f6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801886, "uuid": "1fe7ddb4-543a-49cf-a76b-daae82aac198", "comment": "Malware payload (Mirai)", "value": "2d3e9dbc20fa661f284a9c41383608bd750d3f36369f91d26ccdf300e54c2bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801886, "uuid": "56226057-7b7d-4e4a-bb42-43b344f48bff", "comment": "Malware payload (Mirai)", "value": "8302830dc311d216b75734c045c05421efcf5c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801886, "uuid": "c9bca23b-86ae-44c5-aacf-3858176c3a27", "comment": "Malware payload (Mirai)", "value": "7fa975962e0458f50d8cc280de81c33cfbed2702c52a229e99e17f1c9c2ae28f1a04564c6acce9bbd3fa7607c4c3d8c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780801886, "uuid": "22d12cb8-7140-4e02-bcb7-6fee2b2741b7", "value": "T1028302AE1FE9217ABD9ABD39C20207D6D2B63D8C4DB4D1D41116C76D4A220F805CDEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780801886, "uuid": "4efb730c-a6e4-40fe-8fad-8100894447d9", "value": "1536:QHaWdAncN5Fqh/3wguxaiJh+00kSsWZ2ZUtfmCiG:Q6t4e/3jYaiJ3D+gEiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780801886, "uuid": "44d6853d-3bc8-4bf6-855f-83f4c1f56538", "value": 84724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780801886, "uuid": "543fd9b3-1c71-4e8c-ba19-510827e9b434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780801886, "uuid": "ba8b31ea-91af-4a91-839a-52416afd4532", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4639e3-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845980, "uuid": "7ef25393-dfbe-48cd-9f62-e74127abaa34", "comment": "Malware payload (Mirai)", "value": "251d180553e354c7e62d0e5ae3cb24b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845980, "uuid": "1437c108-bb7a-4474-88cf-fae53f11c903", "comment": "Malware payload (Mirai)", "value": "313ba2e7997770f92b434c8d74b4325ea4e8109fbaab4a1c5560a96b7dd8a3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845980, "uuid": "4c81cb3a-fede-4001-8f32-595660c9db85", "comment": "Malware payload (Mirai)", "value": "a0ea1f19c17c313b3f242ba2a2802733823b7094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845980, "uuid": "62853613-5b58-469e-aa89-1318481e24f6", "comment": "Malware payload (Mirai)", "value": "2dede868e536cac466d041456c73557cb1c16aa76bbabbfb22c40aa0832930c29c6034223d36aaf59f806c68b12d70fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845980, "uuid": "0f021282-9fa5-4116-85ea-6c5522965452", "value": "T1E1630299C3110983CAF83BB8A5DA010E75C59674DBEB74BF28118848B9A7A415FFC09B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845980, "uuid": "9c7f9327-5580-461b-a941-a235a0c6b237", "value": "1536:X8+6+0aHo6td4icSElsuNnjLQnkwwY2CIuSLt:XN0Mo2cXsAjLWTIu+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845980, "uuid": "55b22ba9-2c85-4d63-b164-3b5377664d79", "value": 70400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845980, "uuid": "d5dd9048-95fb-4b49-be9b-a7047a4e3206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845980, "uuid": "6f7be9c3-3ee7-456a-9fd4-1256eb586310", "value": "Mystic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cbf64a-6282-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780844657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844657, "uuid": "d8b68b69-74a7-4e0d-81cd-1e98c68bd86b", "comment": "Malware payload (Prometei)", "value": "1e6d0f5b74b1a56ffec51dd2f2e7c62a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844657, "uuid": "fe27f2af-a3d8-44ca-8fc9-56113ac5c972", "comment": "Malware payload (Prometei)", "value": "3168306188b22044cc4b5ecf7bc7259df69e0dfbc568445e30ee0c22211a129a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844657, "uuid": "9454ae2b-3114-4519-a9eb-ed1c271932b0", "comment": "Malware payload (Prometei)", "value": "d6b4a0fe0e2d9936cf6ab383dd959758e0864969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844657, "uuid": "c14e3759-ccfe-4fbf-811d-ad0782ce74a1", "comment": "Malware payload (Prometei)", "value": "eda78267bf2861f9820b5e4b313754883909584ca28a8ee69abe1d5928251c56849ac4126834b5214849e8940e53c77e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844657, "uuid": "ccd15c6b-26a5-4289-92bc-b7f6fb625c2c", "value": "T14147DF77814338E9E5B98DB4D01025416DAC388B5778A3C7BAC871E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844657, "uuid": "fb8f06b2-cc17-44ef-968b-591a60a4b492", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780844657, "uuid": "edcc27f5-6bfa-4838-a41a-4104ff37d118", "value": 27033600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780844657, "uuid": "43a1f02b-1055-466a-812d-4c92facff81e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844657, "uuid": "dd2a6125-4e60-4fd8-b227-335ea52869ac", "value": "3168306188b22044cc4b5ecf7bc7259df69e0dfbc568445e30ee0c22211a129a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308c4150-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845960, "uuid": "13c16cc6-b162-416b-81a3-d73d66f73074", "comment": "Malware payload (Mirai)", "value": "6b5dd95c620eb3d2f11ece9bf99b9cd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845960, "uuid": "9c66f2a1-cc15-4bc6-95c1-bafeedf4d6e1", "comment": "Malware payload (Mirai)", "value": "316a954a15f7ce64b61f46b69d80184566bf572251c719947c546b30c3879b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845960, "uuid": "66569fd5-3617-4228-8150-d121134fac01", "comment": "Malware payload (Mirai)", "value": "d3e30a2a8b3fc5ee46bc416ce4350f4d1ec9f629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845960, "uuid": "df62c02e-c20d-4565-9022-15a5b1927db0", "comment": "Malware payload (Mirai)", "value": "85e01345a66ada841c2844bab4450b7f4f7821db30734d8302ae00696ec3945d447e457cd6fcdce90899a667606806d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845960, "uuid": "1278bebc-48c9-41b2-bb0b-6a1c2fb90a8b", "value": "T191932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037C755F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845960, "uuid": "59165ef4-75ad-46b2-8d45-3b0bd5a59af1", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2K:AGUJtkyYEETn0T32TDBf0nsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845960, "uuid": "8cee6660-1137-4af6-b20e-ea14fffa3b69", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845960, "uuid": "ff85e5a0-efa9-4dd5-beef-9f98087d275b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845960, "uuid": "a34dd892-cd5b-4d08-a343-e0a78e678d4f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4688b113-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845997, "uuid": "63be4aeb-0937-4a01-9f03-c08c61580537", "comment": "Malware payload (Mirai)", "value": "8f30fc54e4164e2ae669de3ddcb30dc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845997, "uuid": "8da0d82c-7ed0-4678-aa95-4319e1267da4", "comment": "Malware payload (Mirai)", "value": "334c62fac9626dda90055d3226830c100b3cb09fda87cd02bbdd96da90c09580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845997, "uuid": "5bd47cee-f12a-4fee-b608-14c36cb3c33c", "comment": "Malware payload (Mirai)", "value": "1de850e9dcb8b3e0990c54c52cfaff734b1e1edd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845997, "uuid": "35e00ec0-8ae9-47df-8485-a72fb1ab6aca", "comment": "Malware payload (Mirai)", "value": "f95731d9d5d932611ba4d987bb6f1be5cc27bcddd91d8d4fd8c2af6bda0e4e35380cf4751d5e2807b09e7eef2d422a43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845997, "uuid": "7e86cdba-fb8f-4048-a919-d45e63d59426", "value": "T1B4E3C709BB610EF7E85BCC3B05ED270628CC596726A93F767634D818B54B24F26E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845997, "uuid": "6dd0921c-ae73-490e-b80d-ca013f20749b", "value": "3072:XXE83SK8IAQdWQaljsm/nENAUkzXCRVB7I8:XXEuSK8I7EQalj9vyAUkroI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845997, "uuid": "9388438e-414e-4ec5-a360-c7b3eec6f22c", "value": 146468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845997, "uuid": "cba02192-e4ec-4df6-9286-25143f277c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845997, "uuid": "8b63a5f8-48fe-44d3-9ce0-be0363b54c03", "value": "Mystic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3822938f-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845973, "uuid": "5b38be4b-e447-47e3-9f92-4b8b5d6dcd83", "comment": "Malware payload (Mirai)", "value": "de5f1a2a0001d68b83f3d57dd5f35823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845973, "uuid": "0e67bbd4-e029-49e1-8ac5-7a66a7d8dde7", "comment": "Malware payload (Mirai)", "value": "33834e3fae8e31d3655189abf0cf3033305a586263d35613344bd3db2aff6124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845973, "uuid": "3e0e458f-293d-4038-a8cd-d98e10b90385", "comment": "Malware payload (Mirai)", "value": "10f7cb584e16c8c7d516b32e48efcb0851610c71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845973, "uuid": "39047f55-5f97-42cd-8e05-d900830d8203", "comment": "Malware payload (Mirai)", "value": "6658944500e8ebf2f9e0739989860ecc166c89b578150f57f9ea9ab888010391343ce1d4874af467a25ee79d964a8829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845973, "uuid": "0d408613-2a4a-4df7-9476-a61199052583", "value": "T18AA39D36D429AD94C14585B8F4E89E350F13F1C063932EF72AD9C6A5909BDA8F802FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845973, "uuid": "a6c30708-983f-43f8-9d64-e02f22f2ce5f", "value": "3072:7ZUavcxSRqARfMHQ/QFSOYeTBNeopn2q:7Zt8YNKSOdUi2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845973, "uuid": "ff54421e-388b-4d58-a6da-b48013b83649", "value": 99644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845973, "uuid": "45864ca7-0de2-4130-825a-cb43f77e3026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845973, "uuid": "3c903daa-d742-45b4-ba7a-7080b93b8f77", "value": "Mystic.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51af8237-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846016, "uuid": "0c1a0d21-a3a3-4c66-aa66-1108dcf91be0", "comment": "Malware payload (Mirai)", "value": "b5551ed24d1bf3a9851cd272973ed2cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846016, "uuid": "cb422736-9322-4b2f-b907-b8bb62274e7f", "comment": "Malware payload (Mirai)", "value": "3533aa5a7723d878df198d3433419df2a8140abceee40d252e929ee4a4e2bccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846016, "uuid": "e3319ca5-6c89-4f61-a6f9-84fa333cae7e", "comment": "Malware payload (Mirai)", "value": "f9e13a910420442e4e34d0480e7f970a924f4c72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846016, "uuid": "d3177be1-a435-4c67-b571-b56a5c5e23c0", "comment": "Malware payload (Mirai)", "value": "68c2cb6e875931ef140039e0daba118286d342b0ae328d2dfac39798ae58d70e070edb33c3f093e92e5a3d7cf3e070b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846016, "uuid": "474eff43-016c-409d-939b-761c47174bc0", "value": "T135B33A07F98180FDC19AC138437FB53AEC21B5EE023CB2A75BD4AF222D49E715A19D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846016, "uuid": "76e999ae-e345-4986-a52c-74d9c01398b2", "value": "3072:RFKzrrLVFDvKenIjDWHnTw/4RChca0sc/8Ks/:TKzrrLVFDyenIjDWUIUdOzs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846016, "uuid": "12dbb097-5f78-4c1f-b105-935837a408ab", "value": 108368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846016, "uuid": "520558c0-22ca-4dab-a8db-e6691f231398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846016, "uuid": "335ed086-0e5c-4c9c-bafe-7de87d6d1b0b", "value": "Mystic.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c52de4-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846020, "uuid": "8944b759-93e3-4ca6-9752-058012a3546e", "comment": "Malware payload (Mirai)", "value": "b1781b92371be9e86d00b95a6c4c2e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846020, "uuid": "7fc9ec1d-a0f1-42a0-af43-7110b7eb79bb", "comment": "Malware payload (Mirai)", "value": "36fd96de48e0cb3d15d8c939da248fdc0e11da6c476946573e16f3efe4876bc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846020, "uuid": "28f0b481-030e-4d59-ac90-d7cb4317f60a", "comment": "Malware payload (Mirai)", "value": "245476133b7fddd3efa8e9fb624b66fa00cd09be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846020, "uuid": "5c08a32e-8f6a-49e5-be4f-ffe6b1d8f9dc", "comment": "Malware payload (Mirai)", "value": "88a2912e698c35eafce797673552b9d38f9c8158c9cd159ccdd442316bf0e1f06803aa64c75418a0ee3b2bc39cfbaa56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846020, "uuid": "66454e22-ffaf-46dd-93d9-6cad8244edaa", "value": "T1C3D3D51E7E258F3CFBA9823447B79E25974933C627D1C486D1ACE2126E6034E245FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846020, "uuid": "31c0b309-3f57-4bd5-8def-6269af6d2e8e", "value": "3072:fEWWeB/18VbK6/38zCkyhc1SOWlrIoE41PDVDu7/E9Ovy7h7Ivzsd7emoyHlWc9/:fEWWeB/18VbK6/38zCkyhc1SOWlrIoEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846020, "uuid": "e8b62dcc-309d-424a-a51b-86dfab475685", "value": 142964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846020, "uuid": "dbabe49b-9d73-4b0f-88a6-2642824b89b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846020, "uuid": "a82d89a8-40f2-46af-ab75-43470f6022b3", "value": "Mystic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d3659a-6278-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780840607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840607, "uuid": "9d7fd4ba-28ec-4cd8-99c5-a22b50c8af87", "comment": "Malware payload (ACRStealer)", "value": "0d2fa4d22c758c7aec71064d2287ae7f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840607, "uuid": "9ebf8e87-d032-4893-8fc7-6e8fb3c93480", "comment": "Malware payload (ACRStealer)", "value": "371c42cf9d9073220796f1a7005c006c3e8e816fc72065297c80294585442bc2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840607, "uuid": "2cabe8c5-f4b2-49d8-a9f2-86004489ed4b", "comment": "Malware payload (ACRStealer)", "value": "c6c0dd8d8f8f91405c50a8f7dcd916d77af58cd8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840607, "uuid": "1153af42-cf60-4b21-9b09-6583bcb7255e", "comment": "Malware payload (ACRStealer)", "value": "8990ef06ac50c26773e5b73aaf0e152b8c21c65eeb35b07d06179df7ccd928f6a088bf7e48531618b8e2ba1a6a18656e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840607, "uuid": "91c7b3bc-9c54-4f4d-93de-21b067436a7b", "value": "T183A533D75F8E658ED5EA04B0D3B1CA157DB8F84C1A94893F4FCA1D015F688C31B3A68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840607, "uuid": "6e54d0ad-5d4b-4b8a-8abf-cac340f2f2e5", "value": "100d47b03956ebf7738cf934b7d6a60d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840607, "uuid": "ba163931-3e30-4355-b17b-d8b98e65d8b9", "value": "49152:28M0XbXKmQx6OazTs/GicJYF+LIf/ZVgVwgZ8HzdmH8tVaJS7c:9XOazTs/82kIf/zgVwgf4aJwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840607, "uuid": "249b4c21-ed66-4fdb-8887-ae6867449447", "value": 2139648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840607, "uuid": "bce0f334-88de-4dcb-8baf-1dd4ef72566a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840607, "uuid": "d780113a-12de-4ef6-8be0-3a70ca870eab", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c494d64f-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859094, "uuid": "ce8faf8b-8a87-4bc8-93f9-135562a1a4e2", "comment": "Malware payload", "value": "0b015c8778c277a07fde4764097b4180", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859094, "uuid": "f2ff6c98-2c19-4356-8669-1925cccc5282", "comment": "Malware payload", "value": "3735d22050a7a8008a8db9b875105a6c33ff434047b4d40081a5569da957d868", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859094, "uuid": "27aaf83a-f492-4a85-ac13-85f67d76962d", "comment": "Malware payload", "value": "ea1d1014da90bcbb1518aa9db84148e46f08e9f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859094, "uuid": "b9263fac-481c-48e6-85d6-30e93d7c5e66", "comment": "Malware payload", "value": "0108718015a31b5487dd90aa185ba8357507cdb6da267700c48acbc28590915897def78cfc51c6b4369caa66732f3ade", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859094, "uuid": "4724c696-7a74-4eb9-8459-f9a068189ea8", "value": "T121565B47ECA515E9C0AAE23086629253BE717C495F3523D33F60F7282F76BD0AA78750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859094, "uuid": "05d7d0d5-c427-4188-b5ea-ed97dffa1c1a", "value": "49152:d1+p0I653L0gWQWJKYlNpjdc+HXggzDL46omhjVAIgC80lH+7GkdhMz6A9HKQKDz:dUtQOHXclgzDvTt8E049n+PEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859094, "uuid": "77a7e5bd-768c-4275-9d9d-e99680351f8e", "value": 6029604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859094, "uuid": "46071042-2d58-421e-b6c2-15bcea061a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859094, "uuid": "025fa3b6-ba39-4e2c-8f23-54d626b29356", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149bcb48-6295-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780852786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780852786, "uuid": "35eebee4-045b-422c-a50b-8fe8b383f9b6", "comment": "Malware payload (PureHVNC)", "value": "d97a2d5bc821aa0f87f18400bcff248a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780852786, "uuid": "32f744d3-237c-4f46-a611-6a91e7c373e3", "comment": "Malware payload (PureHVNC)", "value": "376246273e913c96f6732eb04fdf1900f28f121531848219cdada3c9f271b16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780852786, "uuid": "3be22fd9-0bfe-407d-9676-b8c69d8c5118", "comment": "Malware payload (PureHVNC)", "value": "b5268508b83e26e00158b9b55622b5b28fb4e277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780852786, "uuid": "87fd8a1c-2234-42f7-960f-2aba20bac300", "comment": "Malware payload (PureHVNC)", "value": "dfe46272e23db9d2305c1eb1c30aebbc86703863b64225c0fddf3deeb8f01cb2332dff2ee877af93088a279eb7ecc0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780852786, "uuid": "44e29b9b-f43f-47b9-a4b1-4cb448454fc4", "value": "T116F4BF2BB6528E12C2C45733C1C7690493E5E6827533EB0F768923961E473EBDE4A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780852786, "uuid": "8a237ef9-c7ee-4cf8-b5b0-9b78af1b1372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780852786, "uuid": "849296f0-f059-47f0-b05c-e59e693efdf5", "value": "12288:vC+zA4WKjGZOETwV1EhKCcacD1ythzdK/H0QomiUSoPXySOfvyznURZ9ri:S4awB1EYCcacDwtldK2miZcXySOXyzU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780852786, "uuid": "f7551da0-2f9e-44c5-a849-776240399fef", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780852786, "uuid": "f9a23767-278f-4791-adda-2d35bb38288a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780852786, "uuid": "15dbd015-0324-43b3-b712-6d1c4370ade6", "value": "SecuriteInfo.com.Trojan.Mardom.IN.10.59399691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1a07c1-6233-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1780810704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810704, "uuid": "6c6d3ffe-46e1-4710-ad69-34de23e07af9", "comment": "Malware payload (Kimsuky)", "value": "a7da58d034366bcfb291e3fc4d869756", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810704, "uuid": "539f7f0a-3ad0-427e-a412-f829f7d23568", "comment": "Malware payload (Kimsuky)", "value": "37933abc647813d1ddb8b780f7bebf50ec09fc6179e4ef43a20b1734a4af46ef", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810704, "uuid": "c8d52c4b-35fc-4b76-b856-408d982e6ee3", "comment": "Malware payload (Kimsuky)", "value": "aca3c1a5a13a0f0890cc3f7739f503924bcddcb7", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810704, "uuid": "7db57257-4fbd-49ef-8d54-4dfad6cbcf29", "comment": "Malware payload (Kimsuky)", "value": "31e78a5bc63871fc1dd60a92975f55494eebe16c403857e4b4a96f3ed0f71883cbbed4360712702477b843eb5703ed85", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810704, "uuid": "b2ad1e0b-c53e-4d8f-adbf-ba36133d087a", "value": "T19FF2D67C63AF771BD176E44999DA92A771488FD171100D346EC9038D9F3EC8A39C2A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810704, "uuid": "5bfd32c8-2862-48c5-a780-2743c2057892", "value": "768:CcgYug9dOP0Um1c+ASDOleC6jrwbCOikTJdCx3dx:OYugvOPLm1c+ASDOwCkrJOAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780810704, "uuid": "fb36a74d-e6b5-44a9-bb5a-189c7025cd9b", "value": 35249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780810704, "uuid": "64e04086-88b1-4db7-aaa1-d215b0fc9433", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810704, "uuid": "4c493aac-7140-4755-9f88-884fa238e34c", "value": "requirements.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5beabb-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847432, "uuid": "c99f7697-5168-4758-8127-20223316bf89", "comment": "Malware payload (Mirai)", "value": "9451485f393a65ccba794da96f2616f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847432, "uuid": "ba9805f8-db26-4ba1-8e0c-84c469f6bbe9", "comment": "Malware payload (Mirai)", "value": "38679f84b82e188affb462c17e50e5b352ca53f469b7424473bfdd0da8afcb6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847432, "uuid": "27413b3c-f3b3-4ba5-b947-95038fe8cf4e", "comment": "Malware payload (Mirai)", "value": "590e725a676ac1cdeab2d565998aa8b5d1eaf1b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847432, "uuid": "bbe80f00-6980-4045-b110-51d19c20de14", "comment": "Malware payload (Mirai)", "value": "8d6da28c6b60d7f4c1a97d75567d1439f0e2e0ef2b32018cbb562e93df9f1b44e503483ac478446d5b7cbde70276a038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847432, "uuid": "567f65e8-38d3-4093-8c1d-f4d8df0632e2", "value": "T1D7A349B3D8262E68C566D4B4B0B48F792F63999082835FAE5577C2B48443DCEF8057F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847432, "uuid": "b3065e3f-138e-4e9c-beca-2ed3952619ef", "value": "1536:HiAtYZWVXd93A2NCCnRKT5MoUuNGvKbyuWe/YgVhtR7L+y:CHZc93A2QG4T7GvbuWeggVhzL+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847432, "uuid": "9e695c79-f23c-4c98-9a14-47b330ea9278", "value": 103620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847432, "uuid": "ee8fd325-3572-40b1-9d50-73830a0c81da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847432, "uuid": "f812c6e3-331b-4f72-aa74-dd8bfa79c69f", "value": "CRY.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83aab46-6259-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780827317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827317, "uuid": "6580b22d-1816-428a-b8d7-3caf0d1be528", "comment": "Malware payload (WannaCry)", "value": "8336abfbef0f930a737b2bd32f34d35a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827317, "uuid": "114b78d6-1572-467d-9cf4-5bae868d8f8f", "comment": "Malware payload (WannaCry)", "value": "38777665efc7ee0a09a5ff7edd6ba46b64a3c656c4adaf6cd1de10b1cee02c05", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827317, "uuid": "dd0333a3-ffb6-4eb6-a1ee-c46dd33dc157", "comment": "Malware payload (WannaCry)", "value": "4591525a6b61bd71afabf04b1a9e51a6a9700562", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827317, "uuid": "c3f4556e-a306-4a0e-8f64-e7874fb17b7f", "comment": "Malware payload (WannaCry)", "value": "f5fd2f3f7ff443bc8531e42279dc4dbb8c025ff3eecf7cd69188f652d5f81e855b306fa640248c6e88c45d9b8cfb52b3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827317, "uuid": "4517f53f-59a4-4081-b211-5dd1526fb3fa", "value": "T1E436E009B69A8038D47305B59A3A967C657EBEFC5F0DC4AB35A4F3AD7833D816120E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827317, "uuid": "4076021e-05b7-4d33-a1b3-dbbdd8d253b1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827317, "uuid": "5b3e4bff-f035-407c-bdc4-9f429b9465e6", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P53AV/:DI8qPe1Cxcxk3ZAEUad9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780827317, "uuid": "283e1864-b529-4472-8df4-301c57b00f79", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780827317, "uuid": "d3c85b12-e004-4f97-ba59-71289a5301c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827317, "uuid": "a71d90f1-bd2c-41e7-9fd1-3bad64135da6", "value": "38777665efc7ee0a09a5ff7edd6ba46b64a3c656c4adaf6cd1de10b1cee02c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b9eda4-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859201, "uuid": "d8dc63e2-6729-4cfe-a564-eb3622cb5b2f", "comment": "Malware payload (Mirai)", "value": "849ea1035c9188ad3612cc88a5cb1966", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859201, "uuid": "5f39b934-133e-432a-be41-bcf9cd3b5a3e", "comment": "Malware payload (Mirai)", "value": "3895f3b7368cb2c0657cb743506fe388bd18263c025d391b99a74052d376c04e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859201, "uuid": "c58ded3d-0ef5-4019-a622-15aaa0850c02", "comment": "Malware payload (Mirai)", "value": "2f36b99424e100c7d5cdf4fb5124e87342d3a214", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859201, "uuid": "411b1378-62c5-465e-9ad8-d64215352246", "comment": "Malware payload (Mirai)", "value": "ea34e1b92ae2a7427b60296c33d9cf2b755e5f8dfedcbb9dd668e832671ebf9f8801810733fe805175b86506c46a170b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859201, "uuid": "347ee09c-f4fa-4431-928d-566cd92dcab2", "value": "T1A604B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859201, "uuid": "3b586967-d08d-4de2-b290-ecf2dbd12686", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2H:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859201, "uuid": "04335f81-43d3-4462-8d1c-b6e4eca1a560", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859201, "uuid": "22168cdb-77b8-4084-bb72-9a253ae62960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859201, "uuid": "c261e56e-9c08-4674-adc9-263e17fec2c1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0327d8bf-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859199, "uuid": "69dd275f-4c96-4126-ae56-53def8ad993f", "comment": "Malware payload (Mirai)", "value": "d20c95db4f5e78ed5b35bf6f29cedad8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859199, "uuid": "1fd4f49b-a23a-4e73-b4ec-e5911d60ccda", "comment": "Malware payload (Mirai)", "value": "394d90529db4150272fd16b51b05188528caeee08754d8caef26a0f8d0d56109", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859199, "uuid": "4e80a098-d0ce-4b57-ad24-975e4d1da368", "comment": "Malware payload (Mirai)", "value": "d3121751eb33ddfa806c68614ff439fe85bbb9ca", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859199, "uuid": "c515c356-ef71-4526-9d4a-0293e2859de8", "comment": "Malware payload (Mirai)", "value": "d1b8af372c72ce98818ffcacd94f8f18d46c4fe557b5474b48df919e3fd85dc5a82aec09f12b6038f6194a79a51f38b1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859199, "uuid": "703c29c4-9967-4dc3-b529-91d24f3dde2b", "value": "T143344B45FA418A13C4D217BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859199, "uuid": "52196949-a8c3-4d1a-8f74-6a14953723c7", "value": "6144:W8tTPACOBzabKacEK1dAnJd75LfdfM/9hWfAU:W8RALBzabKacE62Jzp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859199, "uuid": "5d83055c-d496-4105-98e8-a83ce9a96429", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859199, "uuid": "bf2295c1-e1ce-400e-bf62-9184099eee2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859199, "uuid": "da320fce-36e7-4d6d-8e46-064fb9aaafc0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4844da-6288-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780847587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847587, "uuid": "80e47d8c-723b-4b39-b033-a5fed692235e", "comment": "Malware payload", "value": "a1016c92bc23de31501ef692b503e1fd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847587, "uuid": "f8f355f1-4e79-45b6-8629-303b133192c5", "comment": "Malware payload", "value": "39f38ae200450ca77e52f2287d41e06ce3960bbfb8c7b7d2c18369cc2ad41526", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847587, "uuid": "acda2517-3330-473a-a17c-2c31554b7cb0", "comment": "Malware payload", "value": "d85daa4e4a694148fefaa8cec594a65a17c58253", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847587, "uuid": "0260b155-0b17-4b76-99b7-2a59dc7f6d70", "comment": "Malware payload", "value": "8b8493cd201e82d90a8360a3cf861e6f692be620d9523d1ea2a2fbda071d9ceb972121e5a3842418767dcc623effe638", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847587, "uuid": "f669a07b-8e9a-4a4a-88a8-22b57c5a1415", "value": "T1FDF5335D1779F360CFBF94F66978628F5DB30A035C7C47DD22CE00621E9ADA401AAB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847587, "uuid": "006e9b95-faae-4542-be28-4277a1c8d6d1", "value": "76728e28d08f72d2d735736185134ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847587, "uuid": "139d2e98-99a1-40b0-a7ee-a0b8eddf77d7", "value": "49152:zAzznrlg3yXlYO9WSJyv3wY4ws1t4TOnBhLUcbWc64DuwLBE7h3U3Xae7GTR5x/k:zWDR4UXIiyv34OYdbWc64Due//76fEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847587, "uuid": "d0f4b42e-dcb7-4f2c-b294-51a23c75b9cd", "value": 3495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847587, "uuid": "dd367377-406f-4a04-bf39-0b47d9074a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847587, "uuid": "1ae0d160-c0e4-43ed-9279-55bd26ec0ede", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969af80e-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859017, "uuid": "4c281ed1-3b70-450c-8270-690032822ef2", "comment": "Malware payload (Mirai)", "value": "e82585d6bcc47e8c3756abb3b80cef20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859017, "uuid": "e72c1add-b77e-4058-be19-e531ab546ecf", "comment": "Malware payload (Mirai)", "value": "3a5893bb34b85d07750f1b4a82501c35010fec10ff0f355178a4a4e193c13055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859017, "uuid": "abe5ad76-6ffe-4168-9177-c8751e3f72ad", "comment": "Malware payload (Mirai)", "value": "2e41e7e1b36a7d6cca0a516786350208fbddcd03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859017, "uuid": "7ed4c61d-ff48-45f7-8314-f3709f137f30", "comment": "Malware payload (Mirai)", "value": "57b040b907eb9a1a87a11997ea88dd760a65a947a8a9f873923d0147a09229f9357b26f00a202b8dfcd5f8f2e3489ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859017, "uuid": "f3a099b9-f3ec-4fcf-aaf9-1598f0e221a4", "value": "T1B814B40A6F610EBBDCABCD3706E9174228CD641B21A93B757674D924F10B64F1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859017, "uuid": "d2865b17-729c-4bc4-a98a-028d94f38e75", "value": "3072:KV7i6QdQFBO93r35hzreeULE9lLoOZR56:KV7ifdcOp51XQSLooR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859017, "uuid": "9a6fa12e-b697-415d-876b-04cdedaa9275", "value": 198148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859017, "uuid": "b3f498a6-5bf1-49ac-8acd-c839defc3e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859017, "uuid": "1028c404-07d7-4bae-96d4-0d06bdd88aae", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ea5199-6224-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780804488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780804488, "uuid": "009112c5-e3ff-4484-bf53-ef5b599625d6", "comment": "Malware payload (Mirai)", "value": "b0621686423b80cc5f382aa0f5bbc224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780804488, "uuid": "8f4c2069-a054-4eea-9e8b-168681759768", "comment": "Malware payload (Mirai)", "value": "3aa1ef439f4906a332b0b036ac439cced5248e2417fa0727a90df2fbd9e0862f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780804488, "uuid": "4c100965-a99b-4729-8246-699b5c608832", "comment": "Malware payload (Mirai)", "value": "1cbe1b8f78f23cd110707d5b014ec7e7194e8224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780804488, "uuid": "3021ae25-1945-4830-930d-7a261089723e", "comment": "Malware payload (Mirai)", "value": "7c8877776d01e6b9dd18796f6cac4b84b613b6fb9b13089a8b35beb1a80c9bdb8efa74fc0ddce0c80f85c69845069206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780804488, "uuid": "e252b2a1-e3ab-4f33-b6de-f61ad13e56e8", "value": "T1A7D3C032E0145C91DC2116B9787A8A780750EF7017CA2586FEFEF6AB747BD9434AE360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780804488, "uuid": "e6dc4ad3-95c9-4782-9078-ef0b5ce5b1d0", "value": "3072:9fi4NJ5LUNPEumqlvbSNURtExnOdYrm3zjed:9645EPEu7JPGnOd4m3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780804488, "uuid": "fff12e95-cd3e-4156-904a-20cb1f88c66b", "value": 131780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780804488, "uuid": "62c8b806-30e3-4c46-ba5a-682a860d74cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780804488, "uuid": "d5893509-dcf7-4cb5-8292-90d3405a3f6f", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83df0b4a-6208-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780792413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792413, "uuid": "66900fc5-f901-45a3-b7d6-cd31a95afeeb", "comment": "Malware payload (Mirai)", "value": "1518c136d675aa5ff4af9192ae37e928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792413, "uuid": "765e6ded-4e32-46a9-b133-3fe8446a50ef", "comment": "Malware payload (Mirai)", "value": "3ac386dde3d129212d70667f9eec7125874e08b838f6f80fb4e38b11e628a4e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792413, "uuid": "06b4afe4-e685-4dc1-aa86-0283b95b8797", "comment": "Malware payload (Mirai)", "value": "cef5c568d5efc6887f19e2c7e7685dc7fbbb358e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792413, "uuid": "686f9d78-79ba-4299-a1e0-e57c1bbf810a", "comment": "Malware payload (Mirai)", "value": "8561647362af4ed28f00fd0f48785d82fe46a50718499e1fd03378d7a64ec2d8f4c3ff97218f322f5cbac11aa0cd60e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780792413, "uuid": "93912900-2a23-4e01-b50c-7eaa80aea3d1", "value": "T1E0F34B07B7108FB1C358967009B78B679AE626A21AF1D985E76DCD107B3439C6C3FE90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780792413, "uuid": "2add971e-c08f-4e8d-91c2-04efde6eb9ba", "value": "3072:Mld83GuhFDyS/W9ThvFnFlz3whRozXXGxpztzbzvxefaWs:Id82ubxW9FNnFlgyXmpz9aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780792413, "uuid": "4130d1e1-d47c-4688-aef7-b264c299c3e3", "value": 170656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780792413, "uuid": "e9fc94a2-e59c-4a97-ba44-c2ce84f71f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780792413, "uuid": "10186740-869a-4974-ab09-003eb26deacc", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c904a68-623c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780814708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814708, "uuid": "86883788-ff55-4d0d-bf9c-0290d1219974", "comment": "Malware payload (RemcosRAT)", "value": "52bc77a55cd32e304c8c8c4466ab23e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814708, "uuid": "74fdede9-41e8-43dd-b478-52a308d3c78b", "comment": "Malware payload (RemcosRAT)", "value": "3c7cbbed9bf0fbebed1588a5a501152ecffa2daa64f164f9389cf0774efeab52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814708, "uuid": "b4c8c5ff-d1fb-446f-896a-b6dbb8cb8593", "comment": "Malware payload (RemcosRAT)", "value": "715876270911f93e251a5bbad1f6f0f7555678b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814708, "uuid": "83fd2d61-4fda-4033-a7a5-d2216cc4f24a", "comment": "Malware payload (RemcosRAT)", "value": "dc4e73448c09356b2fff566abaa00d5760bcd35fa1251c792ff52873b94a6ff7a90cf45e894fbe5f42065bf8b9bd873b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814708, "uuid": "3052fada-b1ba-4bd0-9c50-096a792fa6fe", "value": "T13AB4AF02B6E2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814708, "uuid": "a59aae22-eb43-422c-9b7a-6aca5075a861", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814708, "uuid": "06eae84b-9bc6-4289-a1f4-6acb29712d25", "value": "12288:FlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZS2j/:Fl0GcNUJV8i4mHM9/DZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780814708, "uuid": "90023a38-ed91-4dd9-ab04-4c984466860b", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780814708, "uuid": "6262439c-7abd-458b-8252-274cbe6e2766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814708, "uuid": "e61f15f2-52f5-4592-81dd-6633744c2882", "value": "3c7cbbed9bf0fbebed1588a5a501152ecffa2daa64f16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eef8976-624d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780821906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821906, "uuid": "6e8009a3-5fc4-4e67-a2fa-85586b2007bc", "comment": "Malware payload (NanoCore)", "value": "d4458c5a85612a4a2c5a3c0a1ac18560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821906, "uuid": "fa7cc611-0850-4f44-b813-325603e39a69", "comment": "Malware payload (NanoCore)", "value": "3fc87275954273657917b849d85fed130a8c8392950d64004f8b9fd61b97603d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821906, "uuid": "aa5f7f08-daab-4205-810a-05b71690afa3", "comment": "Malware payload (NanoCore)", "value": "d27d8164067a9bc20d6bc74dc02e9b3995a3cef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821906, "uuid": "c6b21012-8d7b-40ba-b61c-2e4b5e023756", "comment": "Malware payload (NanoCore)", "value": "f9d92482fb06479732282c255befadfbdfd7414310da2acce5782b574618b445193fc1feb407872908fe829599d1dbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821906, "uuid": "19d1bcf8-4591-4ac5-a38c-c81a684a9b88", "value": "T1D114BF567BA88A2FE2DE8578611202128779C2E3ADC3F7DE18D420B78F567E50B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821906, "uuid": "5ec4b26a-cdc7-420c-bc3a-c80289077751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821906, "uuid": "c687c871-af77-4d45-b7e2-174153492cd3", "value": "6144:MLV6Bta6dtJmakIM53G9lT9E6CvvHPfI2x9:MLV6Btpmk4GrBfCvPPfIW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780821906, "uuid": "a03d2cda-5def-4db1-9f06-ea09eaff9248", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780821906, "uuid": "d79708c7-ab38-49ad-a80d-7eb2f023cdb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821906, "uuid": "5696434b-c7f7-4df2-ab1c-687a5fc73299", "value": "frans-meijers.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64e48d5-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861190, "uuid": "1bd8fd5a-314b-4777-850a-90e95e9ce31d", "comment": "Malware payload (Gafgyt)", "value": "de7a76e12185096d232a8b8176238b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861190, "uuid": "ae513093-44e2-4b69-a48f-6ce3f7009a57", "comment": "Malware payload (Gafgyt)", "value": "4164f83e2641229b0032d23b8cd8ec10b77812c7e8350f1d101813798128452d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861190, "uuid": "09151370-7ba0-481e-a46d-5ce290e27856", "comment": "Malware payload (Gafgyt)", "value": "0c53a61e1c1f7c2e3a25a57a47c23deb3194f655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861190, "uuid": "0887c089-8507-4b71-a33a-5cd25812c850", "comment": "Malware payload (Gafgyt)", "value": "05677122dd6de09c572d2230b0a9ebd3d680aeb791c45030c3cdbc9ff4315d4f8c2918d9df3e53e4f035398323142d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861190, "uuid": "ed63931d-7727-472d-8f3f-bac823161724", "value": "T18EB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861190, "uuid": "ecca7555-dd2d-44ee-90c6-179a89f708b2", "value": "3072:MSY+46m1qOzssCFPPKNy+AmkZrQAhPDCXFke:06mgOzJCFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861190, "uuid": "2f9e280d-eb66-4796-af50-830490855e2f", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861190, "uuid": "5cd06105-c8dd-4932-947a-755156396008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861190, "uuid": "3703a67d-7434-4f15-ae40-54bb8dec6ac1", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c928527b-62b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780865114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865114, "uuid": "11681d69-20c7-4cd1-bb0e-1d642c07369e", "comment": "Malware payload (Mirai)", "value": "5b3a43bbf0d38ef69c9b46de14656901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865114, "uuid": "771a0246-f425-4999-9c7e-5fc48100833c", "comment": "Malware payload (Mirai)", "value": "4187780e7a1fd9187348e2f8ce4331a4066de75dbcea3deecded8cc2f4c678bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865114, "uuid": "45d86533-5074-44cb-9d98-a466ac418172", "comment": "Malware payload (Mirai)", "value": "fd881b6d7a7d12c1fbd8eb07e69377017c4e1640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865114, "uuid": "4ada27ff-8e8b-4ee5-9087-26d417a94a9c", "comment": "Malware payload (Mirai)", "value": "30ed649951efa6c6b2265cf0b6fc077d9db1954259bd61876857ab6eb0158cc0d082e39c4d880463368f14ead06e3314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780865114, "uuid": "9bb61dd9-aca6-4e5c-9469-e5866fb6c4dc", "value": "T115A3AF22CC745D5CF02A6EB020B58BBA8B23A044555B6DFB3996C3355047EDCF19BBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780865114, "uuid": "3b12f9d5-f440-4fca-9687-35673ccae6d8", "value": "3072:hvFW+CdM160KQ+ufLl01POzIG8bOQjH+:hvF3eM16xQ9pl4Cs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780865114, "uuid": "16e56543-5a17-4dbf-9b04-af55cff742b0", "value": 98508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780865114, "uuid": "34dc8031-3460-493d-9c82-8b34db6462df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780865114, "uuid": "e31e00b9-00e3-4b1c-b952-d6d2ba628955", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c9cfbe-6243-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817540, "uuid": "87d3fc2e-bc18-408a-ac5f-97e26ccecf92", "comment": "Malware payload", "value": "c889387120aa23fec0707c843b780575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817540, "uuid": "660b3229-2231-4b43-a01c-3dce63f5b18c", "comment": "Malware payload", "value": "426b7c5af08898de192d7a117aead80ec18b77e01bc1aa9e91323090d90dc413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817540, "uuid": "0e38ffcc-f679-4391-a57d-e44927ff9a51", "comment": "Malware payload", "value": "fc5b82c05e61cbece2057e9d9e3286d0d3de145d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817540, "uuid": "3a78ceb1-6903-47f4-97b8-8ca131381b0a", "comment": "Malware payload", "value": "4e16956babaa9770b34c40e6335653fc50e956e318dd9f33e2bc436e026e9c4c29d88f667a2ea77fe409650050ba4212", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817540, "uuid": "b7f35eb9-bfb4-45f6-a636-bd14b32f9aec", "value": "T12C93DA0B3E215FACF6A8863487B34E359F9876D126D1C2C4F5ACD7082E6470E581F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817540, "uuid": "2b24636b-da23-4d70-b01f-1fc922dd886e", "value": "1536:9sHC5S5YiY5dBcpvHbkWYoz38BtNL2fV+z1dt9pCX6lMjODloDAnxNXO6q+M+Znv:9sHEXFgHzqNad+9b7Znv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817540, "uuid": "9adcd331-10fe-4a10-9f45-c62aff03788b", "value": 91032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817540, "uuid": "271c079e-a092-475f-b38e-7e90a3b5e5b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817540, "uuid": "ee76b1d8-17c1-46e3-a3df-64e74aa5fcd6", "value": "Y2Jt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b0cd34-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845967, "uuid": "e65c832c-39ac-4472-b515-e380a197d1c8", "comment": "Malware payload (Mirai)", "value": "44f6439cebf6429e60ea39754801db06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845967, "uuid": "7aa9f798-a3cc-4d15-857f-012f7fba1406", "comment": "Malware payload (Mirai)", "value": "428bc00d4f495d04e0d1d740fed86a4bae53e2128d7fa9262f7e431918164662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845967, "uuid": "fa685507-b904-4317-a665-9b40b5698d62", "comment": "Malware payload (Mirai)", "value": "43ed961ba23dc19bdfa8f7c5752cc55ab84095d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845967, "uuid": "ebc556dd-e018-4f6b-b4e8-8defcf6e1879", "comment": "Malware payload (Mirai)", "value": "04e07f292f9f3d2a176500948de3a4faaefca2e59f223ed005ca1fdc9dd591d310f9f14e859eea44d49c154a648f09ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845967, "uuid": "2af2daa7-4c83-4849-95dd-631bfea3bf9f", "value": "T112D2D1311D5A9D74C8B8243DDEF99A8B678716B8E39CB6B271090F60B6C148731DC9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845967, "uuid": "8f97304e-f3b0-4892-a4cb-ce47110a2dc1", "value": "768:KTCd7jAn81mZa7DSE875FXLF9E/kXIMs3Uoz+L:TdPo32SES51F9WpzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845967, "uuid": "ccee0111-5dca-43a5-ac85-664295ca31bc", "value": 28824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845967, "uuid": "a9367216-b063-471a-947e-d8b2e980099e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845967, "uuid": "b04eb1b8-7e63-4dde-964b-08a5326dae44", "value": "Mystic.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9800f85-621a-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1780800288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800288, "uuid": "21db761f-560f-4884-a123-16f9b8a32767", "comment": "Malware payload (Berbew)", "value": "bf66190bd054f03cd58300672609ae10", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800288, "uuid": "7d805ac7-cc69-4934-978c-39c3088529fe", "comment": "Malware payload (Berbew)", "value": "43483130d3303ff2d67946e2b30b77b0e9b785ab9b56a65f82d001d4c8a77519", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800288, "uuid": "e5687556-8c16-4ed8-8b6b-97575084413a", "comment": "Malware payload (Berbew)", "value": "cd84c3a10a2bb535a16d334ed6a3d32e0b28420b", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800288, "uuid": "4e05dab2-f435-4493-85c2-68c5bab59d57", "comment": "Malware payload (Berbew)", "value": "37665af282889455203b49105a46b3eb4a584264cd283a8db1644279a61a163bc2797fffa22ce4de3e6f796a45c9d133", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800288, "uuid": "ae58000d-61ee-48f4-b917-b0abf6557931", "value": "T1A52694E616DC1DD6E48B1B7C14B25A2BCD90FB74043A562219C4E4CF5E8EEDB062C7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800288, "uuid": "cd833319-585f-4e4e-a8dd-869d7f209d63", "value": "d89381e0b2b00fbd857eb117c74c146b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800288, "uuid": "ce4439ed-f9a8-4af4-9047-9b1713975026", "value": "6144:6k6DP3/iN1uu8EDJgDJlDJwDJhDJsDJcDJ3DJ8DJpDJqDJgDJbDJbDJYDJlDJ1Df:/6Rdon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780800288, "uuid": "15d83ce9-5f77-4cb9-998e-c753717a711f", "value": 4708440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780800288, "uuid": "44501ea4-e515-49df-9352-cbfb7cb852ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800288, "uuid": "6203b795-954b-48a6-9e4a-4ada440000fb", "value": "43483130d3303ff2d67946e2b30b77b0e9b785ab9b56a65f82d001d4c8a77519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7117c62-623c-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1780814913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "e41bd639-0b5b-435b-9e7f-1631282f0cee", "comment": "Malware payload (Socks5Systemz)", "value": "e50f6b124748c7b3c24a86f2d00333bd", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "98fcac69-5fd7-4f66-bb4a-07d47ad696f3", "comment": "Malware payload (Socks5Systemz)", "value": "43b2a1cf4f19631459be0525f5016d87d15f62b1a0163c759a618cf2a6560f6d", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "fcffb52d-df78-48ba-a4e1-b61edb0f1020", "comment": "Malware payload (Socks5Systemz)", "value": "5bf9bf8f2d74f12d39bcd40cf0a922b8acca3a57", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "82503788-71d0-42f8-ab3f-6b1b0de978d1", "comment": "Malware payload (Socks5Systemz)", "value": "be9ac588a54e4d0c6d0cf017f77dd7bd5045f13006bf091955a569907d787e8d2b7f581e86d97a74d5bfbb167012d769", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "096fe728-152a-41d9-8b82-867e1d0d2cc8", "value": "T17AF53313E55E887CE376E97A3A3B8623447E68651132C48F3BDDB6605B111E3E2E0396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "ddde4dad-3671-47ca-bffb-1356a5aae941", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "cc0ed626-a6a1-4db7-9f45-5fa0b7bbc11c", "value": "98304:NMxHRHHiTik2M/9Snr013gpY9nmy8/JMjCl:6xpiTik2g33gpX/JMj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780814913, "uuid": "e6cfc13f-eaf2-4e19-ab15-f0677cd57870", "value": 3650872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780814913, "uuid": "93870b28-3c6d-42ed-a85a-163c89d79b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "18c101ab-f91e-4323-8125-d1106ec423d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7b3374-623c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780814844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814844, "uuid": "21b2fb2b-af91-447b-b58e-2ee3a39bffac", "comment": "Malware payload (Mirai)", "value": "fa0d96fc95e9e856e0947d44214906d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814844, "uuid": "45921bc1-8121-430b-976a-c3a19bc16748", "comment": "Malware payload (Mirai)", "value": "44d14fed0ad4dbac08a92ecf9a6b8544430c0e1890b22f609b0a8f42966c9745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814844, "uuid": "1c5aa7e4-4634-40d9-9ed8-fa41b984f516", "comment": "Malware payload (Mirai)", "value": "c5d33933ba7adab14050d32bb902f042f2346d01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814844, "uuid": "d9795bdb-9868-423b-86e2-9bba11cdd877", "comment": "Malware payload (Mirai)", "value": "71d17b170a3a1626d0cd02c69d7528d7c546b6c0c66cb35eb7f101f68c470d0ddab6ed049aae36fad1a125c91d0ab52b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814844, "uuid": "e0b95642-9aa4-48cf-a253-09431229ac73", "value": "T15963025231769B72CBBAFD360E3B976F51508E87BF7AC1922E60605032628337E155CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814844, "uuid": "37096aa9-91cf-4c35-b8f0-f9baeb5260e9", "value": "1536:gPkdreWOk7uSasPMLkhol6edsw2vXZxRzmmGU9jILEFRq5NLqMsS7:MWJumRol6ep2RLmmGUxqNLh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780814844, "uuid": "44ad7b33-a1f1-4ecf-ba2d-ab90e46ce3e9", "value": 67280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780814844, "uuid": "0499878b-c544-4ed0-af34-c0a629ade780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814844, "uuid": "1f75ea27-129e-4318-ba24-e68b547e2352", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e983da-624a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780820581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820581, "uuid": "cb4101d9-8826-4a1b-b640-36ec3eb9af3e", "comment": "Malware payload (SalatStealer)", "value": "46920eb46518292c5ca414c67833c11d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820581, "uuid": "7f3fa4c3-3c9f-4d87-b058-9a042f40eb7c", "comment": "Malware payload (SalatStealer)", "value": "45277f3dbfb023a9571e4b308fa9679f1ab2d2d68c40d960a22f2c614110c5b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820581, "uuid": "89fb8eff-bc2d-4bb7-8814-f4f7fed37406", "comment": "Malware payload (SalatStealer)", "value": "badbde24a7faae80aa7a3df122f3eb1ca2e63fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820581, "uuid": "9a428b20-9030-423d-a941-4a12bd77c249", "comment": "Malware payload (SalatStealer)", "value": "82a9e0a20587424348db52c148ba35d4009ca70ac96dccfd0bc85623a2be4434db9c8d6a3cc77ca607ce04a27ddc751e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820581, "uuid": "ca4a32cf-6b4a-4d75-993e-bd5bc70f0c74", "value": "T187F5336F47B3F99CDDB62277E20E953022846DC0E98301A7C2E777B5D3041C22359EA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820581, "uuid": "c21c9dfb-d643-49e9-9697-6f555d4ff46c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820581, "uuid": "b3e0a56c-ad14-489c-83d5-97cdf06e3006", "value": "98304:Cx8y55EuTptbPAsaVBN0r3oTPrQaVDsw8wK2uj:UEu7boVVBN0EP8a9swPKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780820581, "uuid": "ec9c8b6c-671e-4865-801f-d1fe86432558", "value": 3596800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780820581, "uuid": "8355ba73-3258-4a77-978c-399c7a8e86d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820581, "uuid": "eaad5b61-772e-4a00-b96e-ada7629438b4", "value": "Dior fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ba3874-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "ba995196-47cb-4280-aaf7-dd3117e7ad04", "comment": "Malware payload", "value": "1e95716a2244120755fcc89be04a9a20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "89bb553d-51aa-4bc7-bb88-6b0368730faf", "comment": "Malware payload", "value": "46a94594b0f965de3bfcd761089c388d1b9de6c19bcaf0b8ea5ae3fd1f8110b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "c808659b-1f40-470d-9e50-e95cdd30d05c", "comment": "Malware payload", "value": "77d1e37415944d2b35dfb732c032f414346e16e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "a5a557c7-3489-48ba-a53d-069648861a6e", "comment": "Malware payload", "value": "ae3e50c4074f0cbb9f9c0672c1008152116d8c30b1353897a70ddd4e9368301df2a383c7d78646f6fbc3f5cb77f3f7dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859071, "uuid": "ed7e4a70-ed27-44f9-93a5-b596fdba0b2c", "value": "T17A561797B9924942C4E43A37B9BD81C433634EFA9BC652566D04FE3C3ABE1D80E35358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859071, "uuid": "e57d6b6c-8e76-4b88-aee3-abcc185b173d", "value": "49152:+xgAHyjArzZrvgyovv4k5iSFhBZ0dopRgy3xV5Er:aZbovv/piSEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859071, "uuid": "af875a2d-c666-4a79-9231-4825eb284d23", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859071, "uuid": "178043eb-085d-4b30-b6d0-2e4ec6927dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859071, "uuid": "bf3e09dc-ce95-4c56-9724-14e0af281cf6", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a49553-6240-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780816280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780816280, "uuid": "25478be7-c7a7-4970-854b-4658c52820c8", "comment": "Malware payload", "value": "0edcff8ce41b5f2f234bd07a9a43f60b", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780816280, "uuid": "f4b6a863-6399-4c15-83b3-2fc0f4fd71a8", "comment": "Malware payload", "value": "4777e025ac9a12fbd554e5c0bfae0b7193364ec3ad016a9568a145602b19f906", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780816280, "uuid": "df6d6728-38f4-47e7-b0e7-753e431012bd", "comment": "Malware payload", "value": "7ded70a8197b62acaf6025f35dfcb5ad474f2e5c", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780816280, "uuid": "f2006166-c17e-4734-acc9-8924f775ef65", "comment": "Malware payload", "value": "b3a5895f6a44f4807cf2c854e013db27dcf450ca3d73f230ee86b718c0afcbb2ff6b03956c30349147e7108f0b14453d", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780816280, "uuid": "ef2dac42-3cf0-490e-b3a8-09145b95ef53", "value": "T1F3A5232427DC4E06F27F9F31E0E5198EC6B6B743AC1AE29E0D8944DA0E57B419943B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780816280, "uuid": "b8bd66d8-256f-487a-9fea-2f438d363bb4", "value": "24576:vbumKzB+DbRqlbEq+Fc7qBbWWsfY+V4C39Ufl4q0QBAcKo8u+x+0vt124WBH6wPe:vBbz6zv4KqSq0QBDk/tO6w8tQzI8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780816280, "uuid": "19e4fa1b-dfc0-4ca7-99fe-5368c6b1538e", "value": 2208256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780816280, "uuid": "3c240c36-f163-4339-a1c4-e281a3bea805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780816280, "uuid": "7d4f7d8d-7e2f-4890-be1b-c2935cbb0909", "value": "4777e025ac9a12fbd554e5c0bfae0b7193364ec3ad016a9568a145602b19f906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8aa90f-6256-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780825984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825984, "uuid": "b2f7b35d-d701-410c-91d6-3b583a656e22", "comment": "Malware payload (Vidar)", "value": "3ad35d12936678ed0a70b4fbd48287a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825984, "uuid": "7cba701c-a3e2-4323-bf60-eecaacb3a1e2", "comment": "Malware payload (Vidar)", "value": "48a1791ee93cf8a61108177e1255caea6699b5b0d8f33cfa05d96f5e3dda5163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825984, "uuid": "ca625578-ad7e-43f8-8c70-4dc5024b7fe7", "comment": "Malware payload (Vidar)", "value": "3a8c766ceff20ea6ceb1e84fff32e27c1375d77e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825984, "uuid": "a637751f-e88c-4e45-8b67-7ec88973b7e1", "comment": "Malware payload (Vidar)", "value": "afa63ef5f80820a024c39add0f66e6322e83eb517e1b7abd34a922482f92e70bd27880369f578a7a6d97b6f3993b52c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825984, "uuid": "bd718bd9-a0c4-4fa6-81bd-f98af9a5fce5", "value": "T1B1E5AE83BC8046BBD8AEB23494A512567778BC88473367C31F61ABB62E377E05E35354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825984, "uuid": "3937f755-4496-4ea6-92a2-66b63b859bfb", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825984, "uuid": "06b2775e-e28a-407d-8a13-eecb301f12a2", "value": "49152:2RgtABCp8Xezrb/T8vO90d7HjmAFd4A64nsfJdp3pC5FQD1rlj+XFLNHNUTesICR:FAeN3c5+37BjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780825984, "uuid": "75559489-95ed-4214-95ec-b0b63029e110", "value": 3223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780825984, "uuid": "cae2d05f-f225-41a1-b9ed-f8a0ebe41f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825984, "uuid": "fb8ca790-2295-4bfd-851b-43e147148f8d", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37f99c0-6249-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780820410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820410, "uuid": "2cd43152-93c1-4fa4-9aca-c5b139504b12", "comment": "Malware payload", "value": "c1d5eb9fe38d4164f7988dd8a712912f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820410, "uuid": "3c914214-cd17-4c3d-912e-cc6c03bfd249", "comment": "Malware payload", "value": "48bd2947e4828937cc184252cbe70fd47c957a4131fed2133de3bf0d5e7aa7c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820410, "uuid": "8167a5df-6dc9-43f1-aa9b-c9c5536a5739", "comment": "Malware payload", "value": "dd7006f4f715360fd51e095ab16ef4e036b30b54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820410, "uuid": "780db8fb-d70b-425e-9d39-eb0a165c8399", "comment": "Malware payload", "value": "61140ae7cd426d86fd3226332cdcd0977a4358a5371c2037c523b16e16417136b56fdb60241b3657f5da376e202c6976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820410, "uuid": "c865fea5-324d-498f-bd62-5856f9834eca", "value": "T1E63302A53A1308CED83338BB788B86561DC72F2A745F445811BAD2EA9EF311CE5F9315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820410, "uuid": "c0b4b8f0-6e72-451d-9ab3-0eebd88b5142", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4AubAvQ3kuHYh87/qS:XtBTX941eYF8NblpuvnwanQ3zWYqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780820410, "uuid": "9f984e81-2de8-477a-86c0-b61715777545", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780820410, "uuid": "48a885dd-b8b7-4ee6-ab16-ccac12d657d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820410, "uuid": "20c110f8-990f-441b-bf70-f0a14005cdca", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b88dac-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "81444dc2-42d6-4a74-a121-327640fa245b", "comment": "Malware payload (Mirai)", "value": "05e52429997eaa0e5fbc51839fdd0dc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "f130bd85-316e-4ade-9014-fc040e9fb3f2", "comment": "Malware payload (Mirai)", "value": "48d574a4c9826603cb60047e4a5c2c58a63f9b260770043bcaa80556883d0020", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "2d01251a-2bf4-4d03-a495-896c86bf8cf0", "comment": "Malware payload (Mirai)", "value": "8b353b36041cc56ace87ef7799fe37277a8fe085", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859198, "uuid": "626781ed-ac9d-4b6a-886d-6605c04025aa", "comment": "Malware payload (Mirai)", "value": "2f8778cb9410f729ad432b18a32da8df6a8897123e45825065fccc8197945853cc7a439d421053a4a1b42a738827da2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859198, "uuid": "3ab96e84-fb6c-4fe4-8000-9450f5bb97b9", "value": "T1A593E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859198, "uuid": "18ae2ac1-985e-4940-a146-bc8f5cc46de5", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8Fn:8+tsCurVDN+ouw8LAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859198, "uuid": "a734b1ac-c13a-4c5c-bfec-2e5289e14205", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859198, "uuid": "cf02d7f7-bf2e-43b9-812b-32722439367b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859198, "uuid": "d601a1a1-778e-4ca7-afc1-c918c5eb656b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51584900-6260-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780830124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780830124, "uuid": "9dcc13e0-c4bc-4025-9ef1-9f438939dfbe", "comment": "Malware payload", "value": "24f0043534425a3686a3dd3fa23d856f", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780830124, "uuid": "1e15b9f0-e3fd-406e-875f-a88d26969a53", "comment": "Malware payload", "value": "4a8818d0585665a4064c14cc6e7d1048431d671d6eec2505310c3442abded478", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780830124, "uuid": "261ac7cc-17d0-4f88-a374-3174246b0caf", "comment": "Malware payload", "value": "4c0fc7f5a55d406547f6cf3b1fb267a61167df8b", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780830124, "uuid": "7160dedd-7331-459e-b9b3-dc922ae8f429", "comment": "Malware payload", "value": "576d53f2ed3135b49438f2510486860d5d4a6657e70a6bd063c931b709c63f6b8cdaf8f48820b634ae040ef7dc4890af", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780830124, "uuid": "573e977b-a72f-4454-9ab5-f00cfd36a2b0", "value": "T1BC623C14B7BCC77AC92D0B37987352100BBAF355D857DB1A6FD8A04B3D63B094520AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780830124, "uuid": "dc5991ba-d9bc-4e4b-909a-cd4138beda13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780830124, "uuid": "4c3fd99a-e809-4011-8d9e-d83625c21834", "value": "384:AJzfYp4OdRsOZEaJg2YBM26TS9fCRszjmqJ4dJmXm8LWGK:AJmddyBQTM1qqDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780830124, "uuid": "107f29b9-c8d8-4a48-a6cd-8544c240618b", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780830124, "uuid": "454907f1-9df4-4f4a-a957-8afceb6cf987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780830124, "uuid": "43048f2f-f04d-4cf7-b9e4-ceb34f4c7460", "value": "4a8818d0585665a4064c14cc6e7d1048431d671d6eec2505310c3442abded478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb23bb7-62b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780867649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867649, "uuid": "a9848227-7091-40bd-85fc-cae2dffcdc4d", "comment": "Malware payload", "value": "c85a3b8963ed16d0542546f53079f0bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867649, "uuid": "25c42bc8-a96d-42ed-bdab-56720d3ac3db", "comment": "Malware payload", "value": "4bbbda04ff4d5f6f6b187be65564019255c94ee7309eccdda59ec4fa3349079a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867649, "uuid": "0cbeb117-b293-43b5-829f-84b915237e50", "comment": "Malware payload", "value": "38b72f0457b9b5848581c699d9125d9f72acc459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867649, "uuid": "63bd04da-6655-4831-b40f-9d52348359b0", "comment": "Malware payload", "value": "61a0927faa5666818cc076c53c19ce0a72c3875d630f2ee8120fd52c137d6305566d372532366ee94ac44c5511b98f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867649, "uuid": "4d2feb09-167a-47cc-b36c-f2b4359b3fdf", "value": "T158F3D80A9F910FFBD86FDE3701A9070635CCA51722A93B763674D628F54A90F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867649, "uuid": "74b66f99-d065-41c7-a838-3b14b2607dfe", "value": "3072:0Y+i0c98Bb3Xp31v57Kip71yAeOcE3Ag:0tfBzp31vRK6eOx3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780867649, "uuid": "71841c25-d817-46c2-acca-d1e2cb3ca01a", "value": 170436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780867649, "uuid": "cc4fb788-6644-4ed5-ab99-f977e0e25fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867649, "uuid": "522fb2bc-d107-43a3-9191-98df7b6f65bd", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd933cb-6229-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780806414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780806414, "uuid": "e3caca12-505d-498b-82c0-00eed20dc6b8", "comment": "Malware payload (Mirai)", "value": "a5bcd197b40442a9da702a8fe7ab9ed3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780806414, "uuid": "927202ff-d193-4c82-b43b-1006ee6937e6", "comment": "Malware payload (Mirai)", "value": "4d57bc6515acce4ca938785ad6b0763c451ea39c0c217307824922c5bf4e6b56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780806414, "uuid": "83213e33-3b54-4e18-a30c-9fbcdf14842b", "comment": "Malware payload (Mirai)", "value": "035374aa5d0836af769c0ab2b3ad03daf5eac8c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780806414, "uuid": "4ecb635b-38f5-4aab-a1eb-0c2ba335c8e5", "comment": "Malware payload (Mirai)", "value": "ef7a9fc906fea71e8638a09381e2f442cb69a2e693d2c5071da1406ea351f5f037ad965b2b5ca34d4591de945ca1c6e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780806414, "uuid": "97266cb8-5e43-4477-a410-56edc57abf84", "value": "T1ED01AFCDC016966042C9D8AD27EB5084B421C3CB25668BB9BF6C583D8B65B08B065F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780806414, "uuid": "470d838e-3a47-4be9-8002-e342a1615276", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaqIxgOI1HvVS6IJabAIux1eRFIo6X:kXCKysE2hi0ziQvZohaqu69huzxQjmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780806414, "uuid": "5fd67638-7d15-4687-a7ac-dffe2d881929", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780806414, "uuid": "515cee85-8506-4991-8e68-e35163e1367f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780806414, "uuid": "46bc29e3-d471-430b-aeca-00b09b65c2d4", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040ca190-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "d14fa8a4-2a04-44c7-951a-4d813b591cfa", "comment": "Malware payload (Mirai)", "value": "57c79cf82567adfce0be43ba12274da1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "e57e5596-041c-4750-912f-c3f67837ee6f", "comment": "Malware payload (Mirai)", "value": "4d9dd833ebe47101a9764f8283b7f39391012bf62252300f88628f9b3c51e77f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "49ecbf64-ac9d-44d7-9f63-090073a5f5ec", "comment": "Malware payload (Mirai)", "value": "de869066a61b4d6b4fee96780189123db5a85d8b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "488a041a-b338-4d3f-b144-68d0d36b56fe", "comment": "Malware payload (Mirai)", "value": "703485d0abc8bee2430cb8f87d50fc5667eca8ae782cb43bb962c0d28e0dd8a46e74ba6784206d1ebf6d6d9a5534f39b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "f1bbf8c6-77c5-48f0-bdf1-f7902c0bb22e", "value": "T1E9E35D8AF4029E7DFD4FE5BE44670E09E931A39131831B2A53DBFDA3A9311990D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "4d957723-14b2-42e3-ba60-290f0bcd4976", "value": "3072:noDlIyA+oy+ZGiTirDQCcX7ZLgLq2e9FdlJcNXu:RDy+ZGXcll2e9rcNXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859200, "uuid": "73090aca-4298-48ad-9585-b1c524531e0b", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859200, "uuid": "01c5f4ba-1cbc-44f1-ab01-b13ff0b5d044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "2fd82149-eec3-4406-a16c-fd493a385957", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50b70ca-62aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780862155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862155, "uuid": "0af06998-d826-4d7b-a64a-a73938eb5d39", "comment": "Malware payload", "value": "a5476439840bb715f82d3c786aeca49d", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862155, "uuid": "c4a6218b-0e1a-4183-8454-3d6f6912e494", "comment": "Malware payload", "value": "4e2cd762f49fe488cb33f4b479ff069a95e28e34c5d281f7f13c9f69ae7205ef", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862155, "uuid": "ddb3273e-01ab-4db7-8eee-bfef53ebaf90", "comment": "Malware payload", "value": "ec5c34dfbf8857de9e0ef21be8113351bb3799da", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862155, "uuid": "dae06708-70b9-44fd-8e0b-e06e13fd39c1", "comment": "Malware payload", "value": "7e8af2d240c39cbd8adda2748d4ab65a431cef827a9b8100d1aac1c8880291fc489c962637ebd5b1a157163260db6f94", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862155, "uuid": "68f7f4e9-20e2-4e4e-8186-6f871dd2a38b", "value": "T10D576B25F9971C2FE3B39939C9D5E1B6975AB3FEE7B3043938604384A212143B846D2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862155, "uuid": "e9eb9760-09da-4f20-a071-9186483bf32d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862155, "uuid": "b35ac4f0-cc84-491c-9150-4942af1af6fa", "value": "196608:L54WgHWb24qEPjAmGz0bcCD4SHW1/pOsPYbW8+vBOY14onvl1Wt7sgnn3kPHDZn3:L2EyZ25wwgBO84onvTBrZn9QLpyUYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780862155, "uuid": "8f01d666-f693-4cd8-905a-b23d18149a61", "value": 27760640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780862155, "uuid": "de31ba1c-73f4-418e-9009-981d8631935e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862155, "uuid": "2065fc1a-3975-4d54-8aaa-79f73ed3d06c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e8618f-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846003, "uuid": "447433b4-5fb4-4e40-85c3-e5802b75a7e7", "comment": "Malware payload (Mirai)", "value": "accee1aba5776c31e5d9a47e172d61fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846003, "uuid": "b7eeda5f-78a4-41e3-8a88-6536814dd494", "comment": "Malware payload (Mirai)", "value": "4fe6effbbffa6212f936db91dd49c8819c32f661aeb7d68b3409470298088e6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846003, "uuid": "fbfb7f47-2c37-4c9f-b11c-12fb0da44cf4", "comment": "Malware payload (Mirai)", "value": "366b462a7e923fe6acfd47fc05034cb375315ba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846003, "uuid": "5ceaf338-1274-415d-a466-f565969c336c", "comment": "Malware payload (Mirai)", "value": "a9fb7167534cb66f0c833e8899ffc77ad6cde72abecfd04834405af0576a7fcb8ee1ca3a37d7c94a1a9bdba3dec00359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846003, "uuid": "2296f9f2-cef9-4cd7-a4e7-d5482b4755a3", "value": "T117730791B8824A2BC2D4237EE9BE618E3360B3E5D2CB7127CD219B2537C551F1D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846003, "uuid": "1a6ac165-d41a-4d7d-b54d-eb17b4f33e4c", "value": "1536:4mCSVsiF88YRel8bTcjmYkMpMR3cFdsipaV2lVF6V:KSVsiF88Y+5pFFeYfF6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846003, "uuid": "0af63d19-56f1-45ab-be75-d5992f031abb", "value": 79932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846003, "uuid": "d10d1126-c352-420a-88ff-be59295e27c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846003, "uuid": "7c63607b-35ba-4af7-a969-fd0f40092035", "value": "Mystic.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be183be-624f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780822894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822894, "uuid": "b8944ce7-764f-4281-ad2f-2748d8e9e461", "comment": "Malware payload", "value": "49a57ed28b6585d08bfd6624bc3f196a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822894, "uuid": "ed2c285a-339c-465b-b076-bb2e26ab491a", "comment": "Malware payload", "value": "512c87314d027068df5d3faade026de695fd97a552a884479c2e184f8ba897f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822894, "uuid": "fa4305f7-302d-4fdf-bff4-c8d4f687d2a1", "comment": "Malware payload", "value": "4096054615855bd854bd67fdcdf4ab7ddaf00783", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822894, "uuid": "0d02554b-d141-4cb9-8bd4-5294a316216e", "comment": "Malware payload", "value": "bdd50404adf5b5a6cf2d1f8e88adc550803db3be3681cb933ec8be02e8727c83fdcbb08e33bf7fa494c7914cf304097a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822894, "uuid": "cf02bebb-630d-4324-ab7b-ce09f7d7c9a2", "value": "T11F31F5EB0B1A3E9D4911DAA673B51269D054D7CE354FD7F0FB985D7AA1C81483204B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822894, "uuid": "587aac5a-d814-47d5-bc43-ad638512a821", "value": "24:TR9RNMu4RWp/Kuojpp2uU3lLbPsNOHGkKDTyVG:YR7NpgLjsNnGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780822894, "uuid": "d72ca618-f34d-457b-9a26-71787875a9c2", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780822894, "uuid": "03a0634e-bef4-445e-95e0-d3b424419f05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822894, "uuid": "49c5f7e1-e063-4985-a9d2-76c9206a983c", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe9f303-6292-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780851704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780851704, "uuid": "c3baa6e2-8ddf-48ad-b14d-3f385f77036f", "comment": "Malware payload", "value": "2ecfe92155d1c317179a28f5d178d682", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780851704, "uuid": "2ad5f230-3676-4b88-a31e-045bcec65d58", "comment": "Malware payload", "value": "51402236f88110a40b3873656acf2f8759be0cc1775fe01238eaf2e08a3c4c21", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780851704, "uuid": "809d429f-e25c-4859-974e-75d7cb024477", "comment": "Malware payload", "value": "93054f922f8f0d768b88e6c4c5da10e5daf9f722", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780851704, "uuid": "3f50c0dc-0657-4be9-8ee4-75a5d2f31b16", "comment": "Malware payload", "value": "67b26db8c17633867d9fd74251cce51183e66e7690a42d6e2503c5236cb39ac49ad8da1c662eb46966332286df66f2d1", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780851704, "uuid": "0cc9eaa4-0e17-4ba2-a484-e5ae28c163e3", "value": "T188520A46779CD729C43E0F7618F38A402BB3B3182912DF5E28E244CEDF2AB500626B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780851704, "uuid": "689b9b50-5fdf-4547-9f68-beda3ecd59fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780851704, "uuid": "d549144c-f392-4ed4-9e05-0606bce58836", "value": "384:EcjY7gCo4UpvEwbNUgva08NDgQUXanywgCCCCCuE:K+2cKrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780851704, "uuid": "bf35ffbb-22a7-4cf2-a574-d789735505cf", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780851704, "uuid": "2ab88f0f-dcac-4b6d-bbca-b01297f9fa3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780851704, "uuid": "a88b419e-c04c-4d7f-a42e-23b5a0e86f90", "value": "51402236f88110a40b3873656acf2f8759be0cc1775fe01238eaf2e08a3c4c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc54d72-627a-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1780841476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841476, "uuid": "9c33e812-ff7e-45ee-9602-f0e25c239530", "comment": "Malware payload (SantaStealer)", "value": "a1fc513a17d8b76ce860c43dbc4a7141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841476, "uuid": "31b2c21e-b103-42ad-bb0e-8358f16a630c", "comment": "Malware payload (SantaStealer)", "value": "51fcfcce28187704a91597bd55209971c0f9e2da26ec3e79d48389b56c3b6148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841476, "uuid": "ee04e81d-789b-4264-9626-fba82fc8d6cd", "comment": "Malware payload (SantaStealer)", "value": "fbb45d7a5c4711b3d7833e78c9d9eb96bded86f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841476, "uuid": "0ed87d84-785e-42d3-b1e4-90f7e485e726", "comment": "Malware payload (SantaStealer)", "value": "42b94dd4db1caa28c30e3e95611b74f5d8071baba7d44b43f8eb49c5f3c640cba435f71678666b5d2a053becc7ea74c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841476, "uuid": "1caf7dd0-ceee-4da5-99a6-5886f4a42bfc", "value": "T1CF66D0CAD16B40D6CC067FF598142BC39B3056324A34047836ABBE595F779FA801EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841476, "uuid": "67f59577-8caf-4d39-af02-b1f06768b2a2", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841476, "uuid": "7e8aca65-15f9-472f-bcba-b27ee74b9fd2", "value": "24576:XrSqnwRcjNSY84j/wDSB7XJh9BFk3ZPiKJG8mOxDWNmBmlMtwjTSwyIgZINv1cAB:7Xm7C5NWUWtHV/tngbrxrGo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780841476, "uuid": "09c2c1f0-6059-4fce-a65e-6930eb111c01", "value": 6824448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780841476, "uuid": "89fbd737-9fd0-4319-90ad-bc8894e9a285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841476, "uuid": "6aad4511-12da-4a76-81bb-fe8b79c29899", "value": "Cubase 15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682ac88e-6243-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780817707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817707, "uuid": "f906a4fd-6083-45c3-9d2d-3a7e4e3c86a0", "comment": "Malware payload (ValleyRAT)", "value": "2486dcfe3208ec0d22551b4c6504f48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817707, "uuid": "33dcbfa9-5947-45d3-bdf9-7448bbc2981e", "comment": "Malware payload (ValleyRAT)", "value": "5383de5956d052794022598d14df4f8ccaf6c278f6d5b8c13dc2ec0ab6b10fe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817707, "uuid": "ab111fce-b426-4db6-9e3f-73ddbfc0985c", "comment": "Malware payload (ValleyRAT)", "value": "bbb10f9724b023aeb07c935ec439f86284fcafd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817707, "uuid": "98f8217c-3b5c-40e0-8972-1a9b9681ad78", "comment": "Malware payload (ValleyRAT)", "value": "c49d1298ce1baed0e5fbde0b6a373e74fb1f19d36c70c8b29008d30e88c8bc17d3b35989fee72d7e88c78de5a0ffeaef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817707, "uuid": "379e2ed1-dd06-4f9b-baf2-14dfac99e841", "value": "T1C6D37D4733A450F9D4A78279C9A24A06E7B374660735A7CF17A086BA2F137D1BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817707, "uuid": "4a47ec17-0136-413c-a76c-8f47c3f9d218", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817707, "uuid": "c0caa15c-fd1b-445b-9147-e26577bd34cb", "value": "3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oE:lO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817707, "uuid": "bc146097-c8de-4975-b828-bea4454cfe34", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817707, "uuid": "129a7c89-2a64-47c1-be9d-73198c02ea46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817707, "uuid": "62177a42-94b5-493a-8c15-77e6cd6812f4", "value": "2486dcfe3208ec0d22551b4c6504f48d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705eec83-6208-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780792380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792380, "uuid": "554d1161-dd35-46c1-8e15-07d5108e15e5", "comment": "Malware payload (Mirai)", "value": "7f33172ed5c3d046e5de1808c432f193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792380, "uuid": "40d33f64-01c7-46d0-a3a1-73c68476d496", "comment": "Malware payload (Mirai)", "value": "53c17afb3a4dbb564d64d6708b8360daf7c54a83608543f07fa60e67ff1439f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792380, "uuid": "0a1de86a-6211-4d78-abfb-cec4ac6fa0da", "comment": "Malware payload (Mirai)", "value": "f87197bcba6596d338b3a0ec7ebb62150d2aac47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780792380, "uuid": "0e190646-7016-4bc7-87c0-54574d45baed", "comment": "Malware payload (Mirai)", "value": "7517a454ab8550bd3c30aa261da13705798e4360f8a09d4e7bad49ad7db822c22c8c2a9ed2ac5413149760a9488b5b39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780792380, "uuid": "525747ff-d2f0-4044-b49c-87f3db5fb200", "value": "T14D831206586E4B6BF9D231BDC47AA6EEBFA2C590C6413D257B40478F09591D30C37B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780792380, "uuid": "163e3920-c51e-43f9-ad20-495cf8d29f66", "value": "1536:M4l8saiqtSdrhaybZFxt7Q4xms98nsAnQmUPxfqEogS5IHGAHRkB9Ldn/cSjlY:M4l8saiqtSdrAcZFxppWlnQTSPgS5IPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780792380, "uuid": "88d7061f-47ba-4839-add6-2cff0d025d9f", "value": 88068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780792380, "uuid": "2a81de2d-e58b-4d21-b2ee-f79dead1aa92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780792380, "uuid": "e5662175-3597-4918-b84e-3d48e6f8560b", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3567f6b7-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845969, "uuid": "8d46e430-1a95-4503-9afa-0e701b8e43c1", "comment": "Malware payload (Mirai)", "value": "879b7a8f96a0b9a79ec716545b258a93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845969, "uuid": "75f189e1-7013-4dd3-ab54-473e0b95d4a7", "comment": "Malware payload (Mirai)", "value": "541213ee66278164fd82e02c808b8498c43b7109286b5400b439dd316c9a8f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845969, "uuid": "2a2b7f38-8d9e-4ec5-9f46-24fc60bbfb2b", "comment": "Malware payload (Mirai)", "value": "3b881b5a454d3e6547af4daaf64dbb70573f1ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845969, "uuid": "c4f1e712-1c01-45e0-9607-4543c74414e9", "comment": "Malware payload (Mirai)", "value": "4329b84d3a20df8e89d90b85913f90cc9115b93ddb588ff1fcf68b790fd4588d1dc54b1f130c0e7cba7f3b7ab299b736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845969, "uuid": "b94dc2e7-5d48-495f-b426-646bb1500946", "value": "T19BC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845969, "uuid": "c4041713-f013-442f-abcc-e44395e2e981", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPiO:LzhWutxBaORaebXQd+mzBzlki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845969, "uuid": "31730798-4714-4ada-a27b-506db0caf1f8", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845969, "uuid": "2e80174e-6212-4063-b805-8da79c133e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845969, "uuid": "e67abf6a-cf1d-4c3b-8d2c-9721a605c16d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f40b7d-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858958, "uuid": "896a6179-fcf8-4084-9775-ddbe262d917d", "comment": "Malware payload (Mirai)", "value": "33a2d5117276e58ebecb4f1f2b2e7569", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858958, "uuid": "2cef5976-b06c-4e28-9f6d-b499d39823b6", "comment": "Malware payload (Mirai)", "value": "552726f1564f8d671314546a947b84225c4fafbd302b5601cf70435cde1a6ad5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858958, "uuid": "c7e4ff06-0f75-4db4-86e5-3911c6349217", "comment": "Malware payload (Mirai)", "value": "b093902b2e686b186dbfcff89aa522e3f074f925", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858958, "uuid": "edcda95f-8190-409e-976a-19962453cf63", "comment": "Malware payload (Mirai)", "value": "4da114edd59230ced647dd6e853e7a5fc8b187d925ed3c8ee9dc18220b3e3f56c1402325319a82cedbee601ff0cbb0d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858958, "uuid": "0e7fd2f3-e08e-43ac-9e1e-873a98d0234d", "value": "T1A7518DCF50501FB2A589AF1CF3B34AAD900695C6F18716D8DF4F08274CD8B1CB695B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858958, "uuid": "98549081-bee9-4b07-8e22-ea96e2d13993", "value": "48:NHBBGFaiQNMjb7jkuPjbCWjh32b96+0Ctb4cU4jbjSbjRjeed7PDQ6gdTa:NH25j9xM9fkV7PDQ3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858958, "uuid": "3ee0b3a8-8288-4221-b523-53ea86cc1e7a", "value": 2840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858958, "uuid": "0afe63e2-872e-43f2-a2a3-d5ffc1832149", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858958, "uuid": "bdd59029-a73d-46a4-a743-454ca1f9119d", "value": "adb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86d7f84-6276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780839773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839773, "uuid": "90c71eb8-b6b0-4a02-bdc9-758b04a864b0", "comment": "Malware payload", "value": "f5e5e779e427f0091387b41b2fee1f46", "object_relation": "md5", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839773, "uuid": "c2314efb-a750-43c8-a6e5-2d99269c4945", "comment": "Malware payload", "value": "56829efc5cf4c9b55783af67e56b01629cccece417fbb4847833006ca340cb6c", "object_relation": "sha256", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839773, "uuid": "3c4444be-7333-4ec8-bda9-cad6cb784b2b", "comment": "Malware payload", "value": "5303c580f6d1ac23a1ef33d7625cb2f45e1b0781", "object_relation": "sha1", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839773, "uuid": "80cb619b-ce5d-4df6-bbf7-05fe48b33265", "comment": "Malware payload", "value": "6a5370e819a33ad479e6f8364acefebf87373ef9f1e18f694c31ced278242c325924d8d6f0b13315f280e79170634647", "object_relation": "sha3-384", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839773, "uuid": "13627935-e0f9-4761-8045-236ef03c6ef1", "value": "T11494CF913BC9C13AD2AA063785BA97A5362A7D350B31D0CF77947D6C5E306E3E939302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839773, "uuid": "e197a3ff-6a3a-4a98-9e3d-0be2b8fc2bb5", "value": "6144:GtOfiRQYpgjpjew5LYyGxhqo8KlFCnacCpMZHSq53KUJyb5tCp:GtDRQ+gjpjegLbo8KnCacC4HSG6pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780839773, "uuid": "53d445fb-2ca9-4d42-9ba2-252542043887", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780839773, "uuid": "a6438235-9187-4b59-8192-dc63dcc036b8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839773, "uuid": "c63e6a8e-f40c-4382-8b7e-8fba5ef7d117", "value": "update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35d7cdd-6256-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780826101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826101, "uuid": "08beb83e-dbec-4540-ab81-2a9c296d3554", "comment": "Malware payload (SalatStealer)", "value": "58ad245a54b785ce919dbcabfa77fa36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826101, "uuid": "ae7f8676-8552-414e-aeaa-5cc6b0e174c3", "comment": "Malware payload (SalatStealer)", "value": "568a732ae78c9ef36631997276b108f81a821cf0887578c4869a0b1cc193117f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826101, "uuid": "35be695d-e200-4c16-b950-e8554914a494", "comment": "Malware payload (SalatStealer)", "value": "4e6539c42460750c60ef7a098f5f8099498a63c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826101, "uuid": "64356be3-8365-4f5a-9a27-549e07748494", "comment": "Malware payload (SalatStealer)", "value": "1b75f905584987cc822b72ad5699aa2ab0dcb483607d95b7bb4f677a6948c86891f147a9932727379940b07f795bae10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826101, "uuid": "8d2ad4c9-b991-4157-af62-c68c89727316", "value": "T1E946AF037BFEB05EEA6B97B4956862418625FC770D91808D71CC148B4F9B9107EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826101, "uuid": "374e1565-255c-4001-b1d5-1c3f67d0a2b0", "value": "503dffde005c6b4b5130dbccccfb068a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826101, "uuid": "59dc44f6-b926-4887-b25e-92779a7a3256", "value": "98304:mrlhGvD71b8nB5tFM3pSK/vvASAzdUFLhIRla2DVtcL7oN87AK:alhskDM30oXFleDzqEN85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780826101, "uuid": "ffc3320f-bcfb-42dc-a212-c49f08bc5746", "value": 5688136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780826101, "uuid": "c1cd78e6-a333-49ec-bd5c-2fbb675b7720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826101, "uuid": "7e432e9f-a7ad-418f-9848-5d5ac33f1acd", "value": "BootStapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921889f0-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859009, "uuid": "d72154c4-9114-41f4-9bde-21a63da9643b", "comment": "Malware payload (Mirai)", "value": "75748ab3aab0668e83a4f07397afa593", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859009, "uuid": "569bc6d9-e181-4a05-b8b2-df46db9daca5", "comment": "Malware payload (Mirai)", "value": "56bebd5aa3a08bee8e38d4186c3f91acce824cbe472f87833b0a1262d4f5454c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859009, "uuid": "05ef1b48-0242-41b5-acb0-9c516567b79c", "comment": "Malware payload (Mirai)", "value": "44dec2d4ecb42d971b4cf3602e0a946418ec45a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859009, "uuid": "3e134071-93f4-470f-9b5c-e4c8e8db3ecc", "comment": "Malware payload (Mirai)", "value": "9d59aeb8dc01cca0b0ee5a91918cdff1231e502e2aa49043d79e8859ed9ec9cb1d80d3f98d11b94b17f7fa2a92e8ab8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859009, "uuid": "49d9ffdd-829a-4546-ba75-c459af5772f6", "value": "T193E32945FC805E17C6D512BBFB9E42CD372A27A9D2EE72078D115F20378A95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859009, "uuid": "9bd0e7e5-89af-4137-9a8f-41dbdc4a91b4", "value": "3072:iHFQ0juwKl08Z6emN8V4ADREez4rsEWI:iHFQnl08YjuV42Rr8rlWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859009, "uuid": "d0d8c50f-943c-4974-923b-f8dcd127aed3", "value": 146508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859009, "uuid": "5e8c23c3-54fb-4523-944c-44d4c0edbdaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859009, "uuid": "a8bc7f34-1243-471f-90e4-adfb8598012c", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfc887a-62af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780863992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863992, "uuid": "83bfd7ea-aa75-4d9a-910d-4f8e1de8d14a", "comment": "Malware payload", "value": "d55751eb1b1b071f35092546d15d2c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863992, "uuid": "da5e2ac6-4f8f-4706-91d4-0730c952b4a8", "comment": "Malware payload", "value": "5720f3f13ac1216533d735c2c4ce9fcfc5588dc233dbf10e31e0f68aa4ba0a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863992, "uuid": "aae5e251-dd01-4663-a511-35a92b1a6008", "comment": "Malware payload", "value": "33aef3ab24cc65e7eb2aa4753567de31e7a5b3ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863992, "uuid": "abccba43-3751-466b-bb28-47e33b09a457", "comment": "Malware payload", "value": "e6bf294f6c5d4d50bdae347cfea5ec641b9b729bb010cfedb094e84c4cb41064ebb6958a6df6be84476032f0f959c556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780863992, "uuid": "7c95e699-3e10-4124-aafe-071a38f35f95", "value": "T13E159E46FB08AE67C596037E88EB43145325DD853B868F476B68F27CAC77738EE06601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780863992, "uuid": "cabd118e-7bbe-4b0d-b7ac-15be9cf51db3", "value": "12288:AxR+jaqg8KP1iWmnRZDKTuiRdEHpXhB/a3To9qurnRh1wF/YT79HcH:AoRZ1BB5wF/e79Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780863992, "uuid": "21a750c5-e3c4-4169-a972-50afc7c21b46", "value": 912928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780863992, "uuid": "f94a90c5-4d7c-4914-ab4b-00526cbb8862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780863992, "uuid": "e9e28705-d31f-40e7-963f-8b079371dc18", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417b2c88-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845989, "uuid": "9d71cbe6-b463-4443-bd45-133906ab7b5e", "comment": "Malware payload (Mirai)", "value": "48f195673154446773537744a04a091f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845989, "uuid": "dbfe2e35-88d0-4a73-aa31-18fbfc9ec611", "comment": "Malware payload (Mirai)", "value": "593a1948c007229f5fff7b24ebcd09f3e3b26f6011dda864ff5f873c13753b4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845989, "uuid": "e1813396-b2e9-40d1-a3b3-ca7e1881f1c4", "comment": "Malware payload (Mirai)", "value": "62c6f90566ff43b52dcead78ca9041d1f1db165d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845989, "uuid": "29f82a39-8ee7-4701-9cd3-8863294fe553", "comment": "Malware payload (Mirai)", "value": "77d330e58fd8c29f60de655dca05fe39704385f2e91f44da409c3931aaaeaac2fa888462e22b1ce3130bb3429d8b2e6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845989, "uuid": "ddf89951-2eb8-4bf6-bc18-3edd7c88453c", "value": "T1ACB32980F98B81F6C50B883061A7F63FCE31D9A951B18B6DDFD59F32DA77A02D102259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845989, "uuid": "9376f989-acf5-48b4-9ef0-b8fcb0b22a2f", "value": "3072:tRv2psmtgAJWiHKd0dJgts7+8raG5ONfrY6kybhpRb81M1sQ:t1QsmtgAJWiKdUgts7+8raG56z5UesQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845989, "uuid": "c542844d-9f0b-4e20-8634-299713c2ab30", "value": 111700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845989, "uuid": "bacebf17-ad0b-43ca-a35d-42e5d85bd182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845989, "uuid": "fd3a9a94-74f1-4ec1-b46d-aa0f461cc08b", "value": "Mystic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959d3ea8-621e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780801892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801892, "uuid": "d0709da7-19fc-43bc-a382-3fa9452c22a6", "comment": "Malware payload (Mirai)", "value": "a41f4c431c2ef19b84b629021a655bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801892, "uuid": "6ec51c68-a0f8-49f0-b169-19053077ca7e", "comment": "Malware payload (Mirai)", "value": "598ebcfbc35afadc14ebbf24d7367948f679686a8d833ef2bbbf91f9c1769930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801892, "uuid": "2fcc63c9-a433-4ea9-8d15-2170919dc950", "comment": "Malware payload (Mirai)", "value": "e60a53b45de9fbceae7aa45864589f5a5a77e5ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780801892, "uuid": "0a6b0db0-4330-4bb1-af7c-c5bec1cbbde9", "comment": "Malware payload (Mirai)", "value": "98d2bea2752dfc3131c436a5f4753c63b5ae6ab92e10b7be02f4d076eb7e99db2c0eecc954eb40d9ae8b8733bd59e281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780801892, "uuid": "9a62228c-3291-415c-9119-2c153df8ff51", "value": "T1D2145916FB0C0463CA935CF44E3F0BF9A362199205F9910125097F5E5A32D7BA68BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780801892, "uuid": "5a7c1862-8efb-4248-8f5a-c0f578275ce7", "value": "3072:PKIiV2OXbCxoDaoa7nt2SAaNgMcryUtJ+cep3WUa4/DQB:yIy7A+/a7t2S5rUL+XzPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780801892, "uuid": "5697bc6d-2e04-4798-98e6-2de6b3848358", "value": 197412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780801892, "uuid": "22935342-aec3-40bf-be40-e722d59e2f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780801892, "uuid": "d27a784c-ae0a-493e-8422-6cdb0cfca6b7", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1738aa04-62a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780860521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860521, "uuid": "843952d9-ffe5-4d3a-89fb-54616a51e118", "comment": "Malware payload", "value": "91fc1162715d3d91d7c0db0b34156121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860521, "uuid": "d9a42b94-c8ad-4494-9230-d194e5b4e947", "comment": "Malware payload", "value": "5c12d9b33c2d28dc2323bfa7db99e264fe292dca9ad1ac83f99b2e3762e67cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860521, "uuid": "9e9e95e6-bea6-428c-b9d8-f386ae5f0d00", "comment": "Malware payload", "value": "82b27b1606ad70e0e9d9626043883a6e380d2064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860521, "uuid": "eaeca5f8-2f04-411c-872a-f8e8e3f31cb2", "comment": "Malware payload", "value": "8e59ccadba5ffc6e08c40d520135efaee3058de54125cdeb42abd761bf59c0f87bc2a84080b3ec2160a52b446f6a74cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860521, "uuid": "4ff19e86-cb73-4a31-b764-56ed0273eb2d", "value": "T1B0D733A570158A16C8BA95327E82AE49BADC4CC8A11BDF7DC711FE3D09513E1F03B91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860521, "uuid": "c314863e-ed38-465c-95bf-6dc0faf209c3", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860521, "uuid": "6cc68ccb-c200-4748-a323-6119d8e3332a", "value": "1572864:n73KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYK:n73ecYmoCWdiUQxdF8X3kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780860521, "uuid": "2deb0c78-fa48-48bf-81ac-936ee0399822", "value": 63709689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780860521, "uuid": "97b885de-3497-4554-8881-3547b5a3d1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860521, "uuid": "aeb35db7-7b15-492f-b395-8c5244028903", "value": "DeepLSetupwin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0d5ab-620d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780794507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780794507, "uuid": "657a313b-48ce-4645-889a-a1540bbddff9", "comment": "Malware payload", "value": "23b371ca06441360dea5e5e54ce82e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780794507, "uuid": "15caa8ed-39e3-4016-8f42-d82493583398", "comment": "Malware payload", "value": "5cfe5b27f8ffa8a0db3dacea41062a051e63f5443ac2474b52c800e4bc1f147e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780794507, "uuid": "21872b4d-631d-45f8-90ec-2c98c8a80954", "comment": "Malware payload", "value": "6c2687844b771bec318c97c33e5b0dab302e4ca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780794507, "uuid": "b1bf745f-1239-4bde-84a2-8ca8dead792e", "comment": "Malware payload", "value": "bd5278153691a4d102a2561d705cba6f37db277698e42f83b407975dc43667f99de4d51b534091af1c9f747f54131831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780794507, "uuid": "494ac823-d673-44bc-b904-a4cbdd7d81a7", "value": "T1460833AD8C32B573CA021C7F48627F91566D673F6BB8707A199935C4D9B02C620ECB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780794507, "uuid": "8d46c599-7d45-4f74-9f7b-6b2c0221c3a1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780794507, "uuid": "44bb9233-2847-4a9a-bfef-d9d39a034a3c", "value": "1572864:et9IKPP/P6RWYEevRbUe2wTuI2Hb+pEoDON9c3DRsW7:eUKfP6RWVevRbUFvFKVDAulsW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780794507, "uuid": "64063cab-4d94-467b-88e6-a6bd8d9ef308", "value": 77148241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780794507, "uuid": "21d84ddd-b369-45b4-8190-c0adc87a1e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780794507, "uuid": "72a44a6f-41c5-4217-83e2-3f1a43ba5488", "value": "activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd209a4-621c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780800805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800805, "uuid": "4ea01e7a-a198-4aa4-927d-d15e355246c6", "comment": "Malware payload", "value": "0c35d80de1f152dfef615bd2dab4d5f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800805, "uuid": "3704fbcc-a8db-4819-bd52-129bd8a6fc89", "comment": "Malware payload", "value": "5e4a4c44bec29b3c9c1297078e3275f65f2f11161a8ef39bcc2de9ca7c42b5e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800805, "uuid": "f7d51766-55b0-4022-b575-0cb9d51bcb33", "comment": "Malware payload", "value": "cc3eb9a5761364d66486b759723c410fe585b556", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800805, "uuid": "e8ab2b25-902b-4d59-a64f-8c9a0ce07e40", "comment": "Malware payload", "value": "92735c0b030bc63c416ac2f2211056f15ba54192be792b87a341312f28a1a3ef7bf696a0b072599865f99177e3b8770e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800805, "uuid": "55535b45-4910-42c2-9212-7f7f146e195a", "value": "T11F136C6566953C28AA9998371D7F1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800805, "uuid": "9b5a2e30-98fb-4f1b-955d-88f6417a4b16", "value": "768:HXRWNGxVU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:BlxLco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780800805, "uuid": "4db04bee-d6e7-4b90-a091-a01a02451bdd", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780800805, "uuid": "d8f76c15-1272-4a4d-89d9-648a6831e300", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800805, "uuid": "31d60acf-90be-4fe0-8c4d-5d3071d8d3af", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4a6966-6217-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780798949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798949, "uuid": "6443683b-a719-40b3-b5b1-c3cab1eeba72", "comment": "Malware payload (Mirai)", "value": "0024d6fe73118e44b959e36efeb12f4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798949, "uuid": "ebdfae8c-4441-48df-9cb6-aa5341545be9", "comment": "Malware payload (Mirai)", "value": "622b6cca3d9edb7cc6832c9a352816369dec7aa7574416a61a8647ddb1bf7eff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798949, "uuid": "2a031fe1-b8f3-4393-809b-e6764fb8b608", "comment": "Malware payload (Mirai)", "value": "4d8b263adda7fbd4d8f74d87e87c7c9febff9b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798949, "uuid": "a6497ae2-acca-4f21-9d28-538019e1b8c8", "comment": "Malware payload (Mirai)", "value": "85d2e0d8373088e1bd1fc220d24cbb3c51237630704b6789431ae3fc29a66252453012edc7f02b845774e080c49c2391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780798949, "uuid": "fcdee725-b27d-44f3-823e-859de38a934f", "value": "T1FDD35A0A79D234FCC687D13152AE9F61EA3A745C42183DBB9383AE711937DE01F25E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780798949, "uuid": "1e15ab0c-95a4-448a-a235-1a3567c52365", "value": "3072:qH1vfg7CHCjP2Pna2mEja19WaM2yZJFPIg:qflHCr2m19WaMNhQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780798949, "uuid": "596257de-5b36-441e-86c9-e6ad1a18bce9", "value": 140320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780798949, "uuid": "8f5c45ea-2fc2-4756-913e-960129c1d412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780798949, "uuid": "7d1ac59d-413d-485a-8aad-a760de1b8f6f", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebd044c-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847434, "uuid": "6db00090-cd82-49ac-b7c7-f48b1609b313", "comment": "Malware payload (Mirai)", "value": "9bbfe63a31aa1542feac8386f63739c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847434, "uuid": "53f32d46-e1db-4a3a-9989-254fe9c74598", "comment": "Malware payload (Mirai)", "value": "634ef1d7252b8636cf06f1ae4a800a560a68b0372a40f993764b9cdf62840aa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847434, "uuid": "799261b7-8938-4861-b040-8da7618fdc8b", "comment": "Malware payload (Mirai)", "value": "f50824c717b484287317401836d67a79ea1ca9f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847434, "uuid": "6fe517e5-77c6-467b-888c-3c7152f6fa9d", "comment": "Malware payload (Mirai)", "value": "5f9a65d76c3038f8277d02516fd4475f34e92f44fb8a46e8e7c1ab2dc2f564ada587f8149177ea4fe50e0b92720da066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847434, "uuid": "87881978-761a-4a0c-8c09-bf6a12d03aee", "value": "T19CD329D7F900D9FAF80AE33648534909B130B7E50A925A373253357FED3A1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847434, "uuid": "b498fb0e-aa2b-4124-9cab-b782c9924f57", "value": "3072:Q3dj1AVQrmTU0dCKgzU5VojbiwLYE/2eystHEvx:QIVQrmTUJKgzUCLlystOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847434, "uuid": "8dd7ec9a-d0b8-4844-8567-54c084eb64f7", "value": 136352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847434, "uuid": "f676f1b4-9630-4972-b94d-101ef464d733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847434, "uuid": "9f625b4b-8fa2-43ad-993a-4c8c3abe981d", "value": "CRY.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f80f7b5-6273-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780838308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780838308, "uuid": "43a822b1-3f1e-4998-89e0-c9b77c3ad955", "comment": "Malware payload (ACRStealer)", "value": "5bb16847af63b7eaac675ca18a78ca1c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780838308, "uuid": "e37b57d9-d38b-48fa-b0d8-b863ffd46931", "comment": "Malware payload (ACRStealer)", "value": "639b0811c9f109328398efe15d75f3b2144af3c3286783f39247721e2415b689", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780838308, "uuid": "c5e1a426-a1e5-45c9-a116-074b40513e33", "comment": "Malware payload (ACRStealer)", "value": "eb564dbba9406031fe62c9939845961ef778a3fa", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780838308, "uuid": "d4d8f74b-afc3-400c-95f9-af85572bb5b7", "comment": "Malware payload (ACRStealer)", "value": "04ebf86d9bf76662e1a63bc837ad01bfc4d9204a660ae8b86d02c7163fe8644d69d41c3774a7b2295100ce18d3dc47f1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780838308, "uuid": "5fd36c5c-5f6e-4d85-9465-17c5599721be", "value": "T1D4458BBF93A648D3D6C5B03F0FE97A1E4138FC9913B0D6B72793241727A8D81159A16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780838308, "uuid": "129d2bd4-130a-4674-9619-c54acf801460", "value": "24576:YWryiFiOM6yhn64eVhGgORLfVb6mb7/yfZIWqgF9ewy5ZVoxMat4:lun6LchRL9b6C7qemby5Zaxr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780838308, "uuid": "5fc42153-ecf6-416e-a56e-312b93365062", "value": 1202224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780838308, "uuid": "90ba41d9-49a2-4523-8554-52ead0f9ea39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780838308, "uuid": "645472bc-a071-474e-a3ce-77d2be5af695", "value": "swfobject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dc058d-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847528, "uuid": "bbd6fda3-b7ae-4c14-a0ac-db637fc2ca2c", "comment": "Malware payload (Mirai)", "value": "4bfb74242241423bb18267ac952b124e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847528, "uuid": "0c300c1d-26ee-4d60-8efc-65505f093574", "comment": "Malware payload (Mirai)", "value": "644933ccf018523580c4b45682ae4f58a46ac8b9bebbdf138b908f0eae37bb59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847528, "uuid": "30120478-de84-43f2-80cd-461aa0f6b67d", "comment": "Malware payload (Mirai)", "value": "fd9d36b4f0dd398862b0c1a2df62f4a071b64ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847528, "uuid": "20eddc56-43d6-48ac-92ce-6d8c7a246b94", "comment": "Malware payload (Mirai)", "value": "85c9ece7be405e12b01c0fea08a664ac27887ff612b61854d1fbb58996566178f0f36d0c06ff611b318f7c54ac79775c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847528, "uuid": "17490a8f-e0b6-4f4d-b0e8-514990fab743", "value": "T122C33B17B4D0C0BDC4D6C2744FEEA616EE32B1ED1234B21B37D8AA762E49E215F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847528, "uuid": "fef6c069-ef4d-4a4f-8190-cb2ff3c6462a", "value": "3072:me8U6zQ/pKM4Ap9jSAk+myPM7ETV3UREh:aDn+5PDEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847528, "uuid": "1e7b45d6-bb60-4259-9098-a5f62e077652", "value": 126200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847528, "uuid": "a81f0082-f7c2-435b-9b01-1ad89deada86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847528, "uuid": "09d76056-4c33-4bb6-8989-b20858d2d40d", "value": "CRY.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3a185e-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845977, "uuid": "3158f6c7-975b-4c86-8e6d-1339d645964d", "comment": "Malware payload (Mirai)", "value": "bbf98ff6f41e26250761ee6b72583c3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845977, "uuid": "7841d3d2-605a-43bd-99c0-944ba0827697", "comment": "Malware payload (Mirai)", "value": "6463556b7909e990f3364349e3c9dd5a2cb61acc1d16a20f7180700507fce5e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845977, "uuid": "52552b5d-c777-499f-9505-b99152ba36d6", "comment": "Malware payload (Mirai)", "value": "2698e9985eb05f3d5f9399995f7a59600f09a4e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845977, "uuid": "24542368-d8ee-41ab-9672-870cc67ea5e6", "comment": "Malware payload (Mirai)", "value": "36e02b7b683e959cba5559327423b7c84ccc1430c49fcef515738678e4c8d5c1361c6423d6776483cabdf1eda455a59c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845977, "uuid": "3b50bf0c-4ccd-4032-bdaa-143bf0008ecd", "value": "T10D23F1F342AFAFB5D077A472192922D0BD46782E21EDCFB7049624BF98275944D32E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845977, "uuid": "9ecaa827-dc05-426c-8825-88d52f8ad97c", "value": "768:kQaxVarUB7UzuLOgMJrG1tYjSC60fS7hocXwWyx6fUBnEowOVFLyBaVRNXqCx0JA:ixnJUzuLHMJxjc2Iho9LDHwunXlwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845977, "uuid": "4bd9c30b-61fa-4ff1-8aef-0e5946eee213", "value": 45684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845977, "uuid": "aee86d6d-8cec-4968-8147-6bf0b23b79fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845977, "uuid": "448fdffc-f749-4326-b599-09c85ae99c68", "value": "Mystic.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44646bda-626e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780836115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836115, "uuid": "46dc0fde-8519-4bb1-b57a-85d1f8071bd7", "comment": "Malware payload (RemusStealer)", "value": "a74e2a4aa786c425e8804ffa0b05c996", "object_relation": "md5", "Tag": [ { "name": "demale-shop", "colour": "#78C50D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836115, "uuid": "e0da964e-b0c1-43cf-8456-3a5f4a912bb3", "comment": "Malware payload (RemusStealer)", "value": "69d92815865bea3b8266f56c096d5e4a01528aabc98dcb00ef34ea9ba77c5fdf", "object_relation": "sha256", "Tag": [ { "name": "demale-shop", "colour": "#78C50D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836115, "uuid": "9102bdc5-8b30-4e00-bfda-de8e870ff4d7", "comment": "Malware payload (RemusStealer)", "value": "7ba5ab1c53e08c46a7408392619bafde43f12fe2", "object_relation": "sha1", "Tag": [ { "name": "demale-shop", "colour": "#78C50D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836115, "uuid": "45989d24-3440-4356-8885-a36593d0dc7d", "comment": "Malware payload (RemusStealer)", "value": "a32526edd8213a91549ea1d0290a6f68c45d6726df30e51fb03a950aca990f62b327d5e5d4739c1756e98274936d4177", "object_relation": "sha3-384", "Tag": [ { "name": "demale-shop", "colour": "#78C50D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836115, "uuid": "033933f7-8ab7-4806-8fc1-8638a3969087", "value": "T129664A1B7CA005EAD4AA63328CB622917BB5BC4A0B3223D72E50B27D3F776D49D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836115, "uuid": "fd4fe099-22cb-46ee-ae61-3eea71052194", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836115, "uuid": "19e59362-4657-4c8a-9051-f63c717cca0a", "value": "24576:8Jy12a41x/yf5P6PQiStUaImjfOrql/NBele5yK2CxnzuWdXo/xij:8JO2l3M5PAQRUaIyfdMkdu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836115, "uuid": "c122933e-7d66-429f-89b6-9e7a75d77967", "value": 6989960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836115, "uuid": "759e6af2-4b62-4183-82ec-7c8bb4675c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836115, "uuid": "6b15986b-52fc-43a4-bb1c-9c829d429379", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ceb019-62b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780868333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780868333, "uuid": "c68ac742-baff-4c86-a208-6a64017b1eb2", "comment": "Malware payload", "value": "baa0b86c2d2eb90840a42dd9a8f1e06b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780868333, "uuid": "13ebb36c-86e8-4cc5-a15c-29eefd557d44", "comment": "Malware payload", "value": "69ebacf262236a7c8404d82f5c350f6006b5b8fd12ea030cc20d8fda382ea7f4", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780868333, "uuid": "6f0495d6-8d93-4111-80f8-5d4371c49423", "comment": "Malware payload", "value": "9b2473153d0b30516f800cee010faaa3a6b00684", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780868333, "uuid": "db9c6701-0500-4352-a12e-05dfd19248a2", "comment": "Malware payload", "value": "56528cb5f8eb8b67cc4bf6dd0ab6cab716acab7b37e222cda24bf710c99d519f0f50afe5d90be91357752aa3033167f4", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780868333, "uuid": "a8da1970-f5b7-4db7-8f67-ce19274940ef", "value": "T10D07123B634BA53EF06A1B35B576A9A0583B6E90A4124C0796F0FC6DDF350721E3F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780868333, "uuid": "612f7585-5a93-4ba0-88bc-b102902e0fc4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780868333, "uuid": "639d978c-7d27-4a61-b6bb-b2640dd3d2c8", "value": "196608:gNPDOftUaBjvvazs6uqsGzhgMv8uP0SQd4:gc7HahuqVhzQd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780868333, "uuid": "8ceadd1a-ed70-4744-be6e-447c4d646632", "value": 17434299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780868333, "uuid": "5f4491c4-6abc-494f-bacb-39af07393673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780868333, "uuid": "0f0f037f-10dd-4595-903b-f446a0f93961", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6580c2dd-62ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780862800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862800, "uuid": "ab415309-769f-4fc4-9526-1151ddccab81", "comment": "Malware payload", "value": "93c30e1496232b1948006b9930d2df09", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862800, "uuid": "20b0b43f-49b5-463b-b5cb-ce672b0cd609", "comment": "Malware payload", "value": "6b96b764b5051e1b4c319a8584ec401af75d33c0fa8d271c54e447e0a2e75a82", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862800, "uuid": "fac3fd28-9f08-492d-aadf-11e9adaefc6d", "comment": "Malware payload", "value": "32b418615d6018dc8ab0275b2c2d2595d331a925", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862800, "uuid": "ae420d4b-5b4b-4f66-832e-8d96840019c9", "comment": "Malware payload", "value": "b250626864ca31a5886f9b0fd186fbf7ea916d69dfbcc10eb3a2b0103d1f2883cbf4fb883edac1cf0c1cb9f12dfe3711", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862800, "uuid": "c2674888-ff7c-4624-86c6-aa9e83fa4316", "value": "T13531C5AB071A3ADDA401EDB973A91158C060E5DE204FE7E5FB4A1CBAD6C82483355B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862800, "uuid": "090d03b4-907b-4f99-927e-0de87d27ab87", "value": "24:aeKOIbmo28+flTASiez5kueugcJJnf2VZhFhCPSJ8UhNP:KOIbB2rlTADueuvGLxVhNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780862800, "uuid": "43742351-4310-4ca4-a555-b928a5f88acb", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780862800, "uuid": "216517ec-7e47-43f0-a2bb-c064d80d2a68", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862800, "uuid": "d217d042-5c1e-468d-aa05-40cff695db07", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38c935b-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861186, "uuid": "10290bb1-a9e0-4aad-8fb9-784ddce893f8", "comment": "Malware payload (Gafgyt)", "value": "a7ae16ad707defffc5b20c26eeefbd10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861186, "uuid": "f405b8b3-b56d-41eb-925d-5497857d76bc", "comment": "Malware payload (Gafgyt)", "value": "6c4833c25ce2d479932759249b2f5ee9aa3955132c17e70b5c2ebdd1d1d20907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861186, "uuid": "f6dcbb0b-b855-4c82-8e4f-8e8e866d1306", "comment": "Malware payload (Gafgyt)", "value": "e38e6463adc985ad8bbdaf8cd748f692e5ce49ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861186, "uuid": "6a61747e-4530-4369-b0e8-cf8d1568fb01", "comment": "Malware payload (Gafgyt)", "value": "1861065e3855a18de7eadfad6b341ec59348ae0555c0c566b3695c029a000ffa626ef4989aed989cc9bbb0cbd8cf0de3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861186, "uuid": "4bbd1550-e793-451c-ad75-7b9561caa8e1", "value": "T193933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861186, "uuid": "699f7dff-8962-41ed-b0cc-1b691494dc25", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Jl4umXxVqDrstKfz9e:Q97vk51RcG7ADl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861186, "uuid": "28b3f27e-89fd-4552-88b7-d97e2f261793", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861186, "uuid": "6ab0af6e-4851-4da8-b683-f243610c8d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861186, "uuid": "64f2ffc2-1b0c-40fe-a32a-4f6c2dccd796", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53adeb6-625f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780829889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829889, "uuid": "b830b87f-b233-4f33-824c-1a6a1e31443e", "comment": "Malware payload (Mirai)", "value": "fa62c371c030e12933feded2414f365c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829889, "uuid": "cf4fdab4-d39e-4805-8be5-03c2e56d7ea8", "comment": "Malware payload (Mirai)", "value": "6f4937115deae4ea178a4112944418156e79a32c5a9012d27ff774ff436ea9ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829889, "uuid": "77c5081d-75a3-40bd-af7d-27562efdd9cd", "comment": "Malware payload (Mirai)", "value": "49f295d1d4b9f5d9ab6ea4bc749034a9313a274d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829889, "uuid": "4f669354-6bfe-4f40-a252-56a21ddd2882", "comment": "Malware payload (Mirai)", "value": "c84c2e8c15144958b0726485e547b67edff80b6e375ec61d2f9b6d584ef3862e532f0339470923e8294eed1cc4b13551", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829889, "uuid": "547d7c20-5060-4251-8e4a-7307da0082d9", "value": "T1418302091D9CE2D2DBE655FC2C15678B4BE84D0CD898B2083EE0996B314AF771D72F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829889, "uuid": "020fec2d-f19f-4e78-bf59-2c13f6d75af8", "value": "1536:gY8TyX2+b3Tj6l3+CCmC2rbkUG4wIQLbM/iSdTfh0ashhSGkBd2116YHR/JTc:gpAG9CKkUTCb2v1fWnrSGCdIXRpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780829889, "uuid": "84968a02-35bd-4e67-8192-4e621c3dded7", "value": 83148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780829889, "uuid": "4ef8da76-4af9-4740-81a4-9dc8839c08f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829889, "uuid": "c13ba998-5dcf-4a7d-b055-3934cb1c98d3", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a1fcec-62a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858587, "uuid": "0691ae50-71bc-4347-a1f3-b6b2c6d9d621", "comment": "Malware payload (Mirai)", "value": "bf6cc84c34116ae0fad657a07c5ff70b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858587, "uuid": "86c55681-6be6-497d-a8cb-cc2c24b76a82", "comment": "Malware payload (Mirai)", "value": "702e6a19a4ede3ea2d96edd1e8570af3b0e612b80530b56c37ee1d39d425d68b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858587, "uuid": "54a4f3e0-b710-4325-8370-4368816e6de1", "comment": "Malware payload (Mirai)", "value": "bb5e00ca15085f07037e93cceded2e3f521ea26e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858587, "uuid": "e5ceb608-80b6-4a98-b40c-881974b101a3", "comment": "Malware payload (Mirai)", "value": "aae65bc96fea047830e7a0206c85a85edd698d23b72b64e4948a3065ddf44171d8e0800c98a42ee1a46ce7cad916d70a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858587, "uuid": "09374bd2-cb04-4589-9ce3-5512bf4d72e2", "value": "T1F543F231CE3009EED84B80B446F157425A3A4B9DDC534D430482DADE8D97AB4B86BDFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858587, "uuid": "abbb5110-f30c-49d1-a5e6-ec775f019c55", "value": "768:39NbqdDw07TECMJrRQkoEsoAF8EEyZjaM6K5MsGl6y4QNhvMg7+SoUYm2xsW2Jgn:3Xqw1YkKoAqCmMLxcNhMgqc2SDVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858587, "uuid": "63c8dea0-21ca-4598-bd15-4c61e5f65c98", "value": 56512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858587, "uuid": "5c905019-61ea-44d6-b9fa-b7198229ef53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858587, "uuid": "61823e6a-533c-4c7a-a99d-bc3fe25947b9", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f0c57b-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861188, "uuid": "3bd26b89-2de7-414f-9cee-82a2eb3b49ff", "comment": "Malware payload (Gafgyt)", "value": "168335522db6a2c5357c09d1efac1987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861188, "uuid": "a2449454-2c74-4d6c-9d36-46cbd86a76b8", "comment": "Malware payload (Gafgyt)", "value": "721153ef7124ea9af5014dd64eddfd44227536ce2f2d393e07dd8dfe7e0464eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861188, "uuid": "96c45242-83a8-40d8-aef5-520cb6f4e12d", "comment": "Malware payload (Gafgyt)", "value": "cdc5721cdec62d5186f1495d009f033ef90fe875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861188, "uuid": "ee3c7de7-f06c-40fd-a827-44c068352566", "comment": "Malware payload (Gafgyt)", "value": "bfa378bef046d4cfbcb86e85b02f765a40207f83fec14360f03e5af5c59c19e15b1d6d60e83f4daf38544b85efb9a42a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861188, "uuid": "6e37861d-baa9-4c83-ba7a-8521522f5d5c", "value": "T193F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861188, "uuid": "d91a6201-9813-4fe1-add1-5af60ac01a48", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBpYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/jYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861188, "uuid": "e5352200-9b55-4b2c-8c3d-7d03c4c403a8", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861188, "uuid": "a78deeaf-6350-4f38-9807-3215e3042f24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861188, "uuid": "bf3a3258-1744-4d06-8cdb-69885a4243d3", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd566ca-62a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780860450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860450, "uuid": "faca50d8-0646-4333-b7b0-f7b4b5d0600d", "comment": "Malware payload", "value": "c36db6a013b02c091cc9cadf633f8edb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860450, "uuid": "fcb1e91b-e33b-413a-be4b-82b97b72aaf8", "comment": "Malware payload", "value": "7258a8eec22b21345dc754e2b90b36e6faec37978ce6a8cd327767df23a5d27f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860450, "uuid": "cf6bf257-fe0a-46ad-b809-6de511ae9f20", "comment": "Malware payload", "value": "5df4781f224ba4ecf179a8f5d11d506975d0301f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780860450, "uuid": "87fbd061-4541-45ae-86f8-8673d79bee95", "comment": "Malware payload", "value": "4d40d77c804c61b311adff1a554ed7f9468eadc52d1980eb1e689906645b1d3b51e5f7c82ab49c34fbd4a512824751f5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860450, "uuid": "1fed3723-6ace-4a29-90e8-7b72d1035db6", "value": "T177F62320E9868432D16F4777E92CEF1E49353E633B3305EB76A47D6E09F18C26675A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860450, "uuid": "49403529-f297-46ae-9c27-318c8ca456fe", "value": "196608:ZLhRFt0Q/7CEm/1ijcbUBn41J2IZGaGNWNOfuCfEAUnb94zZup52Ob9f1H/:ZLhRFJLc1UcGn6ZZGs0fgb90Zut9NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780860450, "uuid": "2d2bfa9b-7fe0-4b64-b886-1f7add7d864a", "value": 16030208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780860450, "uuid": "5225b6ed-c260-4aee-af20-fdd955ff8487", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780860450, "uuid": "8182285d-9a8f-4d4f-962e-c011c0e2e102", "value": "DeepL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0600ef87-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859204, "uuid": "6d5ec576-4e26-4b63-8566-b54d6dbe324e", "comment": "Malware payload (Mirai)", "value": "d73607d9ba2d1267c8c45ab9f173a827", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859204, "uuid": "f7595c8f-efd0-419b-a7a2-4fab91045a36", "comment": "Malware payload (Mirai)", "value": "7398c35856f5b73d61895f6abe311a36efcc1e80ae20da64a0f6d36843a75291", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859204, "uuid": "75222e58-6c94-40b5-bfb8-dc8a1423563d", "comment": "Malware payload (Mirai)", "value": "afa51394406af33edcdee6641f427650cab2614f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859204, "uuid": "988a316c-a8e2-4e79-9e60-d22f71d4bef2", "comment": "Malware payload (Mirai)", "value": "d39833d5f8435f30b778c3f17aaf97fd32e28bedaa9191b1a8ef2a308baa63fcc4d2e015e1ff9721b7cab2b88b89bda7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859204, "uuid": "f601e87d-4e37-4a30-bf5b-d283c1ecb0df", "value": "T180C33A06F58184FCC08AC2341B6FB63AA935F1DD1238B6E76BD0AF127D4AE614E1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859204, "uuid": "65375b40-dc31-43fe-881a-28f6720f0e03", "value": "3072:pxv986gurREnQI8ysmTn645T1c4n2pPCZzFr0PGvHS3/2zQAPUAackTz2j0:DPgurREnQI8ysmT64J1c4n2pPaFWez5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859204, "uuid": "a3dc1bba-1dea-4a00-803d-e7c044d91740", "value": 126304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859204, "uuid": "ee9cdb43-f0be-4078-b11a-0a424fe8395f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859204, "uuid": "1b9e61ee-c780-4c67-a168-ca7989b495dc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71746ec-623c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780814913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "5480f36a-ca3c-4128-bb3a-df5df1c84ed3", "comment": "Malware payload (Mirai)", "value": "2d8337f4db62a879bf88987dcb12688e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "86e4ed69-c441-4906-820a-ef924b958bdf", "comment": "Malware payload (Mirai)", "value": "73e8c321e17b0b8b159ecfc5f440cbd1c88ea07e275f029ef16b35dd6acb715a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "b1e25894-ee1b-4bdf-9785-006f9d8761c7", "comment": "Malware payload (Mirai)", "value": "355d8896e4b387e4a4753ee5a5c6d6cc1ed92cdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814913, "uuid": "6bee03a1-c616-4336-ae7c-b7944a8b4291", "comment": "Malware payload (Mirai)", "value": "c58f063f4c4a7a00977142556e0ee1c3867a3902810158fa899b43b8965e149d50b95f573d467d56d44cd671f07bf837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "c5624a86-69b9-46e8-a138-ae9205297d86", "value": "T1A6D35A45E7E3D1F0E68742F00167A3E68934E530A112D9D6FFA93D70E971281AD9B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "9564381b-0519-44df-88e0-9e2b81ce7269", "value": "3072:Fbdm+ZKMEswlTV9TuSDWFHMULr3nfYrV2mCQGSil7:FiMEsATV9jXrfCQGSil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780814913, "uuid": "bf6d616f-7557-4b8f-8803-ee8cd4dad1ba", "value": 131832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780814913, "uuid": "a7219a93-0d48-41e4-8eee-147c959b0f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814913, "uuid": "7fd6dbbe-b5d2-4a2a-977a-2ee66e7b686d", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b98bda1-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817122, "uuid": "d375fe46-5498-4de2-a538-f5c893188372", "comment": "Malware payload", "value": "7501d7d6c85c5dd2663c1c09ff3c97bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817122, "uuid": "12c0439d-12e0-49bd-a837-deb2766a8f48", "comment": "Malware payload", "value": "73f0ae679e980df97cb857c1cf136d1c6398fc7f6243e10e91491ac8e9e77d2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817122, "uuid": "bd1a85fa-f494-4c22-a29c-64c1e4b79710", "comment": "Malware payload", "value": "8bb9b69869b3559759be318e8ce713bc77fea3c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817122, "uuid": "7e641bb6-dfd6-4bbf-915b-4c51e66d7f82", "comment": "Malware payload", "value": "11bdf82642a995fdf898838c5c4306cd56b44fac5012d3afde6cbc6777a26f61db0ca513ff393366a8badb74fd0662b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817122, "uuid": "58f39e84-a573-4143-88a9-db3aa048d4c8", "value": "T13E059D46FB0CAE67C496027E88A783542335DD852B879B47AB6CF27CBC77228DF06541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817122, "uuid": "b014fd5b-ef4c-4785-a2e6-e4e32e1d3b9d", "value": "12288:m+VspQB2KijzRZzXW0/x6lC7Hp3XeH0l3+0vGPOZXcRyXcqq:hPM3jXbtdebOZXcIXcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817122, "uuid": "eba0659b-1405-4169-bc9c-04177044694c", "value": 821728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817122, "uuid": "fb1f61cc-2584-47b8-93dd-add79aeb8ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817122, "uuid": "571d837e-c194-4866-a7d7-4954765f8fd2", "value": "bot_arm_fixed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78ad352-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847529, "uuid": "e4856434-6243-4736-97ee-f63b5f9626e1", "comment": "Malware payload (Mirai)", "value": "1439e54782246d8939c39c309a01f8fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847529, "uuid": "5d773bd4-52fd-4978-b3a1-e5ebff81cd0a", "comment": "Malware payload (Mirai)", "value": "74e06ba4ea1ac38f03be673a4483c1068ea9d04b8cc3d6bdc80591a311bdd5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847529, "uuid": "1ad4276d-27fb-49c3-88af-79efaa1c8938", "comment": "Malware payload (Mirai)", "value": "c37935ad727dc7dd6960337e92af002ffa591131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847529, "uuid": "d7e958d1-85d5-4f03-b6ea-d8727451cc21", "comment": "Malware payload (Mirai)", "value": "211cf2935b3b311e3b32dc60f9c19eee4d75a04488bbef42cac65ef69c97e5730c4fba186dabf9d07e31572b595f1cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847529, "uuid": "c2179dcb-398b-4e0a-8186-d5766d5e1a7e", "value": "T12AB30845F8515B17C6C212BBFB4E438D7B2A17D8E3EE720399256F20378B96B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847529, "uuid": "451672bc-6b7d-41a5-afa6-853e339940f7", "value": "1536:sAFIx9gnNpFk2/WB4VcL7v7Tuhy8CTj2eleWwyw1N+kxQ6+raiwm6HpvOkjvE+X:sAFmQFkZ46f6hC3qQP2xE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847529, "uuid": "127c6947-2d14-46b8-a130-26e777e4dd7f", "value": 118144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847529, "uuid": "07931737-4b83-439e-a039-c202acca8040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847529, "uuid": "8f6c4f5b-4428-4c23-b3ef-e3f0ec1a13c5", "value": "CRY.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6108144f-626e-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780836163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836163, "uuid": "afca0ff0-e074-47a6-babc-7ceca7004009", "comment": "Malware payload (LummaStealer)", "value": "edbb02494175381b731916244d87f396", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836163, "uuid": "ad35fd78-5fda-4cf0-9bc1-907f32bf76de", "comment": "Malware payload (LummaStealer)", "value": "759ae151308b901cc721205f6029801bb0e38614d2e586c6bfe130ca6e42ab68", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836163, "uuid": "e84af139-58b1-4fa0-b359-741327488fc3", "comment": "Malware payload (LummaStealer)", "value": "fcd98b533f6de40b51af03ffb9fe9abdd8855e5e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836163, "uuid": "d952f107-4d0e-429a-89ee-60cb6abe1448", "comment": "Malware payload (LummaStealer)", "value": "032d93ce7477542804212d83bf1e8d85869cd83cde775f703dc0fcca123e222313cb787473e96f043d70c7b2f195fe89", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836163, "uuid": "07c5f445-1a69-4f30-abe8-265e8151bc4b", "value": "T1A9063900FDD788F6E402563289EB23AF2735AC050F329B97EA44767DA97B2D50C36359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836163, "uuid": "3a73f981-55ae-422c-8bbc-22b30da1d565", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836163, "uuid": "560d22e2-b034-4847-91a5-c11db76149f6", "value": "24576:2QLVPAYgayJg/LdrJMeShWMCFPLj+CoTBS5nDMYGYM+vw8ZgY+b4Cb3cGsaVy:2+PT9SGFBZw8ZHe4CbsGst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836163, "uuid": "62d026c6-e23f-4a90-bed8-878421ef07b9", "value": 3892360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836163, "uuid": "d4df2150-438e-4f34-bb0a-4625512300e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836163, "uuid": "6009227e-5a72-4b0d-b07a-ddb6f31815a5", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4897a79e-624b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780821090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821090, "uuid": "665a3745-fbd9-493e-86e3-5e0d34b4e152", "comment": "Malware payload (RemusStealer)", "value": "f04fcf81a389710889e308fe32c82ad8", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821090, "uuid": "527dc148-c6f8-4b62-a882-42df1031e7b7", "comment": "Malware payload (RemusStealer)", "value": "7610cdd6e67c920d672ad8206692591fb58219efaeb3c5697ebbbaa42184a301", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821090, "uuid": "4168e0e9-4c1c-4aeb-b68d-2bbbadf2b79a", "comment": "Malware payload (RemusStealer)", "value": "dfa021b6dc6da7fcad0d103b165f7acf83568806", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821090, "uuid": "e7cfb05b-f1b2-4484-90bb-fa4332aad9e2", "comment": "Malware payload (RemusStealer)", "value": "7409f99ea4e64ea13658aeb63082ccddfd647aaa5c1381f0876300426aa9e2e38f9734a8b67ac510b38bd46ba988000f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821090, "uuid": "9d534f64-6dc3-41f7-855b-89495087fbf3", "value": "T115B4024222E44E41E835DB38BCB54F471A697CA64F7CCB6E6327720D68B26D9C4387E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821090, "uuid": "67e8258a-6313-4eb2-b956-25a0cdf8ec78", "value": "6144:n47DSw+ylVoEZhEFBq0qf9++b+ABB60ZZHvrg37YU3fMuYD+nWFHVnhVF/i:YDnVhABqR0+bjy0TDg3d5YOKVnp/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780821090, "uuid": "705f160a-adad-43dc-a8ec-04088ea73742", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780821090, "uuid": "8f505b0b-bb74-4e9d-88a1-dcaa491d8ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821090, "uuid": "936835cc-7acf-4199-8525-bdb3b286974b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b717c30a-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "1647e3f8-5daa-412f-bb64-ffd86d07d2ce", "comment": "Malware payload", "value": "19172badfedbf995822d018b89794ab7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "e131ff84-d916-4e42-a9c1-cc8f93a64a88", "comment": "Malware payload", "value": "7786c84a5ece037cbeea6c97dd0a82f876e03877e9896a28a9333ab78cfe588f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "0f20c0d7-aa3b-4172-beb4-421f6cc6fcd9", "comment": "Malware payload", "value": "5bff64a5adb6d5b12a4dc5d996fc583901845652", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859071, "uuid": "fe7a2fc3-97e2-44f3-bdb2-466cb66386e6", "comment": "Malware payload", "value": "cc7075029a5a9e0e27a8e2fca4f07892cd62cc0a62e39d2324a01d2c15ecbc80c72999593a15b678be6796621672556c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859071, "uuid": "75255aff-f6be-4d19-9d93-3fff34a079e0", "value": "T190561897B9D24982C4E43A77B9BD81C433630EBA9BC652566D04FE3C3ABE1D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859071, "uuid": "d739d069-adfa-4da2-84f0-badf0723da84", "value": "49152:uFWa1Ul1qgC7XkxPY0jl31Lkxo6ESeAOxCOxx6ipUd+I2T5EB:BayoXkxBcBxiWQlEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859071, "uuid": "84e5b6b2-7fdb-4379-9011-cad45bdad8d7", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859071, "uuid": "8ba83111-7d20-44d0-80cc-db6023330c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859071, "uuid": "ff32d141-4d85-4ba5-ad43-95fb1869b94c", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4852a677-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846000, "uuid": "81604c8a-e92d-4bbd-99b3-68d66a544b84", "comment": "Malware payload (Mirai)", "value": "ff8029c9593d9f705f1c5f19a07790d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846000, "uuid": "a5df05c7-081c-48c2-abc5-6a865fdad673", "comment": "Malware payload (Mirai)", "value": "79f49d4390a0cd0ca33b2dafcf6340b00451087b1e333809a9bf8fe6d0ad4727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846000, "uuid": "4a21d1e5-1378-4996-b699-6f981761beb2", "comment": "Malware payload (Mirai)", "value": "cbacfcf7faa2e79e152c76fd6b0e5682d3d44621", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846000, "uuid": "3fe908f6-61c6-46ca-a684-e53ecbe914c6", "comment": "Malware payload (Mirai)", "value": "a78b9d1be8219a44f255f6b6045199102276e463ce9584926e4d0e829134770da6dae2d88ca4c46aa805b18e992f6f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846000, "uuid": "0d9e9fdc-8238-4d1c-bef0-063eb0a98ca7", "value": "T110B33951BC825A22C6C6237AFAAE418D372563E8D3EF3217DE215F2133C651F0D67A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846000, "uuid": "1fed7171-fb9a-4f15-9066-99ed51897fd3", "value": "1536:vcJDiNMARPokkW4S58fzZWLM9Z+o7lCRObHERRSiUhe7sbwvk9vSum:vcJDiNMAJokk/4LeOeHERReg7QSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846000, "uuid": "77e67be8-03da-4759-aa84-35eff6bba43a", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846000, "uuid": "03e7859a-d4f5-41d3-a128-b27f2c5ded49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846000, "uuid": "a567f9a3-b728-4fa4-b6a1-3bc0492d150b", "value": "Mystic.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd3c570-62ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780862898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862898, "uuid": "f25525ec-004b-493c-8696-0edfda692179", "comment": "Malware payload", "value": "5c74b97eb1eb17ac8a35029b0edb16d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862898, "uuid": "a64c329c-713b-4049-8398-d128899c4409", "comment": "Malware payload", "value": "7a358512e77afc93c1c76fe5d99fd112947d845ec1f60e75acabe2db7d113ec7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862898, "uuid": "9dd65f38-b1f2-4ad3-8875-b906d7b7aade", "comment": "Malware payload", "value": "aeaee440bf7f911c2b900a6aa18fe8d2e8615656", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780862898, "uuid": "f3139c38-20e3-43e7-8b1f-4655ae287d76", "comment": "Malware payload", "value": "fdf002b6b94b3be68866f6f3a64ea1f5e6524b0da02b948861483700ecf56c6ceb5800c5c69f8fed912fa9233c5aa65d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862898, "uuid": "12d8873e-da83-4bd5-bb92-3240e67b118a", "value": "T147136C6566953C24AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862898, "uuid": "173ebcec-9819-4695-979f-17c826bd3877", "value": "768:2XRWNGxVv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:ylxGco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780862898, "uuid": "992b06bd-e8d9-4395-af56-9c99cb4de0fc", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780862898, "uuid": "39be7ae8-ac59-4c6e-a6be-6096ffcde9e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780862898, "uuid": "e1e1d724-e73f-4135-b1be-8546de2046fd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0f62a3-6233-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780810895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810895, "uuid": "06e36245-b2ff-4273-ad09-91b8bd5d9308", "comment": "Malware payload (RustyStealer)", "value": "b979508fc1ae3e34c6238e3fe2fb293f", "object_relation": "md5", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810895, "uuid": "f1e3b9b9-d397-45c9-be14-57555a35b71f", "comment": "Malware payload (RustyStealer)", "value": "7b00c4529a376875298fe04ff1bddeb20e17f07691f41cf1465af5203d3dec7b", "object_relation": "sha256", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810895, "uuid": "2ab021c1-0df9-4265-97d9-cb10dd73a461", "comment": "Malware payload (RustyStealer)", "value": "1d2dd1dd321f56bfcfe2e7cde03a427c4d4ad45b", "object_relation": "sha1", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810895, "uuid": "99cb4d59-fd4d-4ebf-9be5-b1190b36b993", "comment": "Malware payload (RustyStealer)", "value": "e0c5deafa39c88cede3c376b995f7ce5e619b745da2b645dec00b5623200ced9fa293dda15fd721bcbd748949a0f67e0", "object_relation": "sha3-384", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810895, "uuid": "fc45c1c1-a15e-4d48-80b9-c4f1e995d828", "value": "T10CF5334AA4E01BB68211B5B55DABE4CFF7FC756B82220ACB1F12C3EE3109C6D7711562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810895, "uuid": "7348da41-9403-4f05-996d-aee38bc9b387", "value": "98304:C0KQIWuJmMQzI51Zyjkoj80a0F+Ju7IfRabOw:1fCQSHyA0a0ktZab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780810895, "uuid": "7f811fc2-bfdd-442a-b39d-aea02cc12d1c", "value": 3425690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780810895, "uuid": "95a748b2-af05-4ab1-a9a8-9cbcfa93c725", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810895, "uuid": "f9a8017b-e24b-4c7b-a576-f9ecc0640bc7", "value": "Reader_install.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a1f580-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859020, "uuid": "8408a1ca-9414-4385-b6be-c3616a6a8f67", "comment": "Malware payload (Mirai)", "value": "b4880b5fd0e7559e7d8aa6e1ddc47a62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859020, "uuid": "ef335b74-e3e6-4b5a-9a90-b82732c2b9ca", "comment": "Malware payload (Mirai)", "value": "7d8b9b66f560e9b1022f867669ccf462163e32f2cab29945583d1a3afc03a1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859020, "uuid": "df00a51b-9e05-40ee-b08f-0e941c7921b1", "comment": "Malware payload (Mirai)", "value": "c286b624d829228544d1de0d170d4012c42b1778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859020, "uuid": "563d8532-3c40-4d3e-a56e-e61defebb40d", "comment": "Malware payload (Mirai)", "value": "43baed4efd351ed7dfa7c222a3827a85c290a0d42031da7092f442a1d967adb2fd640fd86ad015974956b32d7d3cf45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859020, "uuid": "a5665195-6919-4928-90f4-38dd84e9c489", "value": "T1F4E33907B8C094FDC499C1748BBFB13AD972B06D623CB29B6788AF221E4DE604B2D555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859020, "uuid": "3d8c9906-ec8e-49f5-a138-94e39378b2f0", "value": "3072:pNen1u/AOe3AOoWKf4Oa5SGVK8uEAaKN5/nMagUskICpwrPZ+S1Fphp:ren1u/AOe3AOoWKf4Oa0kKnRiUsewrB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859020, "uuid": "412b4b12-498f-4660-8d54-4547fabd1961", "value": 156184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859020, "uuid": "5bc44819-b61f-4eca-877d-430bf681f4e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859020, "uuid": "78e6bccd-3d39-440e-8e37-175404229690", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb75e2c7-6280-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780844127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844127, "uuid": "6d8f4b8f-8a4d-4ebf-a9cf-589899acecd0", "comment": "Malware payload (Mirai)", "value": "999ce814bdbde48e252ef3979d91508e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844127, "uuid": "8aaea10d-2d24-46ff-92a3-01b1adb7b79b", "comment": "Malware payload (Mirai)", "value": "7dca536f80d61bfb182eebc0d9e17e3723194b2a472cb60c8cc2c0a119d4a2c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844127, "uuid": "cf38fe2a-f934-4525-bade-b8130a7f2348", "comment": "Malware payload (Mirai)", "value": "1eacb4d51287ff8f33acf6cf820dcb8f938fd441", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844127, "uuid": "bba3fef2-4ce2-4211-9094-330a81502fe2", "comment": "Malware payload (Mirai)", "value": "527e1bae879d40760ebc182156aef2138740fc5e5f13403be3c41f8fdb6d2bd6fe03693180b9ddc9e629ef81757fbe4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844127, "uuid": "ee6c41ff-bb5b-4b53-b1e4-2729f18922db", "value": "T1FD413ECB61924975BEA0ED6B31AE884D33C4E5E780DFEF6468DC34E4809FE987410697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844127, "uuid": "81ae0da2-cc49-4db0-a124-9f5f39e21375", "value": "48:vtwtkt1atItcht+apfUxt7Atkttjg11JtMttU3CGttdUvpLttmhEqJttn76Zc:vmqvaWGhEalUxRA66qjU3CGjdUvpLjmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780844127, "uuid": "7e655333-f398-4029-9b62-731ce88187fc", "value": 1970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780844127, "uuid": "0ab860df-bd10-4971-b1c1-7152474abb5f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844127, "uuid": "eefcca9f-5036-45de-b21c-4435c89f4ce6", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad39c6-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859012, "uuid": "cc309d23-1b09-44c0-8a81-d1f826be7060", "comment": "Malware payload (Mirai)", "value": "af7bf022be6cdb113a8aedf7e39d8091", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859012, "uuid": "b919dffb-c290-4c45-ac29-e83f12cd9849", "comment": "Malware payload (Mirai)", "value": "7e0c4a05e2a3278cf079e5415984165f9a9a8f032802010803a7cb23a976aa6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859012, "uuid": "f7470389-f7a8-4822-b13c-be7ddae36f38", "comment": "Malware payload (Mirai)", "value": "1e09d9ac3c1869ae95da954957cee7abf758a277", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859012, "uuid": "56d6dd40-59a7-4ac5-a24b-c8aea8e9a1eb", "comment": "Malware payload (Mirai)", "value": "98e031d5a933e563d24ea1766667ba2616c694069688585fffb8b84c413adfeab2dc93b39dc76f5d4ba0041dfd26ca6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859012, "uuid": "4023db92-69d7-4373-b279-9e4a62dba650", "value": "T1EBF31846EC818F16D5D512BAFE1E128E33231B7CE2DEB2029D146B24778AC6F0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859012, "uuid": "539a1b2e-a10c-4af0-b363-37fbd1e779e9", "value": "3072:HTcMYmroLmpMguHcUNVUHalw7W6uH0BsfCuPFQp9peXJEaWOx0ecVxXpRxD249:HTcMdoLmpMguHcUNVUHalw7W6uH0BsfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859012, "uuid": "9c4d0222-8433-428b-9971-19c1df6288bc", "value": 160976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859012, "uuid": "1c65eb59-9fb4-444d-9d36-e1b1d270b414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859012, "uuid": "d49d1798-a2b2-4b30-a602-e911f30c6ed5", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8291b17-6246-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780819237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780819237, "uuid": "57649810-b0d7-4345-ba8f-8144903d274b", "comment": "Malware payload (Mirai)", "value": "fcfd7d0d99957e88640d3bb41df23c5e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780819237, "uuid": "1a584b9e-e9b9-4853-8705-135df75f398b", "comment": "Malware payload (Mirai)", "value": "856afa5da4d31cc2c425228bd4f37894834fe2659119a957a796dee1b3fc3fac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780819237, "uuid": "9cf58d22-afb5-4701-802c-d91e9b3dfdeb", "comment": "Malware payload (Mirai)", "value": "604b9e2c3c6b272a9082fcd5fb7886eb1c38d881", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780819237, "uuid": "4cb46190-fa5b-470c-82c0-6700a66de9f6", "comment": "Malware payload (Mirai)", "value": "91ab89b613046561bd06ee962953eb16a8b15890af0535f6aeffc1cc52dd85de584b9aaa9f4c3313918434cecc1581ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780819237, "uuid": "549293a8-832d-4c74-b495-69331fb1c7f9", "value": "T13301AFCDC013D6604289DCAE27EB61C07421C3CB15564BF87F9C543DDB69B48B065F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780819237, "uuid": "eb4237f5-b04e-401a-91ae-bed330a46dc9", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaqIx2FOI1HvVPs6IJGbAIybeRFIoGauD:kXCKysE2hi0ziQvZohaq5o69H1Mqjy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780819237, "uuid": "050b4f07-2809-4fed-baa3-a45e5dcbbd2f", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780819237, "uuid": "2ed6614d-ca16-474f-93bb-afce95e6a472", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780819237, "uuid": "ad3c3d3d-1431-4a97-9159-70b481d6d50b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05727630-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "959a2d9d-294a-4e37-b826-008c7f20230c", "comment": "Malware payload (Mirai)", "value": "b016d652bc535ded8f4995e3107a691f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "fde6aee0-32ed-40ce-bf9a-dc6a18601e69", "comment": "Malware payload (Mirai)", "value": "85f81d8713fa7d55806735490f7f5dac78b29f951b74feee25f25a627a36bc5e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "5b80ccbc-252a-4b79-acae-0ce6ee3398a5", "comment": "Malware payload (Mirai)", "value": "6c243de9979d8f6c6db70eb751695e9df7ca9584", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "c215d480-8edd-4799-b3ea-28b7f38e9cff", "comment": "Malware payload (Mirai)", "value": "68c3120bb7cf86b1296d8c2362b01de3b25d4076f5b0dfee3a29b296a866ffe8743d88a1e6a688994b123e32da3fc373", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "c300d790-10af-43c0-8bb8-5642e8068e47", "value": "T1C9C3AF73D42A7EC4D1514030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "0e053649-b6ff-4589-9d83-3b35c4732264", "value": "3072:hfpZykqkt436I+9eIHemNOkSMPXeC4GnHc:hRZ0F3BchNOkvZhnHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859203, "uuid": "e144e276-49ed-4c02-a13e-c364cb42d104", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859203, "uuid": "ff93389f-f8bb-415c-9bbb-4a43ca17c8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "96064bcb-2fe9-46d0-bf5b-f5949bb0ba7d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d79033-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "2c09e52d-6e00-435f-bd1e-c00580a8f6a8", "comment": "Malware payload (Mirai)", "value": "255007ed35e9f10eb684ecefd8241faf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "cf2c48f4-c2fc-4e39-a99f-03703a6da074", "comment": "Malware payload (Mirai)", "value": "86dec2a0e49a227a64ba225dba4b2483873f5958f8b857f86e91c1a5affd28c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "03df70c0-6ee4-41b2-b582-72e42530856d", "comment": "Malware payload (Mirai)", "value": "7bace2bbc8a59d0d336db49c6a401f1153d15780", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "927ba601-ce39-4fa5-93f6-62d91fdc2a00", "comment": "Malware payload (Mirai)", "value": "f830f6ae3f6be91effc60c023ca93fc23f34209b5f8625493edc4be44d5c86561710a93a43e9bed7ee58e1c87888befc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "4beb79f0-ce54-40c5-a63b-9d15dc6e61ab", "value": "T14AD33A2275791E2BC4E0A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206517AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "d522207e-9af7-4dec-a4d4-69898f334592", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyiOFe30Hi09lshKwTh:ZUH+FD99IVWFtqOgEmhPTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859203, "uuid": "141b7832-ebc8-41c2-a37e-751b021b0ef2", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859203, "uuid": "290669b0-5ae4-43d7-894b-f2b17f05af61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "0445d86f-ef6d-496e-94a3-7a811dcf0b2b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf69030-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847429, "uuid": "6f568846-a7d0-426f-8d60-3acfaa0ddaab", "comment": "Malware payload (Mirai)", "value": "8b5e94917217d13b7f128a4ca8083f71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847429, "uuid": "d32fca71-fa54-4896-b2de-bda725220787", "comment": "Malware payload (Mirai)", "value": "872bc0cf636a7d71b04ee7c298f76eac90cf99f86bc62a51f56d1c3c64ed1b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847429, "uuid": "cbbd82dc-86bd-43af-9714-58291d6e2498", "comment": "Malware payload (Mirai)", "value": "ec00635e8b75c3a81b4f7487c2dcb733b29a59e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847429, "uuid": "3452e720-1690-4bc2-864b-921b744617b9", "comment": "Malware payload (Mirai)", "value": "8dcbbc82501b4ce92ac457d5d9efca94e87d514fbd16610b27a285a7de49b4e4b0a76df3db504d4e8ca41fe4591b83e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847429, "uuid": "8b7531dd-1f93-4dba-8e85-5c0d8c0ab075", "value": "T15BD32A56E7408B17C0D31779BADF42123333AB94A3DB73069528BBF43F8679A4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847429, "uuid": "a4597af7-eb93-4edd-826d-dd789a78617e", "value": "3072:gW+Mc8vqaEEkfnONGaAqtB+ws78LoM/921yZ:gLcqaEEkfnaGaBps78sM/921yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847429, "uuid": "de624787-5e4a-4059-91ba-1102ce4b5ad8", "value": 132091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847429, "uuid": "498d0dcf-09c0-4298-beb4-27a0a78f9f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847429, "uuid": "c57b2aff-d30c-48a6-95b1-96b36c16c2e3", "value": "CRY.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e477264-6279-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780840803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840803, "uuid": "330aaea4-a382-4ce2-b543-0a3f9ea6f2f2", "comment": "Malware payload (RemusStealer)", "value": "a1fa427dd3fa8f44043fdcedd7e36c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "repqst-shop", "colour": "#3C3135", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840803, "uuid": "88a9af4c-c6e1-45ea-8691-f11f62bc8e75", "comment": "Malware payload (RemusStealer)", "value": "874a53f23a3f1010be4a17d7a70db65d40402e6594372a4a762a8b9c7684df0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "repqst-shop", "colour": "#3C3135", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840803, "uuid": "f34e0f09-0839-48ca-bc21-2c5cd0031a10", "comment": "Malware payload (RemusStealer)", "value": "8ba13bd57b2038913e7f241320f635cfd10cf2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "repqst-shop", "colour": "#3C3135", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840803, "uuid": "c924322a-16f9-469b-bfd7-e09e7bdf5b64", "comment": "Malware payload (RemusStealer)", "value": "91694da0642e5622817badc2df71224c84f116c22beca4e9b76c78e6aecdec3f167e2db60de665687a452f478930e418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "repqst-shop", "colour": "#3C3135", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840803, "uuid": "658bc6c6-e706-4c1d-bdc1-53ef0e150b22", "value": "T1A124086BD2A331FCD262C0745266A232B733B93D47289EF74293D3359D219C05F79A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840803, "uuid": "fc40162a-7d74-480a-b4c9-38778f0333a9", "value": "8b41a1754e41495e9695410df2f316c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840803, "uuid": "31cce845-69b6-4e03-8f43-51caca9157a8", "value": "3072:AEvG46zsRMlwQqS8a7/UymQTrMNTfeAd3PxVv2NLTTkTFqXZlzeqxY3iPnAKHJZT:urVwQGajObeaPxVv2NLTIpezY3iFZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840803, "uuid": "0995cdc8-8646-458c-a16f-55fad64019d7", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840803, "uuid": "39b3fa8f-14b6-4df6-918f-2aa8eb6440a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840803, "uuid": "26dd9bf5-ee00-48b7-8353-419709068610", "value": "ckfinder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59faabb-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861189, "uuid": "71a14841-06e9-42dd-8f8a-2b8106cefd8b", "comment": "Malware payload (Gafgyt)", "value": "2ebc85fa43d2acff9263ef9913929007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861189, "uuid": "f42a19ad-d1e6-4abf-b2f5-99a890aef47b", "comment": "Malware payload (Gafgyt)", "value": "877858e9f2c1b79cbec7bfdf7144efe9be8aa148d4b21341f8c6548b0a819484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861189, "uuid": "0b171863-6874-4c3f-a7a5-6a3a9dacaec6", "comment": "Malware payload (Gafgyt)", "value": "88bf05074c0b3561bd1d7996924a4c9da1389f42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861189, "uuid": "85729366-0d21-4292-aed0-5a037eaadfe2", "comment": "Malware payload (Gafgyt)", "value": "4fe06bbdac0bee15663f8856d79fcb5a57f4c7dfb76f61b1ac4609a8d5f8f2aed40f7bbafb2bffa9c2494b6050e612eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861189, "uuid": "65d43363-4c68-4313-9914-9aa0e2fb7800", "value": "T1EDA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861189, "uuid": "0f7ec13b-5a94-467d-ac0e-d1bb685f7aa5", "value": "3072:VSx+i6mqaObhNjnPNKV+qKmZuqQ4DPwXXtse:y6mRObnjnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861189, "uuid": "8be71f76-6f37-44f4-bc29-61c0600441ee", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861189, "uuid": "e5fc92a5-03a7-4a13-af8f-de92a906fc64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861189, "uuid": "fcc414ec-a82c-40c2-8274-559e99fee1c7", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90e1cae-6297-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780853947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853947, "uuid": "d723c5b6-61b4-41eb-a597-b1a974cb5da4", "comment": "Malware payload", "value": "5f1070c5d10b53322aa920b68e02b173", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853947, "uuid": "688df9ea-a46e-47af-9f30-0e387af47578", "comment": "Malware payload", "value": "87d48290bc7e22771784820398c55e4bd0153db4bfd4654c5b5aa482186c972c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853947, "uuid": "ef9716fc-b1f2-47a6-82c7-4c16de786104", "comment": "Malware payload", "value": "570da40deb5c635375eb7b4a692a6a9d575aa481", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853947, "uuid": "fa1bd0cc-f28b-4fcb-8e01-aeb7622ceba5", "comment": "Malware payload", "value": "f3f0693951334c1a4ebd99304dca0ec7b29f77747d0ea7da9e949afaa128aaa2b4e170982de07b5706512b3431b0e6ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853947, "uuid": "0610bd21-2397-4c48-8285-388e41800725", "value": "T10831D4AF1B197E996C01ED69B3752188D074D9DB209FD751FF880C7BA2C81983246B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853947, "uuid": "da9cced7-8873-4c9f-b6c6-21a70e82c64b", "value": "12:5H0rHCoIirIaI6Crr6UHKtkr3UIrUgpA/kWfrBvnyv6r0C+VYdIrd0xbiwriAU2L:J9Ha97OikonyvC+020xXOdCXkUSt8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780853947, "uuid": "7d87f001-25df-401d-906f-348247db0469", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780853947, "uuid": "f83a9362-7253-40d3-be32-da9b3e16c2f8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853947, "uuid": "7229fe10-5600-4d18-9c22-4b924ef3b328", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6283422-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847527, "uuid": "327f5d6d-05bc-410a-8189-17ed94515a1b", "comment": "Malware payload (Mirai)", "value": "78cbb75036b9a9dd9eefee82af285603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847527, "uuid": "a99212e3-2606-45d4-84c8-b04adc606a50", "comment": "Malware payload (Mirai)", "value": "88469382bc6e4f5a227a7c21c3b28d67ac3896663a30bac2b9c9591713ee56f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847527, "uuid": "9f935b1b-3082-4747-a054-766695f62229", "comment": "Malware payload (Mirai)", "value": "db573808aadc23231f9b05c927a849b25da0173f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847527, "uuid": "97809cd8-6522-4190-b7ef-9bed9cb236bd", "comment": "Malware payload (Mirai)", "value": "8cf8b6a3f640a9d550e0d9832cab42ee13317b866fc350225f610e5701c7781741da852a311d84af9c3e37de4ac742c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847527, "uuid": "4c3fe9a1-d0d1-4aba-a8a3-38c49d1ef646", "value": "T1DAF3C71AAB510FBBDCBFCD3702A90A0539CCA55722A43F763674D528F54A50F4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847527, "uuid": "30e5fe1a-98c6-48ba-952d-6d7b9f301e6b", "value": "1536:ycQAW0sBqR3azJWDlVzVxkl0J1shIwkMxrFZ1zs9ZMP90e3PbGhqOtbTgr34r8+n:y1AW0sBqc96vixrFuG90aDGBtbTgv+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847527, "uuid": "9afa6ac8-35d4-479f-842c-97744a78f207", "value": 161144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847527, "uuid": "877a3bb0-bcd8-4aaf-8a6c-d76c76eedbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847527, "uuid": "498064b0-378d-42d2-9457-50327cbb945c", "value": "CRY.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0336d389-6270-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780836865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836865, "uuid": "245be12f-fd16-4c53-be30-6f0e6379579e", "comment": "Malware payload", "value": "35a9046b95020e8f0e245ee01ae56e7f", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836865, "uuid": "4bd531b9-2ad3-4eef-9da8-1f5bf724ebec", "comment": "Malware payload", "value": "88c5bb230ece26b21792c82beff015c8896377acc948b871f3c1eec8c4defdf4", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836865, "uuid": "5ba1a24e-1d85-4cf3-b042-fdc1a371ec56", "comment": "Malware payload", "value": "e6854de0cc15c0f0957e163a80509ff075ee9e58", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836865, "uuid": "d087ba55-550e-404d-942d-4c060348f18d", "comment": "Malware payload", "value": "ab78f2a3843e769b5151cce6cae66877306d159320ab929de70cfc0e6e2e3d28e16cd2fe8e716579b222ba1bb2e965c1", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836865, "uuid": "ff4e60ad-58d8-4129-90a3-7400dbe6b4bb", "value": "T155A4027FA0D32BFCD9BAC278A24721E1FA7B748146344E7BC34491643976A90693DF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836865, "uuid": "400c44f0-ba4c-42df-a0d3-e86f8a54ba60", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836865, "uuid": "9a8991dc-0a5d-4666-8dd8-32dc658c882d", "value": "12288:CHBUmicMEouUS2Dcw7xcUJ/sK88KaU5KahBFrMsyXfsux:5micfFUvcg/6+UwabFrMJ0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836865, "uuid": "11d44b52-238d-40de-8f95-7b0adf0d3b14", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836865, "uuid": "225bfc3a-c06c-4498-904b-8b12a633878d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836865, "uuid": "9ab2c155-e7bd-4048-bdae-33dd6452be6a", "value": "sqlite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd8ab3b-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846013, "uuid": "7228684e-e2bb-488b-8774-9921214758c1", "comment": "Malware payload (Mirai)", "value": "a6d00d2133a50d68997b8148bc509435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846013, "uuid": "d0ee1f2f-594e-4f56-a8f8-447829a5130c", "comment": "Malware payload (Mirai)", "value": "8d85265f5b5116f3a22221bae3a3facb1639f27b66589f0d5fb49c4cf0c74060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846013, "uuid": "d90dadfc-01a3-4cf5-aa2b-f8234cfef2a4", "comment": "Malware payload (Mirai)", "value": "50fc21a263c52e18a943af105a54b4ae67a455b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846013, "uuid": "3038736f-31a9-4bdd-8685-01d69c578ed8", "comment": "Malware payload (Mirai)", "value": "df7a41e682af915e6cee89be091e86fb8ab6a73b0f4803f849114e09d1c1b7c9b0c2d66f8907e1f5c8c69a06415b105b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846013, "uuid": "2904965a-1cc6-4ca1-92f1-267ebeef6b03", "value": "T1C7B34A0273580E47C19349B4263F6BE587BFE4D122F4BA86251F8B5A8675E3B144AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846013, "uuid": "c5b8ab83-4a18-4b99-8825-294fe22ad98f", "value": "1536:SimZwRDArpu/4jPNE4LVta7RVWtIDYbXC7FXUQOlOqkj7Iy9r+qwk2WNNYGh:UwKzf3sWti48GjW7Ia+pfGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846013, "uuid": "92332958-5498-4600-84a7-60c0db54e031", "value": 109416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846013, "uuid": "51d16499-8ff0-427d-bb56-eedcf8b79ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846013, "uuid": "e51f313f-9b26-4514-9c9e-79f46a5c847c", "value": "Mystic.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d044388-62a5-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780859725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859725, "uuid": "c1b9059f-0233-45ad-887d-eec01a241717", "comment": "Malware payload (WannaCry)", "value": "56b4a6610aaa71874f2be6cb09b895d5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859725, "uuid": "dc4d02ae-55e1-4d5b-8f36-30e824085dda", "comment": "Malware payload (WannaCry)", "value": "8e44fa3ff26fa0f208e415e02558488a59d72c5190b729c541b6d2cff896efdd", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859725, "uuid": "29bdd5e1-fbaf-4ef4-bc69-cfbf628788fe", "comment": "Malware payload (WannaCry)", "value": "c20f8ef5cff74c83dba19565742c974a13d43ec9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859725, "uuid": "6d8f53df-401d-4b34-9c48-d8cd49fbf681", "comment": "Malware payload (WannaCry)", "value": "122bc8bea3f6e0033da86ba7010a0e901f34898aed5e416c4a4a1de298c67e54d1ad9229784c4e1f7bcd593d5314745e", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859725, "uuid": "2b5f6735-d345-49ed-a16c-53f05c113951", "value": "T1A73601556658937BC11FA13890F30D2AD5B3BC5A1276527FB77CC60B8F27390AB28B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859725, "uuid": "ebe2c46b-3847-49fb-99eb-b9a8f28e24d3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859725, "uuid": "bb0c3ccc-9d5a-45e6-a433-4f8ed17496d0", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DWe:jbLgWbLgddQhfdmMSirYbcMNgef0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859725, "uuid": "b19ac1ba-6dca-46fb-a5a4-cd7bbf1675ba", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859725, "uuid": "a4c706cc-b5eb-40be-b4f3-a85fcdecf4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859725, "uuid": "a1efb4ca-d159-4caf-afb7-0ef10e237138", "value": "8e44fa3ff26fa0f208e415e02558488a59d72c5190b729c541b6d2cff896efdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d654e6-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "1c446574-12f3-4482-ad6f-16f83b509ea7", "comment": "Malware payload", "value": "caa5d887927489d751995360dcb0f863", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "bea98dad-7a49-48c6-822e-bbf13cf04c60", "comment": "Malware payload", "value": "8eb3b9dd9e56601c17a434844d8baf261db994ec6398777edd99e411b051022b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "a07dfca4-3d91-4047-b68e-79ca3a7e9665", "comment": "Malware payload", "value": "4864a13b2157f5a39419012c9832d7db12dcc68e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "3e58344d-66ed-4ef5-9943-d99191a0fca3", "comment": "Malware payload", "value": "d82ca125ece60b3710c3f1c01f321634794398e29ca9f4a2576f742ec51f96958e75aa2c48c6ad84f95abb24398b0464", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859072, "uuid": "5c100134-c7ff-4254-ba9c-2e3b76c98b59", "value": "T1EE6608136B28FB0EC229313449B1DA9467A91C8506D79917B395F31DF9F20BC99AECF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859072, "uuid": "5807fe9f-8429-4d29-8c09-9c4f293b95c6", "value": "49152:ZWlr9OrSwu4eO+s9X37Z17qRyLnS593gHrrBcqrlxGEp4ex7AW1HHEt5Ep:MU7IqJcqPp4S7J1nEjEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859072, "uuid": "ccc8e3dd-3022-4374-9703-f325eb69825e", "value": 6619351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859072, "uuid": "5cc22895-b092-45b2-8878-a8c0e2fc3959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859072, "uuid": "79900da2-aafe-4969-969c-bfb936cdae0e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd8bc3a-6237-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780812563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780812563, "uuid": "d79c326e-be52-4004-b053-c0336784f8fb", "comment": "Malware payload (RustyStealer)", "value": "181d5c25e1c6df48cbd0ed217208563f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780812563, "uuid": "9382912d-efe8-4d6b-bccb-558f26360654", "comment": "Malware payload (RustyStealer)", "value": "8faba0a21cbb9ea8ed16135b9e7ca7cef938252cc7cc8d786f8fa9c126f69c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780812563, "uuid": "3ea9affb-b263-4863-82dc-cecf4cc18aaf", "comment": "Malware payload (RustyStealer)", "value": "1d2e278553dda0b47eac0f54b77d32b1d42dcac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780812563, "uuid": "b1dc1214-cb00-4a1f-bd6f-56c6932c8e57", "comment": "Malware payload (RustyStealer)", "value": "b5536f83fb5a1b5dbb1b1e3a1da94bea6d5bce20cec94db157377bd9018ce06f1f5e77959b2c9b3542e7a563d30c6361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780812563, "uuid": "cd15353b-cafc-4e34-8588-2eb2a70a6a1c", "value": "T1DB444C15B6559CECD45AC079834A49736A3274CA0B32FAFF12D542393E6BAE16F3CB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780812563, "uuid": "916d7637-602e-4867-a36d-42a7435dc9b6", "value": "c6ed946ab30d1287f715fcd9c6da21dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780812563, "uuid": "1b16a20b-8a78-4432-88a3-2968043b711b", "value": "6144:jJ4PJpBlMzHL5uagjJrbOctIJaISIMMtRNh:dRzrwaAlXIMMrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780812563, "uuid": "b632e4f4-baeb-414c-847c-fa480bb644fa", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780812563, "uuid": "fc88e529-9d59-4e24-be03-8a1d16c2ebcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780812563, "uuid": "3e41cc05-e742-4ca7-8bec-57b4cf54355e", "value": "8faba0a21cbb9ea8ed16135b9e7ca7cef938252cc7cc8d786f8fa9c126f69c0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f5bc4b-62ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780863393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863393, "uuid": "92f8adf0-d852-402e-9348-1b20a0b80f44", "comment": "Malware payload", "value": "2ba886b285a029268eae5a19b8b93766", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863393, "uuid": "af0dd337-8932-441e-b28c-7a43c10e7a06", "comment": "Malware payload", "value": "915057e08248c7e92ccd2f693f10386f3b422f8e6729b63e5db987172cc42296", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863393, "uuid": "a89ee4dd-de06-4811-b410-b9d77e31d220", "comment": "Malware payload", "value": "57b53681666bc9b3dfc0244c91a06ee876965476", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780863393, "uuid": "2bce2ee9-87de-48d0-94f4-407b51443ef1", "comment": "Malware payload", "value": "ecd691fc8ec0b5e71a2f592f36997043867229e46acfee6934323fba0fb479abf09fb01ec3b574c250f90821ee3dc845", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780863393, "uuid": "8fe2ff77-b0b2-4650-a58a-73993f862105", "value": "T1D001CECBC0159B6081C6E4AD66979148B420C3CF3A5A9FB5FFAC543D8BF5A18705AF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780863393, "uuid": "679dd4c1-11fa-46f1-adba-8cea9efcfb07", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkagIhexfYFIQ7jl1I2g/IB46YIjdkIX:kXCKysE2hi0ziQvZohagWF/n8k84dvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780863393, "uuid": "312d8056-f8cc-4094-9d69-f3e13b45cad9", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780863393, "uuid": "2c81adf3-a308-4f96-bb7b-e2c115d2f4d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780863393, "uuid": "ca8d154a-03c2-4de7-babd-946ea5655d8e", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d1b502-62af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780864064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864064, "uuid": "c08f98ea-963b-41b1-8974-c3c4c1cce64d", "comment": "Malware payload", "value": "27c4055af41998fe56b24d4689da0e48", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864064, "uuid": "fcdb246c-1713-4c2f-9bf6-ab12e013f789", "comment": "Malware payload", "value": "9259e263c46edcadaca2671b1d049dc2039bedad9a8b791996294cc363edbe28", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864064, "uuid": "3267813e-b066-4b16-a507-0138ed3aed45", "comment": "Malware payload", "value": "8319af7ee80a527da7098d3a18a21f3ccf76a21f", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864064, "uuid": "6fac63d4-2064-4be4-8aef-bd7192349cda", "comment": "Malware payload", "value": "d1d270c2c6adb6c722c44fcf12ad73d6a6d15c4dc28b85227e9fb3032bb4c72c20dc44cec11b48d4e65b17e2a7a1ec5c", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864064, "uuid": "5302e8fd-6451-4cc4-8504-8c1a63ea5e73", "value": "T1E074F19B72B934FCD6B78639C4550909A3B2F8320B619BEF03A546161F376E15D3AF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864064, "uuid": "64c092a6-faf1-49c0-bd55-925d4fb977a3", "value": "c73309c7ba4eb4f635fff91fb63e6e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864064, "uuid": "7c7e93fb-0434-49ae-9233-f9894f823fbe", "value": "6144:CrtPYijoYFvmVooy/ok9sJoV5eVEvuEuCIUOzI8:Cr+ijodbyQkL5IEjWzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780864064, "uuid": "27b0e764-726d-4468-a421-23182a50e0e7", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780864064, "uuid": "9a5a3501-bd33-43c7-973a-bdbd4eebf34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864064, "uuid": "00184819-c155-4e9c-9135-e5eefd796c84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3205c0cf-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845963, "uuid": "039754c5-cddb-426b-b584-b3ae2efd0527", "comment": "Malware payload (Mirai)", "value": "c9e993a41139b6443e1e35d448ed34bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845963, "uuid": "b17f79e9-0cdc-415d-8314-960e8656c0d5", "comment": "Malware payload (Mirai)", "value": "928d583c95f6bcbb282c0ab3040068cce5909d957685e64b549ba02e8c162355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845963, "uuid": "d4f91b55-123c-4a18-860b-e698281defde", "comment": "Malware payload (Mirai)", "value": "563d1c298b280535e5e12ee41ae5bedbf07ea485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845963, "uuid": "92abc2cc-dc66-434b-8e13-04628f6a3f09", "comment": "Malware payload (Mirai)", "value": "f25c9463329e969fd2e73f490c8ae68c4b034ec6c2b5c73647d68124d13d2d5db4f84ca740b0d1fd51e86756b1dad055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845963, "uuid": "d6a20b83-25ef-40d1-9b8c-fc2952aa28a2", "value": "T18E357D2AF2B3B0BCD017C03053AFDBA2A835F47912216D7B35C496352D66DA01B69F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845963, "uuid": "563567be-856f-4d2e-8983-5a4c8b1a4c4b", "value": "12288:r39v0uT0xHYTnCFVzuQrZW59EnMt8FPtH0myI/pUxi5k:r310uT0x4nCFVqQrqCMt83dpUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845963, "uuid": "e9501ecb-486b-4918-b887-f94f43b407d8", "value": 1070064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845963, "uuid": "75d3f653-6785-4078-9edd-21b13843b826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845963, "uuid": "36899628-7837-4cd3-b80c-1590f93ffea3", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e42de63-6233-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780810818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810818, "uuid": "a4abebbe-4690-4e9c-971d-7081d983dce0", "comment": "Malware payload (Vidar)", "value": "d16a82d5b7ad99d408ec44c72abb61ee", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810818, "uuid": "50627f0c-83ea-4e5d-837c-c5fe8e4eeea6", "comment": "Malware payload (Vidar)", "value": "9336ba3a31182993c6f5fa3431011694c72a466ffa1880221dfa822622268092", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810818, "uuid": "edb6d640-e96f-4b40-82f5-6e756b6aa200", "comment": "Malware payload (Vidar)", "value": "fcecd9c6ced03ab584ce9929c7396f2ab0f65209", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810818, "uuid": "7740a249-efc2-4333-88f5-35317c585551", "comment": "Malware payload (Vidar)", "value": "65c9bb7f3f07c1f1d5fc980757d691d08f694d025c63d89c6a5bbd3b707d4c9636878674aa425c7b740056688e303735", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810818, "uuid": "d0d2037f-515e-4e02-8974-3f10485954a3", "value": "T10F85390BBCA549FAC4AA9231897661927B71BC490F3123C73E90B37D2F726E0AD75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810818, "uuid": "ba5d141b-d1fa-4083-9ecb-049eb6eb26aa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810818, "uuid": "b2cc45a5-a0ea-4dde-a2e0-1724c56e4774", "value": "24576:uX+qs7wQRqc8bpSFBZ9PJS+qSXzlBeleX7KDg7e4:uX+X7NqcnFhPJVxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780810818, "uuid": "6cb0f43c-b2aa-4ddf-aeb2-03f7898a9f4d", "value": 1739264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780810818, "uuid": "11411f83-b846-4240-a674-ac0a38f768a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810818, "uuid": "c411cd11-3c9f-4132-b0f0-0f7dcd1875b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3933f09-6218-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780799365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780799365, "uuid": "943b731a-7347-4824-8e62-e52e5556dc96", "comment": "Malware payload (Mirai)", "value": "9d4b7dcb20974f578d344d8eb74bb8de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780799365, "uuid": "df9a3fa9-b392-43b3-b19b-0c1bc36f9cdb", "comment": "Malware payload (Mirai)", "value": "94973c53b95339304f86c7c193f5c970b39740831fcf8c0b7ebb7f0ffa2c57ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780799365, "uuid": "9b67782b-e080-4271-9287-68a22aa451e9", "comment": "Malware payload (Mirai)", "value": "85f9131dd26f01abb4126e5a8b5f43d3665a75af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780799365, "uuid": "98c0454c-ab69-4226-a425-54d5d279d21c", "comment": "Malware payload (Mirai)", "value": "86780c08637f94589b709d528736a965e2a46686556758feb25b121c90d5d85d36b93c49e05bb395c9dbe7c3cb6cc90c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780799365, "uuid": "cf929ae9-a08e-4203-b6ca-cc9e7fff8884", "value": "T191B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780799365, "uuid": "31633980-d800-4e07-8a54-da26f43ca2fa", "value": "1536:UdNSXAeuUGWWKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzy8rSl:U3SrlGWWKTU83AQB5A5Liy36fmUSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780799365, "uuid": "881e919f-6b3a-4915-8a4c-77417e1a018e", "value": 115236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780799365, "uuid": "1a719362-f340-4fe8-b87e-299a7c99d8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780799365, "uuid": "8c281438-b679-4abd-996b-6d4b886b8d9b", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431ff043-6205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780791016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780791016, "uuid": "1cf8a693-2c94-4753-9743-9d5fc68c1dc6", "comment": "Malware payload", "value": "340e9b9b1023f9f57083fef1adf3d92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780791016, "uuid": "9fd6bfe3-17f2-4246-9372-1e3287df31a8", "comment": "Malware payload", "value": "95587eb00180fcd0c62ee65e7153d7e402886034e461c84463ca27c130973c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780791016, "uuid": "2f96dbbb-d6b0-428e-ad76-389bdc3b4412", "comment": "Malware payload", "value": "0136c0d5447bf9a8df8f50f212477ec4c3423b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780791016, "uuid": "92b7d7a6-8915-48bb-864d-e8f004efa650", "comment": "Malware payload", "value": "1a1c54d9a43f76a31d9ac123ba6f086b8353c1cfcf42b374050145dbaea79bd12398408dcd2e60e60c435742d4a8d9d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780791016, "uuid": "540aba73-231c-40c6-8172-e594a48be629", "value": "T14D08334A06AB52DFC15EB8F856121F22E944FEBD3AB01046FB7F44157CC82FA20996D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780791016, "uuid": "04aeef55-fede-4189-88ec-9296ef10c5da", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780791016, "uuid": "f457fb6a-25b3-42d2-9f6c-a59b661352d5", "value": "1572864:jt9IKPHTJpRWYOR6ttcpCA21INJGnm2aTEohgwoIs87:jUK/1pRWBIttcy8UGTHEIs87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780791016, "uuid": "d66cf788-11cc-41fe-92d2-f19daf0b593c", "value": 77176395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780791016, "uuid": "294236d1-dff6-406f-8ac4-3f1d7cd72e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780791016, "uuid": "e5c6fd78-2afb-4c09-8dd1-88f0a37b4ad8", "value": "Setup_3_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096837b1-6242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780817119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817119, "uuid": "0ae209c3-9ce2-42e5-8242-ddf64cc179d7", "comment": "Malware payload (Mirai)", "value": "994f6319e47c61fc6a424e5f2b279f96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817119, "uuid": "7f51ecbc-9141-4384-b648-8e7da502f151", "comment": "Malware payload (Mirai)", "value": "9614cfa0585331ba0445d4141bffc838871b26a85deffcab28bfc7f647025115", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817119, "uuid": "4b4ba84a-b5fe-42e7-b637-7517e5102155", "comment": "Malware payload (Mirai)", "value": "8e6d1224c05bba9fa863ab2312a60781f1c5c4f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817119, "uuid": "fd29961b-0ce7-4ff7-b2be-bd7cadbfb55e", "comment": "Malware payload (Mirai)", "value": "2e53896477e0e4d490913f70d19ce9ba982fa36291e0ae710685edd200cd007c3af8e85fa31a273e41ad6e047f317eba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817119, "uuid": "8985bf84-112f-4f42-bdcf-eaf2d84fbd4f", "value": "T116C08CCC8020022304A198492F2E5C16E094C1F8B18A0D6AD65C9031C0C60B07E5274A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817119, "uuid": "c4bacb79-b9a5-42c4-bad7-49071a778ce8", "value": "3:L6F+ZNFdRgLChKyIyINKZLRgLChKyIyINaOSRILlW:L6FeNFdbKyXYiLbKyXYanIBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817119, "uuid": "d6ca6035-6ffd-414c-b988-6c1ad189225b", "value": 147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817119, "uuid": "b9d8becf-c52a-47f5-adb2-66369b52fd2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817119, "uuid": "a9f61e1e-7586-47c5-86ba-05603d876616", "value": "r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6ad242-62b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780864875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864875, "uuid": "4c888412-e7ee-497e-9139-12f0c3f5e2ae", "comment": "Malware payload (Mirai)", "value": "81288c5dd10e221f4244770162e750c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864875, "uuid": "af72da4e-cee4-4f82-a522-d75ac2823e3f", "comment": "Malware payload (Mirai)", "value": "96269288ff14c9434139ede85935306da2e20a29d2ff4f575e76f1e28617df69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864875, "uuid": "da343922-6be9-4ae8-8ab4-759e973756f9", "comment": "Malware payload (Mirai)", "value": "380f10e44bb40fdf010ebce78fd574f74ec2306e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780864875, "uuid": "32bbb93d-77a4-41a2-9f3e-42fa8e8afabf", "comment": "Malware payload (Mirai)", "value": "fcb290276cc95dc753b4ac7812b7a2e0d7f919965d4936f50e264c64925dae97c8f96166fe5d5d81fb5a4ded1dd3f2a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864875, "uuid": "2209aaff-667a-4d89-869e-30e74bff1731", "value": "T150B34CE2B400DD7EF817D7B780530B16B234A3E54F922B277617F923DA790742866E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864875, "uuid": "dda74517-42bc-46c3-92c4-73293b0e7c01", "value": "1536:gyQxkgff2OqKhTGS47vhaQxKIF8/ncI8fUwTTJSjH+dtoDEqlNLoxg1:g3xkg3yWd+ZLxKIhBUwTQbDEqHL6g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780864875, "uuid": "b8ed537b-ce09-42a0-8a6f-e8512f37a4a7", "value": 109380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780864875, "uuid": "4a049599-21f5-4414-8c3d-c320200be772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780864875, "uuid": "8b93a8cd-42e6-4a36-b8e7-24bee3045cce", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deda518-62c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780872961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780872961, "uuid": "30719757-e62e-4bc0-a181-7a5b0e9f68e0", "comment": "Malware payload", "value": "b95e6924ad99283c493d1844886942a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780872961, "uuid": "10c90457-0168-43d2-9ccc-bf469efd4849", "comment": "Malware payload", "value": "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780872961, "uuid": "c76c8412-3bde-41f6-86e4-cd2f7b199949", "comment": "Malware payload", "value": "3d8383a70298b920c6378b6f1d14524130c241cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780872961, "uuid": "f1974e2c-391d-4f19-9a2f-728539f3830c", "comment": "Malware payload", "value": "12d7dd2df14de8b7d6e7314fa4fac78b8892dcd9abd1ec146c0750b93e41fe515e9a73984996d087e96dfe8e5621d8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780872961, "uuid": "590aa637-0078-4539-b9b4-a2afa77b2c14", "value": "T1CBE57C076CD21EE5E4E9B3328CB62292BB74B8190B3153C72E9273796E727D16C39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780872961, "uuid": "0f69e7cc-58de-4599-b12d-bf1af592bf9a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780872961, "uuid": "b9177816-e2f9-44e6-8a94-baf92c904d01", "value": "49152:/ZLg3XDW7zDWJ/M8daVpS1xLto2jROcGF4:/mDWjBVpIoUROpF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780872961, "uuid": "4db864c2-9903-467f-af29-fd8b44187bc4", "value": 3104432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780872961, "uuid": "858defdf-cd70-4193-9f7c-c57153e635f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780872961, "uuid": "e5029375-eb4b-4415-be59-1328970c99de", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e57791-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817118, "uuid": "9ed55d35-5197-4666-96e0-6ab74366cba8", "comment": "Malware payload", "value": "26237c2d968a306ffcce11ecb95a9ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817118, "uuid": "de104b4c-7af3-4584-b1f4-be7f8abf07d1", "comment": "Malware payload", "value": "972fa550a999ac56352cda0deb91fd26707ce04955e67cb908491eb7a909e2e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817118, "uuid": "a4e2c668-1f39-4baf-b470-bc973cf40c84", "comment": "Malware payload", "value": "058f72e179af644cbd95fa3f1552fbd3d00907e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817118, "uuid": "ae91643a-9592-46fe-a0eb-4dfa40709890", "comment": "Malware payload", "value": "c089a1315b234c3ba051070e8f6dd6f67b6a00928e37ef7fba22b884e9616f1eb3da41daab605a90c000757fb000d1bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817118, "uuid": "686608c2-e54c-4d35-ab46-79defb1f786d", "value": "T1F0059D46FB19AE57C5A6027E88A783042325DD853B478F476B2DF27CAC77338EE06605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817118, "uuid": "ec51ea1b-f73b-460a-acdc-92e9665f54d3", "value": "12288:ugmZcBiwO9EdyXvpBJlPHp3hrta+3MopbAyeEyL4AxYj4:o9BrKyeEyMAxYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817118, "uuid": "d5833b2c-87f5-4d41-b92d-df1d7cb8691c", "value": 839528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817118, "uuid": "e2ec8953-aa3a-417b-a332-a80c4dcbb0c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817118, "uuid": "98420841-deda-4a44-8e99-0e758e169cd3", "value": "bot_arm_static", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4620a634-62a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780861459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861459, "uuid": "f89ae9b8-4607-4198-8cb6-e9b77f10ff4e", "comment": "Malware payload", "value": "4ddb7f94fdf673476a6aaa10bc943056", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861459, "uuid": "38a92ae6-7978-435b-a397-514e00a40a7f", "comment": "Malware payload", "value": "9792830899edfefaf89863b842980c1814370f4809491e69186955e9d480cc24", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861459, "uuid": "33607d85-60e1-4a08-a70e-69bf33da48f1", "comment": "Malware payload", "value": "794f5a5b898921591afef1fb4ce554f3c3dd4520", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861459, "uuid": "2f27c6e9-0764-4f75-8335-799fa547fe6e", "comment": "Malware payload", "value": "0bd1da916999d80a5d278f1def73f8b99184bbd82b5226a23124c50ae5e78388279650beecede89dd2eaaa4642e1167c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861459, "uuid": "8a493b29-0322-49be-9959-7319d9b35190", "value": "T1EF01C2CEC001D7604086D45D62A762D07411C7DB25C64FA8BF9C483D9FBD758B026F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861459, "uuid": "f4e12f1e-6e24-4c9f-99a2-4c3bea6a6946", "value": "24:kXCKysE2hi0ziQvZoha0knRjPYa1E89SBu7:e9Qp+Ms0ub1E89SBu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861459, "uuid": "897880a2-73ee-492b-909f-df96ce8daa0e", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861459, "uuid": "d93418f7-4be3-4345-a744-c24b03831046", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861459, "uuid": "422413be-2019-4a30-8f96-3ee77a21a359", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376fd59d-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845972, "uuid": "23c98995-671a-4bd3-9996-1199c8aaa0b0", "comment": "Malware payload (Mirai)", "value": "cf75a70e9dde4c1bbda57f67da7187aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845972, "uuid": "ceaf0827-3209-4830-8894-cf854337b138", "comment": "Malware payload (Mirai)", "value": "990c0aa464c157f8b6d0e82a0fc8d24d565ecdd66a661886569a4b95e4a24f13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845972, "uuid": "990aa2e2-0722-4581-a186-24ebc8b863b4", "comment": "Malware payload (Mirai)", "value": "b820cbf2fd8da47da0df3024ca884c8b2cccf883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845972, "uuid": "c9259cbd-67fa-4500-82cc-5b52e7194af9", "comment": "Malware payload (Mirai)", "value": "037bcb704a431b8c349243e1fd90e21cc24cd02e3bc04b1e00440a8a32f3084d3b0a3a80b7d2d9a6ddaec103094ef717", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845972, "uuid": "e5eb571c-8e7f-43dc-81da-5ed75c1e4b18", "value": "T1C1D3AEEFF74724A1C46202F407CB4FED6E2722D26E4B85DB6D6B257B1D390CA4802B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845972, "uuid": "90487776-e5fa-4dd7-be08-ce39ea7b2eef", "value": "1536:mbzAypucoh2llEWtipK/SDt9SytankGT74/iDjjWAo5D5xJ6D5gTq/LW3:4zAypucZEpdDt93tNEc/wjHo505gTqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845972, "uuid": "627feac1-c935-4cf9-9998-d7d3e89dd1a8", "value": 140568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845972, "uuid": "724c74ef-8289-4df8-886f-d007b3d28c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845972, "uuid": "7ef8269a-46c5-4c08-9ecd-14acdf9eed90", "value": "Mystic.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2d4458-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858950, "uuid": "65d7530e-3fdf-4d72-b948-457f219934e9", "comment": "Malware payload (Mirai)", "value": "7d70a30ee8e6776c0f766d1952d25a4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858950, "uuid": "74e28904-459a-448d-8a79-ec19793caa17", "comment": "Malware payload (Mirai)", "value": "99d70815a77d1f49cedc9f04cc50e29a8d6f93a7a49ddc317f95ad184aa02c1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858950, "uuid": "80e40b4b-0b46-4379-b88e-a296e0fc4657", "comment": "Malware payload (Mirai)", "value": "d5f2fd41cf0e30c84fa7bb6727946b20c02662a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858950, "uuid": "6eb40c2e-003c-434c-a331-2f816101067c", "comment": "Malware payload (Mirai)", "value": "273e30db7a25afc4037fe2157930f8418a7143ef5d60b3ce447fa206e2356bca83f763108d451d7f8f6992e2a350a40f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858950, "uuid": "c37cab05-58b4-4311-af36-47681c7efab3", "value": "T11F330124542437F0E6B4133EA6AE270156C70EA89BB3A8E31F8853DDF494466F17DD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858950, "uuid": "a0c746cc-4367-4230-a937-287e8d8ebc09", "value": "768:btXJhRJjZngo0kXjsCG2/jHSDsa2JxH50+AOTTKWEoKGOJ7wqYYYK3s3UozA:NThgoGSjyIf0+HTTKBXG0gYYBzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858950, "uuid": "4ab5446a-4d2e-4b96-bb14-e1ffcd849350", "value": 50960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858950, "uuid": "c7fc0ed7-b927-4161-a607-30ae2b5b44c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858950, "uuid": "f0cd2206-8c90-4efe-995c-8e07c35c0b6b", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3405d8f1-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845966, "uuid": "ae65d7d8-d100-4adc-b7e6-708bdb6e3a37", "comment": "Malware payload (Mirai)", "value": "4238cb8c7b685c7c2c38924847cd9646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845966, "uuid": "1796a170-56cc-472d-9c3e-98fea1dcb4ee", "comment": "Malware payload (Mirai)", "value": "9a5f99bf51b07199dbac5b5bb0dde0e8193e98168eb4b095f31126814aab54aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845966, "uuid": "f19efe2f-bf53-4ab9-b29c-b9179968f24e", "comment": "Malware payload (Mirai)", "value": "07ddbbe856520ce4c4a914d5b1192911835d1e9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845966, "uuid": "11d63771-5800-46ae-bb91-162b33d1ddcf", "comment": "Malware payload (Mirai)", "value": "bd985b408b7a8fcab071f6ebc21ba2b811f36b5453b718d049aa58317090d0cda97c75ac825f4a06c89ef481775c36ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845966, "uuid": "3f9bcd59-e17e-41c5-9d49-2405b32b27ee", "value": "T18C13F138D016B270C3764531FD358943AA86E7F546C8BA3509483F99B16ACC08E76CEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845966, "uuid": "312c30cf-afee-4341-8a01-3416ea2785d0", "value": "768:xgOzWFZF5DR8VZGRRW/82L+PKM0fVY3PhiO25Efc7WXTGviQspGnWsrs3UozZJ:EzGGErH1f+3Ph+5EfcaXKaQspAWzZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845966, "uuid": "38f9a18e-aca5-45b6-aca1-8d4994191295", "value": 44908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845966, "uuid": "56273827-0ac5-4ed3-a04e-2a302b599885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845966, "uuid": "01406c5b-1af1-4b39-a8ae-fc228a5a636c", "value": "Mystic.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14689cb-624a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780820890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820890, "uuid": "f3e083fc-a4b9-46bb-b133-82bb4ad4ea78", "comment": "Malware payload", "value": "2cb61c1bead428e9500cd0eb42c017d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820890, "uuid": "34e5d1b8-fa5c-4a2c-a124-808bda9a46de", "comment": "Malware payload", "value": "9b150f62851884b2c34e8773ecdefb2e3db2826e51338cbf36a51c8154ac471d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820890, "uuid": "e55ff6af-c502-4a71-8437-b01060079910", "comment": "Malware payload", "value": "49a363b89cbb259101fe137bb5e9a7cf8eab3045", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820890, "uuid": "7f459575-decd-4f67-bbb1-a8f2f5cdbb95", "comment": "Malware payload", "value": "25e84f558c1133b02140f35522bab619a86aac507417bafa850f83dfb8b8256de17575e7f3256f11592e1ad8855c4c18", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820890, "uuid": "585813c6-215d-4a49-bfae-c1c158119dce", "value": "T101137D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820890, "uuid": "5704784d-2251-40e0-a033-dd94bd9b9600", "value": "768:qXRWNGxVz9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Wlx6co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780820890, "uuid": "cf8a967b-6f5c-47c5-a098-186cfef40526", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780820890, "uuid": "950b34c1-7997-44e8-bc50-998ba7728820", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820890, "uuid": "309dec0e-a0ad-4b41-87b7-944592783340", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e132a6-6279-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780840727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840727, "uuid": "172a6df3-0a36-480c-95e5-5ed67240420a", "comment": "Malware payload (ACRStealer)", "value": "68bb72637d7452469cd420865ff5d2cd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840727, "uuid": "9284187c-3106-472b-9333-31a532dfcaa9", "comment": "Malware payload (ACRStealer)", "value": "9b8840810b7fc6fa43be9eb2812cd12e49d68f0be9b509330df826edaa3253c3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840727, "uuid": "9b89c51c-8ff4-4362-aeb7-94b1ed79c798", "comment": "Malware payload (ACRStealer)", "value": "2e6994e784b05b1bd5444c1c6b898b5694112ed1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840727, "uuid": "80b5f50f-9025-4da9-8e77-da41e20e616e", "comment": "Malware payload (ACRStealer)", "value": "f0a0d17e4307da93ed0cded6b51dbdd8305dcbd4e8f865d19b05b90225d010a2dd7c043547787b9ac0319356c742ec98", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gro-runtimeforge-cc", "colour": "#7AF887", "exportable": true, "hide_tag": false }, { "name": "muaklekcoop-com", "colour": "#8E55A9", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840727, "uuid": "631b7cc1-2291-4b46-a75d-3ff6f7276969", "value": "T1EE45698F9089D591E88C317DD1316A1A872FECC935E056BF361B3CE06EF8891351BE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840727, "uuid": "19a8b6dc-f6e7-4d88-8b64-8e387bf73c18", "value": "24576:/ISPNoVK31hRLXoFQq4SHjUag/5ZUBut0hDbp69ILk:9oQL1YF/Du3cZZSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840727, "uuid": "169483f2-7d50-4e2a-be79-ca8c4df2495b", "value": 1185360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840727, "uuid": "3cc9418e-a4d5-4ccf-8202-9bd7fee30dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840727, "uuid": "c56665c7-6f53-4e53-baa2-36500291cf4f", "value": "notes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa0b7b8-6276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780839731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839731, "uuid": "9570363b-1549-400e-86a8-8d2a63cba36e", "comment": "Malware payload", "value": "dffea191bae8308c18c6627f70402a82", "object_relation": "md5", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839731, "uuid": "83836c98-1ded-43d0-8e56-8f2ab791fb18", "comment": "Malware payload", "value": "9f62ca02f43d2249a43fcff8b446b24689f1b03e0fdadc3482b95f775493dfb1", "object_relation": "sha256", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839731, "uuid": "e600233d-4a46-477d-990d-d73655d6d3b7", "comment": "Malware payload", "value": "93d44b16e47ff8f55189e2b38d53141f1e3973d4", "object_relation": "sha1", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839731, "uuid": "d7451433-11e3-4561-9b93-04e6a806c062", "comment": "Malware payload", "value": "0fd6535715a68c42ab98f892c7d959a7932884bf7f126e808ce5637192c54165d226e7cd06cc10a0823f8414156d1e81", "object_relation": "sha3-384", "Tag": [ { "name": "abergka-com", "colour": "#A01692", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839731, "uuid": "8ecbc9f9-5eca-4feb-abdb-a91ed30ee276", "value": "T17604236CF884FEE28BDB4564C6D0792B860A531D828D643BF01337F49DEF6581D0EA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839731, "uuid": "63787971-5cab-4e2f-95ad-69e0e33b8181", "value": "3072:swwlFsnlX8ZxshJWMYjDJykLD3LGcFdp8ljMo/l5kt0+QsP0trKgAWD7Goc5/P1g:3WF2aZWhQLVyk37GcfmljMo2y+jWlIZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780839731, "uuid": "8f406c4a-67a1-4c43-a754-f704beb97e6e", "value": 182403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780839731, "uuid": "41d1abf4-d126-4ff4-9289-97a75ad94bef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839731, "uuid": "65c34801-cd32-456f-9cfd-8806dd3796d8", "value": "steinberg-cubase-pro-crack.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb60312-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858919, "uuid": "efa60fdc-2bb3-40c5-9edb-9d2a31ae2ea7", "comment": "Malware payload (Mirai)", "value": "515f257b3686d7e42a7acd3b6dc2ec00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858919, "uuid": "64d5e4e1-f49b-4fef-a47e-f59474f4b675", "comment": "Malware payload (Mirai)", "value": "a4243003d161dd8fd18ceda406aa86693a89cb8db1da4f0955dba0d7d128951e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858919, "uuid": "fb582028-866a-4ec3-a5d5-ac4e383f9541", "comment": "Malware payload (Mirai)", "value": "68c1ac636ef7f7730e9798acfcc248d8c953d227", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858919, "uuid": "29a7ac40-6580-4023-9257-8822ced05566", "comment": "Malware payload (Mirai)", "value": "b1508c8e2c3e640b69a41929eed61894571323673cd3638a82473f8a5949a12795e33e700b3b3273191bba4911a706fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858919, "uuid": "60dbd0b3-7f89-47a4-a3e8-246c995dabe0", "value": "T1C5330220DE327A7081A2753CB97C4BB7BD97873851FBF024E8C506B072EA62B55F6542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858919, "uuid": "42384378-8319-483c-b07c-6f9c643a957f", "value": "768:kfAeo4bZ5Oc1MsIWL38z2xwIPJtl+Irx4HaqVZ9NjjnkNxvllGwhcas3Uoz2:kgYvOwU2NPJfl466djn01h+z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858919, "uuid": "34827e1d-d38c-4a1e-ad42-b7de2fe4a08a", "value": 52424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858919, "uuid": "4dfb7295-a303-492e-8b8c-4371f8edace0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858919, "uuid": "44b138f2-5f53-496b-b57b-7aedf07af873", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65920e77-6233-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780810831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810831, "uuid": "a8c588ad-40c1-4a01-a4f9-d078626ead12", "comment": "Malware payload", "value": "a509d49199e60f72421ba3395b0f9f26", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810831, "uuid": "0fff5263-f48e-45af-b5f3-5c5d5255dc52", "comment": "Malware payload", "value": "a4981b695894c0e7bae12cd1dd8c9546169491bf4f98c76e6bab844e321fa739", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810831, "uuid": "2e416e96-5170-4b22-9d42-a84d3db3dc29", "comment": "Malware payload", "value": "eca64664d80eba22bb9460719bb117f0bfe54ae8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780810831, "uuid": "e2e9d9d7-1382-46e0-9a59-6f8b29379a31", "comment": "Malware payload", "value": "b4edf82930a79192a97ecae0a2198ff684ba613095d338ee5e0dd7ba293d13ca8c5e9e284d8a55e7c00d725283e4bf11", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810831, "uuid": "eba3001b-b165-4fdc-9e1d-d45b957273ab", "value": "T1EEC6013BB25B653EE02A5B363A72A110543B6E6165124C56DEF4F88CCF3E0711E3E687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810831, "uuid": "f75bba65-583d-4cc9-b4f6-0f593c383b07", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810831, "uuid": "1e7dc664-a762-4287-b833-cfab45d361c3", "value": "98304:15/FUBg5SApRbuTroH4QS2+ThfGw11l1GxGbtgf:niBMSWFMroH412U11uxGxgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780810831, "uuid": "1c23983e-6e75-465f-b302-8c9c49f8a805", "value": 11671075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780810831, "uuid": "f55a2b62-659c-41eb-9278-95cec9b09c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780810831, "uuid": "c4a0e46c-c4a4-47d9-bfba-72bbd107d375", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a668a940-6217-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780798914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798914, "uuid": "68a54557-9c04-4790-8c0e-510560ada37a", "comment": "Malware payload (Mirai)", "value": "1fd8ac43aa7a854654be04704526a9bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798914, "uuid": "4b5ffaf6-c70d-4ef6-a80b-2ba61a644298", "comment": "Malware payload (Mirai)", "value": "a74ed52bfc601213d1bd620552b0c67a8675e50923ff8d238bcd340c952943fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798914, "uuid": "cf089241-bf0e-48e1-918a-7424081f751c", "comment": "Malware payload (Mirai)", "value": "6579421cd54b21a11b7427cdbcdbe1785695935a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780798914, "uuid": "9787c4f3-3487-4c38-997d-d80478f18e09", "comment": "Malware payload (Mirai)", "value": "1a6288b8688e26adb0871ccda5ed521acccaf76f777b862c0e7da72fffa81288d624e8993a795d242a045bb000379e74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780798914, "uuid": "52fd7421-8dd7-4c36-b01d-0c958380274b", "value": "T1BC6302D93243079DF3E53E7156FD2AF61376B06CA8171E6B6B50B36C5BA2421CCA8D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780798914, "uuid": "c64d0dc1-a52c-4be8-85c2-c5927cd3c490", "value": "1536:uleam8QD3ZfonQ/9EvDe5AVY3oIoBtYreeHSK9br3vt:8eFB3ZQnk9feVk+BGKo/Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780798914, "uuid": "4ee8adce-377a-4330-ba44-847cb29a3510", "value": 69596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780798914, "uuid": "4791fdf5-24d9-4437-af83-031800304069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780798914, "uuid": "ca5e5355-5312-4774-8576-74d0e87ab33c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5626daea-621b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780800497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800497, "uuid": "46488bd0-0847-4a0e-b3fa-4885a1eff8c7", "comment": "Malware payload", "value": "7eda380108bf852acc971a0219c9b8ae", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800497, "uuid": "3a9840ef-5d6f-4674-9d50-cf6a64635b2d", "comment": "Malware payload", "value": "a7569c18cfd60888f9b1051f99f8c648ca1bdc134e2f702fe936aa1778c178e6", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800497, "uuid": "6af2ef33-fc73-45a7-82a3-5d24cad5283e", "comment": "Malware payload", "value": "a422f32f636ecae18fe6c7d30cd14c44701890be", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800497, "uuid": "000ae948-9a5d-49bc-9b20-78cc3f739f7c", "comment": "Malware payload", "value": "f5d8aeec90db730d4cc9ce603e1a53455e5cf3f2a10a5afc54e4fbcac5a4c0724e029b66d949cdc7f588ce42137cd812", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800497, "uuid": "b04dd61a-7d96-4efb-9b1f-9c0829b05a2e", "value": "T1BEF6023B61EE65BBE0590739257392151E3B7F3064234C0E96F4B8E8DB35FB0192EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800497, "uuid": "8ae455e6-42ac-433d-b97c-8f776489e2d1", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800497, "uuid": "0c98a462-7eb2-4793-b367-9042d108ab5c", "value": "196608:m+KnJ8oVGxS1q3FJzzqe1VjPwD1W1vsPsKtytP:mbnJ8p13FJzzqeLm41vE/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780800497, "uuid": "cf4e8739-fdb8-4bff-a03b-2c6efbe0ce43", "value": 16519440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780800497, "uuid": "e2f336b4-8307-43f3-9a03-f107c8712dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800497, "uuid": "df5df30a-1428-4676-b943-19ad4036f93e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03299c7a-6243-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817538, "uuid": "8f92a369-c4c9-4af3-9d71-02b6a150b634", "comment": "Malware payload", "value": "0a6ae5de8eef859f72b6acabfd1385e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817538, "uuid": "b970069f-4c1d-44a8-abc8-3527ff51cf81", "comment": "Malware payload", "value": "a78af7e0210c8d6b7acc26e2c0d5f4c4b8ca842487391019f5fc57820db1562e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817538, "uuid": "b5ecadc0-ba05-4b3b-aa83-5cce0b800155", "comment": "Malware payload", "value": "8a70b696b7f8508a560106db6e7616146daa7c49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817538, "uuid": "5aa5bce1-b56a-4bd2-ac6d-7613fbc3e6ad", "comment": "Malware payload", "value": "aa99c37d99e6f3bb955e047044b6fc6423736e2c13e3070c4e5d1522a9fca382f81f7c3479aa628f52dcfd307bacc68b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817538, "uuid": "615acf3e-f35e-48e3-8842-9fb3aeb5e9b3", "value": "T15863292A78819F15C5C5157ABA1E534E335367A8D3DFB213FE016B2C378B92B0E2E542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817538, "uuid": "56d67b79-ac73-4c2c-bd1e-b863e2ab01f1", "value": "1536:XbnKQp1O5CWa/yG1IKyRdzKV2Dpik2NuLp5+/k0:R2CWayG1IKyH2NuLpo/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817538, "uuid": "62b96220-4596-43e8-a11b-c1d5b81d913b", "value": 67696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817538, "uuid": "d69c9c7a-e083-4eed-bccd-b158dd2ee3d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817538, "uuid": "218bb236-471c-4714-a4d8-d984bc1bfc16", "value": "gsU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ee900d-6256-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780825828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825828, "uuid": "24c7aa16-5d9c-4848-bc28-c18097f5760f", "comment": "Malware payload", "value": "6d350b14190daad6b789ea537e894e6f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825828, "uuid": "61f8052e-4425-4775-84eb-bb610e96acc7", "comment": "Malware payload", "value": "a80780ffff5fd0d3bb6b8cdb3eed509a7f5e44c2c604ab75f01c27afcb006857", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825828, "uuid": "9826825a-6af1-4641-addb-8d1eb5b5e18a", "comment": "Malware payload", "value": "b5b63b5dcbd38cb86e501b5325a7846a4337c968", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825828, "uuid": "e137377b-8327-4dcc-98cd-36a7b138450f", "comment": "Malware payload", "value": "06cc40aa868fdc3f41f740d8b790930668eced72da78f3f78d6cf547c51afdd469333f425dd9e4fb032e58cb025c255b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825828, "uuid": "3cd21be0-b972-427a-b8f7-784306c3cee1", "value": "T1A905234A7AF8BB23E4D29C743A29033B24A4115F703F5E93FDE1D71E89446216E4AF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825828, "uuid": "7449a64f-ead4-4789-b8c9-ae06035918a6", "value": "12288:deL4uB+DpIJ8xFMP9XfRQvB8+eFxhiglq6wRCAt4UIjx+80HGwxbaigjgO9K:deNB+FI2xGRQi+eFxh7qOmgigjbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780825828, "uuid": "5895bd40-efa4-442f-ad8a-3e23fd9b858e", "value": 797307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780825828, "uuid": "92ca4a20-03dc-4b38-90ea-2658c0b7990f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825828, "uuid": "77a79625-e166-40f8-b439-a534e722aa8b", "value": "Gambling rig-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca514eac-6227-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780805846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780805846, "uuid": "a5009fd0-1d61-4945-bb0f-e7447085c102", "comment": "Malware payload (Mirai)", "value": "385225bbd8849f71129ee43aad76ac71", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780805846, "uuid": "ea539ba8-5e1b-491f-957d-27c97bcd8bb2", "comment": "Malware payload (Mirai)", "value": "a932de29d7252cc930ea0146a95abfe69d2b88731a49cd92db720324ee1fd253", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780805846, "uuid": "e4e1817c-5ed8-49bc-9402-9079f20ac114", "comment": "Malware payload (Mirai)", "value": "443d74413bdc5bc276355c76c21a059849514c81", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780805846, "uuid": "ab54add2-53bd-4064-aefa-de59c6dba5a0", "comment": "Malware payload (Mirai)", "value": "d4a129dbd9bf0f9ade5ccaca3371e8d39b107fd07a97799a617094f6784876687326edbf17c89d5828a13df6d394ca02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780805846, "uuid": "de4df778-707b-4fd3-839f-ba788667877d", "value": "T1B811C06DFAFCCED204C8C884BA707410EC96909782B8A2C1BBCD1A20BF00DCE195330E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780805846, "uuid": "d1427338-85c2-4531-a252-e3beecd02683", "value": "12:FzY8id/7JAC7ikxGWibdnak1B3wtW5oZyW5YEnfZgqdLNiggVLNiBC/jBv:FzY8k1/8WibD6SSySYGZgqegzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780805846, "uuid": "b04956aa-2475-4420-9639-a7f5a2811e0f", "value": 1077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780805846, "uuid": "524b9358-da6f-45a1-a12f-4f58e0b6baa4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780805846, "uuid": "e0b6500b-dfaa-4c0f-82c0-4dc3a7d2091a", "value": "payload.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae35a91-623c-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780814705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814705, "uuid": "2b2dbb39-dde1-493c-b454-cac92b946dd2", "comment": "Malware payload (NanoCore)", "value": "eed6f7072eebcf2722e454bc69a09b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814705, "uuid": "b94fa7b5-8e39-438e-81f4-0f4a7c4287d9", "comment": "Malware payload (NanoCore)", "value": "ab7cc466b9ef866753d53adf76f5ac36a5fe54642dcd21ee3f0b7fcdf3ac4f9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814705, "uuid": "72ca1401-42e7-4a2b-b12e-f90ca9d16f3e", "comment": "Malware payload (NanoCore)", "value": "4027092ba57e64501701a8971186e2026906fe8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814705, "uuid": "5dc6bea9-95b8-48be-b2e8-208385472ab1", "comment": "Malware payload (NanoCore)", "value": "8168621c1e2c242654ab0e8a2718365fdf53699a28b395c2d2484416eaa58ae555b39c004732a105f5b61dbdc0bb0c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814705, "uuid": "ff09e12c-d07b-4533-b9c0-f4bfb9929565", "value": "T11D14D0553BA84A2FE2DE85B9712212139379C2E3E9C3F3DE28E451B64F567E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814705, "uuid": "f7fdd514-a0df-4915-a55d-ce84d8da3d4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814705, "uuid": "e1eeb71a-4a6c-43f8-8a42-c3b88b632549", "value": "6144:MLV6Bta6dtJmakIM5x+LsjAcW/zhIRFq7:MLV6BtpmkA+LsUcwzh37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780814705, "uuid": "357ada31-4a0e-4c6c-8b6c-c4916ff21e4a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780814705, "uuid": "dd697f33-ec68-4201-861c-c9eea0f6b0de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814705, "uuid": "408ea722-9d66-4e50-966f-7195c75718b5", "value": "lishman.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee7e34b-6259-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780827194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827194, "uuid": "a541f1b4-b31d-49d3-93fe-8a4bf6106a7b", "comment": "Malware payload", "value": "5964f808a2f38b7ad652e26b2575c581", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827194, "uuid": "872b8e47-1841-4e57-9f6d-cb3781caee0d", "comment": "Malware payload", "value": "ad21af758af28b7675c55e64bf5a9b3318f286e4963ff72470a311c2e18f42ff", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827194, "uuid": "0456356a-224a-46b4-8e1f-f8fba5c90ac9", "comment": "Malware payload", "value": "b23bdc4aa0f4bc06e464482c4a5d6d4e58ece8ee", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780827194, "uuid": "5ecba48b-251e-460e-aeb8-32f8ac7e304c", "comment": "Malware payload", "value": "3492aa8fa77ada82888ddc0c52376efa89c99e9dfaba204e2c4a6582136ff983e944d2b1d8303380d43ceb2f974913d4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827194, "uuid": "07f45929-5c55-4fc1-b966-abe393054def", "value": "T180D66C53FC6D64A5C5EDA9715B664352B731BC488F2063E72B60BB682EF23D09B32710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827194, "uuid": "b9f521c7-c5ee-4bf2-9822-45621735518c", "value": "98304:Wv9YlDLmuKoTUEO0HWYRUBrOnyofTQHaD7uHUbd7TDgmcwgqid449Yki5xE7K0Be:WYSuK8O0Hp9i48mq05S7KUZqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780827194, "uuid": "b12d4239-c415-40ea-855f-9df6b5574469", "value": 13573826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780827194, "uuid": "48d421f8-f86b-4b6e-bde7-ec52dd2b4864", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780827194, "uuid": "a4b46e72-c6bd-43c9-bb85-42f892a591d5", "value": "a.out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39872ea6-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845976, "uuid": "8ac8cce9-27e9-491a-bb4d-885b1af113e0", "comment": "Malware payload (Mirai)", "value": "cd90fdd304df617719b444f218a89c97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845976, "uuid": "c9464a1a-877a-4041-8fb9-34445f1a05d4", "comment": "Malware payload (Mirai)", "value": "adab7c549a38c3dae295744f3cc677df91287270f2283bc1bcd4f0e8ffa7de49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845976, "uuid": "2cded28d-3bb5-4888-8147-278922903693", "comment": "Malware payload (Mirai)", "value": "d36aab321ecae3a4def5a62ae44decf1ffbb8d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845976, "uuid": "731ec4ef-b0d9-4398-8ca1-bbfb884a7cea", "comment": "Malware payload (Mirai)", "value": "88d97be4c74d1653671570d80de93f2ebe3a9f642cc1d2e1a8980005b7a7ab6758636f7f2e2a2f8b6235c733643b567d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845976, "uuid": "ab8706bf-0299-41b9-a76d-246681f0667b", "value": "T1AAB33CCBF801DD7DF84FDABB54634D0AB920A3915A930B26675BFD93BC331A44906E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845976, "uuid": "22aa1926-30ca-491f-a0fa-55404a3e35a8", "value": "3072:IbbdakDAkymEJVv54maQxjYwVcrAsDyTu3Q9NquzY1Gxz6ew:ybdakDAkymEJVv54YxDXGQ9Yuzxz6ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845976, "uuid": "72c1219f-d9eb-43b1-942c-825aa82f2d0b", "value": 116868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845976, "uuid": "b4a8ca2e-6452-4693-a0ed-bc2830b4cd78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845976, "uuid": "3a45bdf4-11c1-48b6-a369-0ffecf9d1635", "value": "Mystic.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae56ba1-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845978, "uuid": "c06cbbc9-2e15-423e-9776-1e50cc44ef9f", "comment": "Malware payload (Mirai)", "value": "897670098fd310db4ba41eb6aafa9793", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845978, "uuid": "ae8ecfae-5752-4637-9c3a-94a72d3913da", "comment": "Malware payload (Mirai)", "value": "ae8b6239863cf73c99f16cc116227e99ade34bbb365c9f2d0badada374cbc2e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845978, "uuid": "ea0dd1e9-1bd3-4134-a3d0-5118c79d7cdb", "comment": "Malware payload (Mirai)", "value": "53bee25e1ebf2128911ec67e143c012cffbc442e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845978, "uuid": "108ef848-8ba1-43a7-ba52-afdfb5bb8822", "comment": "Malware payload (Mirai)", "value": "3ffcdccc0f024b76e55c20416bfd0a0afbe39616cf7fabe46167dfc2fcf683d235eeed5763c2f28851b3543418da7a75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845978, "uuid": "d75017ff-4880-4255-a4e6-e8c0d4a11a40", "value": "T1965195F500B204742E52FB5BB3AAF10C73BB60953BE7698C69ECACB5434DD916C42653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845978, "uuid": "0f252c5f-395a-4e83-9443-00f7210987e3", "value": "24:ItcOiLcEmLc/9sLcXKLchC3LcxewxeImZLcEPPWLcMmLc32LcaP+LctmLcvQLcFK:iiLML3LvLlLDLzWL4LvLULdL3LLLgbLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845978, "uuid": "df73c21b-dbab-49b9-bfd6-f4e509c70669", "value": 3034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845978, "uuid": "882a95a5-5ebd-4b2e-af92-ca58d3ab6ecb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845978, "uuid": "1f91b360-0b84-4f02-8790-397765b02fa2", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebc9d1d-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817127, "uuid": "f270f5a3-5034-4094-b972-930e29f76d68", "comment": "Malware payload", "value": "cfb48e7256c34fca0447cd0e6bc7d1cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817127, "uuid": "40d82a23-2b59-4eef-8215-a9a995da417f", "comment": "Malware payload", "value": "af7d740565602b5318dc6b5cef6462741be7c38ebff035e2ea587d6fe82e464b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817127, "uuid": "e26f2509-09ef-4db6-a465-91bcc218cd95", "comment": "Malware payload", "value": "e82174cb091f90df9b117bd6536e109429e52365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817127, "uuid": "52dbd296-cbd6-42cb-97af-1907ef78c9b7", "comment": "Malware payload", "value": "39c1343204f9173635a6b92d13fc36327f47841f681b016c8575c04947057c6c47b85a7f0a139ff22523f7449144bf99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817127, "uuid": "0f53f96c-9374-4240-bbda-61294598716d", "value": "T173658D56F3F37CFEC1638131869BC7626936F86512022E3B6584A2342D3AEA41F45F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817127, "uuid": "d1a3f70d-3971-4225-9b1e-38030dded1e8", "value": "24576:kTeszlIEvVsrjh6WwwDbFB1z71Zi5gq+kcnQHNjuc/Wl4Wr:meszlI6VsXh6WwwD9z71Zi5dD9ucuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817127, "uuid": "c9a5cb27-2021-4bdf-9e45-dae09ea97386", "value": 1499496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817127, "uuid": "e284e5b8-f043-47b0-8883-6892bda59ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817127, "uuid": "e31d8a58-31c7-4ae6-aeeb-3b551b9cef0d", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f82a60-62ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1780869003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780869003, "uuid": "ece3d1f3-e3c2-4878-906e-beb8a314c37c", "comment": "Malware payload (Adware.Generic)", "value": "ab6a82313edab476d7230c68e148ea19", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mircop", "colour": "#2AF0E8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780869003, "uuid": "4ccd2687-1b6c-4741-997a-a5eb4bcbab0c", "comment": "Malware payload (Adware.Generic)", "value": "b20afd54974f94d11fe15a25732f7707f853051e5ef20ef257c47f23c0be92a1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mircop", "colour": "#2AF0E8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780869003, "uuid": "77105501-0566-4784-bf2b-21338365d858", "comment": "Malware payload (Adware.Generic)", "value": "2ec7a62ad599db4e3e1b1771181b51261c888f52", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mircop", "colour": "#2AF0E8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780869003, "uuid": "c0982aee-a00b-4048-a8af-076cce556aa1", "comment": "Malware payload (Adware.Generic)", "value": "f61b5aa2c27ab3144b9250197d0bd75c1ae5e2eebba9812687fad206e1e41403f04a16539d24fb47ecc64d3e4faaea17", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mircop", "colour": "#2AF0E8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780869003, "uuid": "2e3bd588-d82f-420e-8765-e9bda0ff9012", "value": "T17AD5E13FB268653FD5AE1B3246B38260997B7A71781B8C1E17F0090CCF6A5701E3EA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780869003, "uuid": "5e6a47cc-76f3-45a9-90ca-fefd0563a406", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780869003, "uuid": "33ab6655-9430-4187-9111-46bef93238cf", "value": "49152:JBuZrEUFa6yfbFsWkES7BOEPrSgmKvrjA:fkLFa6sFsWcdznxvr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780869003, "uuid": "4b0ed59f-9d37-4803-9a86-aa8d9bc4d2f6", "value": 2785360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780869003, "uuid": "c0262a22-e253-471b-b627-8b3bedf0e5a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780869003, "uuid": "1263f79b-cecf-4ff2-8293-1c6441085621", "value": "TelamonCleaner_id6a25e1b7eeb72sp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc0702a-626f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780836671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836671, "uuid": "d6b061c6-3800-4b64-af03-0f6ef2defed2", "comment": "Malware payload", "value": "3853d58b3e9a08fe6031fca60c586f7b", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836671, "uuid": "ad898dee-139e-49f2-861f-c1865415cdce", "comment": "Malware payload", "value": "b64490ff12417cf3595978ea76328b998af879af52ed02c7340bb7e568c00205", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836671, "uuid": "289785d9-b7fb-4e61-a331-f1eb59a578b7", "comment": "Malware payload", "value": "5129a57d21490bbf70b9b90ec2340e1cc8216dbd", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836671, "uuid": "480f50ee-d2eb-4db7-82f0-ca78ae0f40cb", "comment": "Malware payload", "value": "423c8a3e7c4f4eb098ef9cc7cbf5961c8bd61dead55871de6255c8f2197400f14783dd4b765653bb3c78d970dd5cfce4", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836671, "uuid": "b7fc90bd-c4d3-4fbc-bd8e-e19491a333a1", "value": "T1B7B2940A7703307CD6AB867D28E71B7D76F6B12242213F3FC215E33A4DE065466399A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836671, "uuid": "cee45f55-7d0a-403b-908b-ee80ac85352c", "value": "930114ea3a0db366a62402a60e419b13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836671, "uuid": "221b224f-7a6d-4f14-956a-3354baca4dd3", "value": "384:FC5yVV9iT8vyP6Mnk6tYG+o6nccnWcV00FNbGpFL/mWmACZ:F8yVV48v18uG+eqW800FNbGpp/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836671, "uuid": "9e084f1c-158f-47d5-988a-818d04a003f4", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836671, "uuid": "0e1c04da-2c8c-4e34-853a-bb03ac56e7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836671, "uuid": "8453812f-3ec6-461c-92a0-3aa92ebb2f5e", "value": "uxtheme.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f642c7ad-62b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780867767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867767, "uuid": "e7619142-4a1a-421d-a1b1-917d89af40ef", "comment": "Malware payload", "value": "d98ec8d3e9c060ef5c51659204f50b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867767, "uuid": "c8695c82-8b21-46f0-8e9c-fd050fd6a52f", "comment": "Malware payload", "value": "bcb9245aaf4ab658224b2a860ce323083df75d4c3b22acc3ab9441215da2ac5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867767, "uuid": "adb7abd4-7cf5-4421-bf1a-c10a95b5c582", "comment": "Malware payload", "value": "12efdda7b7474a82c8d54e879912971b9f44d258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780867767, "uuid": "9cac9567-de16-4890-a840-b275067007f8", "comment": "Malware payload", "value": "9bd58e78211157ba9b6225127803a8683a8887de57758f8c9910786ef1c4ffeb9a8a210e9fb7f58d579b6c9ee0b84847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867767, "uuid": "7d6f4e00-494e-4022-a7af-a9dec0b92158", "value": "T131B34A73C826AF5CD268D5B5B0A08F792B53991081875FBE56B7C2B58083DCDF50A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867767, "uuid": "f2b5c70b-e574-448d-a45f-b9370f65457c", "value": "1536:WuT1UG7Vcus5ODwj/YYzIajCsKH1tD627ZUzkWIwl9yzWNF3MKy0+TV:WuT1xhcwajCHHTzWIA8zW73M13V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780867767, "uuid": "3ce7a6ba-719d-49a3-b7aa-6ad7a8936bd6", "value": 117344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780867767, "uuid": "f93e174f-cf5b-41e0-a4b9-90effe3f3cd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780867767, "uuid": "839050ef-d339-4997-98f8-6a1d8dc2bb5d", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ac04fe-6266-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780832685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780832685, "uuid": "410c8789-19c1-4c7a-99a4-7000f0486c01", "comment": "Malware payload (Prometei)", "value": "6659e55876e55494b9d187c5cc45d4e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780832685, "uuid": "2ae844fa-8b2c-4432-958f-14d5e0a2cbd3", "comment": "Malware payload (Prometei)", "value": "bd706a3987ca2e3dd1e82ff7408a6c106a1a4cdca498d6a25dc5f92b581825f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780832685, "uuid": "d8bd963e-b3ee-44db-9e46-914f8557093d", "comment": "Malware payload (Prometei)", "value": "c634dc93ffe5843fcc68cdd0bbaf8775af2bac93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780832685, "uuid": "47a77213-f2d6-4e9c-9590-86868a834e62", "comment": "Malware payload (Prometei)", "value": "322effbc7dfa8b0fd751b9bd6dfa1e3d45c7eb4b3b973fc1c9f6c22e9a51bc96e4e7b7f8c2edf6753c79137ad9f16ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780832685, "uuid": "6b22fbc5-c2cc-47a5-8685-ee01d3633f0d", "value": "T1CFA423D62E8069E447A8B0865A689C1915DCF039DF33BD4CDFC148C97516E2BC48E2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780832685, "uuid": "a1d78c93-47d8-4958-8aed-8478fdb8c82c", "value": "12288:j+ajEJnjwVvPZ9YqLbWq6258q1ilZT8pV:yaOwVvvYm3CwpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780832685, "uuid": "c3e435d3-ff1b-4a77-9300-284a1a131b58", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780832685, "uuid": "a2060a98-b5e8-42f7-934b-42fa53fbf69d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780832685, "uuid": "0fdb72dd-2fe0-471f-8dff-9961fb4890c1", "value": "bd706a3987ca2e3dd1e82ff7408a6c106a1a4cdca498d6a25dc5f92b581825f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663fc9ad-624d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780821999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821999, "uuid": "ef90d083-63bf-4394-b60e-ee00ab1c9f9b", "comment": "Malware payload", "value": "4e0bd8ed22683d4dbd545c7453e0524f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821999, "uuid": "1bcbb244-4aa4-4060-afd9-45fc8aaf2799", "comment": "Malware payload", "value": "bd7525163c77b82056a0c285a02bf6a80de3c0b46958cf60d1d1a86b1207486d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821999, "uuid": "c32fa32b-c0fc-43d7-b43b-e10f7f569b36", "comment": "Malware payload", "value": "cd06e86c899dc41df8baddf6465d3cbf388103ca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821999, "uuid": "fda57ea6-9552-4621-9c5f-ca5c19c773cd", "comment": "Malware payload", "value": "20bc35ca6125d9a8e799fa4894ad56d2103ffe6dc3cc1017b2eb16dca17335cf7af93b32582c8b5e8e79d215d6c54a5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821999, "uuid": "89bf4de5-d189-4c66-b654-8c7f104a394a", "value": "T10E3189AB0B19369D5401D9B9B2B11158E1A4E6DA30DFD7A4FB480CBBD2C8148321DB5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821999, "uuid": "466df362-b10e-4a0d-9597-9c5b114ea655", "value": "24:TNuvKQPy2t0+83JR6GWOtGWtGGssth+qAF:BuvR0+85RvHJFE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780821999, "uuid": "5e9b4430-22d0-4055-8648-2f2509ca9382", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780821999, "uuid": "a981a2f0-e5aa-4a8f-bc6e-143fab0e81de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821999, "uuid": "91abbee6-cbe6-480b-bad4-d46017fb6d8f", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6429c8f-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859070, "uuid": "a29fb966-72be-423f-89a4-720ab4239e61", "comment": "Malware payload", "value": "bbd35e14f40b1dce5ef1ad35511b2f1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859070, "uuid": "e460a043-99ef-4387-9cfe-9c428fe67d38", "comment": "Malware payload", "value": "c03e5760c9a44d8fef1fe81bc65735d8a245be6150ffa08de412d39dce930d1e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859070, "uuid": "ac3b1b00-0c65-4ebe-b3da-599db91075f9", "comment": "Malware payload", "value": "3baf38862b9d3f56e20f4b8da9f9add24043f3bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859070, "uuid": "fca5a8f1-db85-4e22-9626-98a326ae76ff", "comment": "Malware payload", "value": "6bae709630144c62fd3f95df0411ff21ec3721d4aaed8c0b5d8fd5e1cc2de1eb88b5bc8f2d3ba2dabb3483333b013df2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859070, "uuid": "a233cedd-c2e0-4bc9-acf2-87d3e170158e", "value": "T180561997B9924942C4E43A77BCBD81C432630EBA9BC652566D05FE3C3EBE1D90E35318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859070, "uuid": "7b1fb25b-8a15-46f6-9912-28196e2a4edc", "value": "49152:U2zplx+WLNKggunKr0k56wnoVRCzyJbnt6RM5Ea:nz0KKkwzteEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859070, "uuid": "49b8ee1f-4b00-42bf-a4d4-d0e8af7368c4", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859070, "uuid": "35c92d9b-7665-41f3-b92e-f12c773cb24b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859070, "uuid": "03e97c5e-1354-4e2f-aeb6-6dc87b518bca", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b705d73-6271-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780837308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837308, "uuid": "904e931d-c154-4f77-b6ef-b4c57e1bf17f", "comment": "Malware payload (Vidar)", "value": "4aa02cf838b2a5bd5e477c9c56fd27b3", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837308, "uuid": "af653012-796f-41c7-adb5-1a3c3b4199f8", "comment": "Malware payload (Vidar)", "value": "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837308, "uuid": "1df1c3bc-c41c-45cb-b8bd-c2ec80eb97ab", "comment": "Malware payload (Vidar)", "value": "23fd1832540dc1afb79fbb3faca0448e8fc46546", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837308, "uuid": "edebd682-22ef-4771-bd92-5dadd77e556e", "comment": "Malware payload (Vidar)", "value": "5664f9be5a83e33a828d18241429c0c28725e6127b8d6ec3b3376f13e0b7b53a0a97d2be88ebded29b0e25a442d221bf", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837308, "uuid": "858bcf64-ed82-47d1-b806-f2ca81579836", "value": "T187E58D5268E50AFAC5AAB63189B2FD16FF647C544B7163C36BA0B2386F327E01D31744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837308, "uuid": "0117bca0-402c-46ba-b5e3-f3f7df78667c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837308, "uuid": "ebc94272-cd6c-4ae9-a3d5-fb99766650d2", "value": "49152:ucMA2IodyEmiwJ7JOkQuBeqGqla//CT6giJmm/ekBcHcVxEi:uR3AnBeqZxi/nBogxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780837308, "uuid": "15c34f51-cbf7-484e-9e34-1e7edf306bee", "value": 3105456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780837308, "uuid": "7db26473-61be-4feb-8fdd-4ac7c706e88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837308, "uuid": "852a1bfa-a1bf-4a40-a385-ceea90c70384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087de02a-624a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780820553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820553, "uuid": "95870ed9-f2e7-48ab-9f5c-4316a22f02ba", "comment": "Malware payload", "value": "e416bfafd652d912ab2cc63cd7d96d87", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820553, "uuid": "8bb8dedf-d798-43cf-883a-7e3fc4d0e61e", "comment": "Malware payload", "value": "c50d1fad7d94bdea6f4a4858e7c5f5436b5aea6d38730a05dcfc35e9e5af64cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820553, "uuid": "2c8e8210-2033-4f61-88c0-660ad98f539c", "comment": "Malware payload", "value": "c8acb4a9f9a27145aa40acc6fad3dd8318f54f09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780820553, "uuid": "4d44f1e8-44ea-43af-ba73-d56a886be83c", "comment": "Malware payload", "value": "05df242a13b6a38e7632584010194e6d8be77d4c7d637926da10c53e555700ea841e3984b78970dc1795385cb8ab6cac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820553, "uuid": "e47227c9-6a5f-40de-8484-710a2bebfeb8", "value": "T166137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820553, "uuid": "fafa260a-2fd8-42a4-80b7-4b9e1dbf7681", "value": "768:w+P9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:w+oco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780820553, "uuid": "1e97558e-0b19-4ebf-a217-2536fd9b14a8", "value": 45529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780820553, "uuid": "9ed16f94-6643-4782-ba91-0aec0cc686e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780820553, "uuid": "4280f6be-7212-4745-84cf-6561ced504d8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3613999b-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845970, "uuid": "08c64839-d8c0-4046-ba1d-a60fa840025e", "comment": "Malware payload (Mirai)", "value": "b15321380944877b70f8ecbad770ac96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845970, "uuid": "a26b2020-564e-4f92-bbb9-fc7b5277eb43", "comment": "Malware payload (Mirai)", "value": "c5e98b65aaa1461c9ebb58723d98dd24a893fba695318d3f84b1fa6f56e83ee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845970, "uuid": "7d156f9f-3d94-4963-80ae-28d3d3d64a5b", "comment": "Malware payload (Mirai)", "value": "63d1d3600e4573d8f20e0bff1fc8b40e0a98f330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845970, "uuid": "4cfc1b76-5e48-4560-baac-7e8c4ac622a9", "comment": "Malware payload (Mirai)", "value": "d7310b866284cebd449ea719e87b19d82d4bae290c480b7fecda752d95755faac9342120467c181f0dc9a051c78eeca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845970, "uuid": "f9c60af6-5598-447e-aac0-c5d566037632", "value": "T14323023847432A770E90AF7ED83C0A976D8B0CBE939872EB73EB44218570C86577E244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845970, "uuid": "1dac66ec-8deb-499e-9cbf-56bac87e7be4", "value": "768:Ijf92QK8De1OWl2pOx+9N5TtqPNXg/CqZ89uDmsppRqJSlJc99jylh6AWXM/WyJu:HFwBlDpCxcXZ89hSRq+i98i39LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845970, "uuid": "5164e8eb-2bbb-4fb4-95d4-1e2a46c699ce", "value": 48300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845970, "uuid": "be84c0f0-288c-48d1-98aa-71187495e01d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845970, "uuid": "f4d496a9-4512-45dc-b7af-8a39f371e0f0", "value": "Mystic.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0d0050-627f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780843482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843482, "uuid": "31fc92e7-9f42-4de6-9648-31ecef6d8fec", "comment": "Malware payload", "value": "aefcdc16fb02dd8edbfe6c26145335d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843482, "uuid": "f88380e6-3317-4856-8651-256064970d0b", "comment": "Malware payload", "value": "c696784cc0e7a9915b83f4df662e33de890e574288ad4e15c41168ba48db3b6e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843482, "uuid": "6d4dfae3-1cbf-4cc8-93ea-f536ba3df5cb", "comment": "Malware payload", "value": "bfdc2a5afeec74f0f8f4a4a21051df218116adce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780843482, "uuid": "a696910e-c745-4594-9cd1-2b438a3d880c", "comment": "Malware payload", "value": "55b6d80caf9ac55d2efeb1bfbe7c6d673e8b1bed874214bb492520c2a5d9404c9f21eac0160277e4187398dff0634186", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843482, "uuid": "e525120d-eeb0-48e0-9023-087c750b8f56", "value": "T10C85AE02BAC3A0F2E5DB4170506AA33F493D59189314EAF3D2D06E64DD73BD25A3A39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843482, "uuid": "8e0daa3e-2b2c-4781-a60f-5abf90d42bcb", "value": "d7b2f1c4b6c23e25f8b1571d3d67f059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843482, "uuid": "95d2845c-2f38-4279-8597-2666e1c73865", "value": "24576:iVQ271A/tx6+xKUpZOkRBsSoWntKVcE9lLUvwm2i0od/vWRzXsQ4l/lPUTNhDM+R:2AFhEUhKIvUitd+zXdCV8hDdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780843482, "uuid": "cc18c4c2-6c8f-4e96-8dfc-790ae84185a3", "value": 1801216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780843482, "uuid": "e10a7ebf-fd58-4816-8776-3517c7b36065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780843482, "uuid": "623d5a68-663e-44fa-a472-e39e4e0e994a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f536f99-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858951, "uuid": "db0d04d4-255d-4c8a-8f21-52967cc019dc", "comment": "Malware payload (Mirai)", "value": "ae62d4f6b8905348ac858dcc6338fca5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858951, "uuid": "7e4792c0-40a0-44f6-a992-44a3fcd3b3af", "comment": "Malware payload (Mirai)", "value": "c81cc1ad7a0bcb37236796c1c7927e108e5532810735d6ce0407a2f2302b1e65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858951, "uuid": "a40b480f-7843-415f-b827-0914deaefebb", "comment": "Malware payload (Mirai)", "value": "b0998c5e5fd0878da9d43c0d29532b10cd8d9c20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858951, "uuid": "3accac09-9c75-4c72-b45b-1743b8a3b97c", "comment": "Malware payload (Mirai)", "value": "3dae9ca7ead8eb5f7b50e816e51a27a4e5cbd647aeb8dedc388140d554add0947dc86bb73c821f301e2971a096d754b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858951, "uuid": "27e6f5b9-5352-4571-ae51-478c94daacaf", "value": "T1E94302BB4A4964E3EE10257DDC18A9529C4D5AB4D4ACBCB1B1373D6AD1F6C20314F70E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858951, "uuid": "74605243-4db4-447d-9b59-c85fd7d91daf", "value": "1536:1WaM8UY7hTDdLCteE+9Iew+yuTZc+/qFFxdSQmfyq2L9:11M8UkTUt1QIeuuuFnhmaq2L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858951, "uuid": "7a737881-6009-4c90-9a87-ea1395d01d75", "value": 57348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858951, "uuid": "02adca56-3bd8-4ee4-af9f-69e5f9219569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858951, "uuid": "8d7d6477-1b3d-4f7b-b3f0-bc3b833c78f2", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36beb8b1-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845971, "uuid": "af496887-cfea-4757-b3aa-0cd3a2ea521a", "comment": "Malware payload (Mirai)", "value": "b7c830e1d00f37bf9552e45e415d588c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845971, "uuid": "ea4e3d2d-9979-4b66-8ffa-addf4fad36fa", "comment": "Malware payload (Mirai)", "value": "cbde6fc927f85fdd760da0697004c0db61dea6522a34ddf0004b0911aa745dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845971, "uuid": "28018736-677d-4480-a2d1-b2c3e565d5ab", "comment": "Malware payload (Mirai)", "value": "414884dbd33ef6310022d7d140a256dc4165841f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845971, "uuid": "bc0c98fc-5a7d-4202-b9c8-885bea3eed2e", "comment": "Malware payload (Mirai)", "value": "c2496edb4c3049e812453ec04ab8e2461ec7658b831eff528d900b0c0f7d72a0cfac94ef76f264cad003d6a96e9df4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845971, "uuid": "2351389c-a1ed-46fb-ad31-0ee4d736b83f", "value": "T1B71302994B774A40C5EE62780CDF2F0B9270999FD7150C03EED8A16B3450FAAD619F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845971, "uuid": "516c11c0-5c4d-4840-b5f5-862f122a0f39", "value": "768:8bSyfu/XdVzId88AmG9KWPPfx3iT3VOnf6IHQmfs6jcFpeulnbcuyD7UoQRjP:W2FV8y8rG9KWPPfx3iLVOnyuJfs2ulnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845971, "uuid": "b61e0fe3-89e5-41a0-95c7-3ae64526fff6", "value": 43052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845971, "uuid": "1533688d-9557-4267-a85b-b78dab9919ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845971, "uuid": "074d9a9c-fe10-4748-8e39-654faf71e0b9", "value": "Mystic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268b8fea-6278-11f1-a769-42010a9c0008", "comment": "Malware payload (ZigClipper)", "timestamp": 1780840360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840360, "uuid": "0b52b68f-3b02-4462-a398-0271f5afc860", "comment": "Malware payload (ZigClipper)", "value": "98887ebaac9fe0d1fa9433f9d8811201", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840360, "uuid": "eb640e94-1c37-4f70-9016-85e925facdc2", "comment": "Malware payload (ZigClipper)", "value": "cc72b42c5ead241222e935eaf10144a2a3a56ec492bbefb46eb78ebdf04f87cc", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840360, "uuid": "494a8641-bdc9-429d-86ae-ee532723b00e", "comment": "Malware payload (ZigClipper)", "value": "c9c6c474a014b1cff3f38398c6f329e053302c51", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840360, "uuid": "9c141010-e04d-4606-9ecb-bc28e56fcc68", "comment": "Malware payload (ZigClipper)", "value": "3f0afc866519f184a1f8facac438d7915fdbaf4afb2a6b2adc1ad18b6664323545f2dd787e903eb39325cd134fa420f9", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840360, "uuid": "03139f6e-c3b8-4f0d-8382-872be6a512a3", "value": "T1830507CF41A459D5E4787373C02AFB1EAA39BCE964A151CF1A673320FE384498D1B636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840360, "uuid": "dbea84a0-db96-403d-a364-467389d2d1c2", "value": "24576:sAEdXtLgSod+vCjiQK7dW9aCYOTAUNqBqgxIBWFb67jbTWs+4HDwx2UPY4BEA2A3:49j/pM8juMMkpLx3Q92/Pmbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840360, "uuid": "bd4813ed-28ba-4738-8503-3210d6c7ef3d", "value": 808296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840360, "uuid": "5089c79f-3f77-4c3b-9330-87d75bd0271e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840360, "uuid": "41940077-5c56-4308-bc53-d3cb9dfd1b19", "value": "XPA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e32b34-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "66890beb-57b8-48c0-8d47-13c3327dfe7a", "comment": "Malware payload (Mirai)", "value": "03ba55b98f037a958a8b520a12d909b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "cd1f237a-61fa-4438-adcf-0bc5b69546f3", "comment": "Malware payload (Mirai)", "value": "cd8cec8d509f19176a13d5750a458c55dacdb3397d0b141380131ccb13cff8e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "14a1c594-8a54-4166-8bc2-e95a480f90e2", "comment": "Malware payload (Mirai)", "value": "8b97d082f097c5f6b85d3494c0ed30f7228dc272", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "79397824-5941-4802-8573-8b1de0e1f28d", "comment": "Malware payload (Mirai)", "value": "04815dff9db02be8e521ab707868b0d41b000d7784246294a42a3edd3d61f407e3f2ee8ad51c33b10645e5d83ea270a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "895cae06-fdba-4030-9df9-bb73d65d68b8", "value": "T1E7D33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "67aa185d-d1d5-4670-92be-4b72409161c7", "value": "3072:JuVeGJFWOgt9ctajH1I7sO41o+YLyXzXgvY:JuVwt9cUH1I7sOMeLmLgvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859200, "uuid": "84454fa8-0568-42e6-a3c4-b31f06c5644f", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859200, "uuid": "c6cbbf5b-0ca1-4540-9b03-22d690c969d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "2c321064-e95b-470e-92c9-afce682c2216", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a98851-6288-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780847580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847580, "uuid": "9417dfe6-0779-46c5-a5eb-33f6188f44fb", "comment": "Malware payload", "value": "62bed4e30d17626400e2407ba47b67cb", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847580, "uuid": "2dcdd155-6633-4999-8de1-f9baaf2d1e45", "comment": "Malware payload", "value": "d05942475da506338db8d05e608a2468e5ebd7c3f379f5e1c7ec7f48956f7c99", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847580, "uuid": "540af283-bdb6-4a83-8a68-a2a0c6c649cb", "comment": "Malware payload", "value": "86949c30609b92f6e7ee0dd21ed42fad421b29e3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847580, "uuid": "ec8ad154-61b0-4d42-9d89-5aec9bbaf96a", "comment": "Malware payload", "value": "0fbd80ab254f5bad74d9c048a31fe881095b8045c0ce873489b4788faaa566a56a210488731f45fd5dd88e3934306b7a", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847580, "uuid": "a0d25d4a-717c-4ada-82ac-175b7a69b1e6", "value": "T12F366D2439EA5029F173EFB95BE47AD68A6FF7633B07A85D1050034A4B13A81DDC253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847580, "uuid": "58254526-61e0-4d91-9d94-e7571ed941cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847580, "uuid": "7cb509be-5484-458d-b062-1be2fa6c4ebf", "value": "49152:3LmPXF9ArGGb/cZC/7d8MnarPc5r5+6t:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847580, "uuid": "5a048fab-1179-412d-9f97-362ef0523f8c", "value": 5006336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847580, "uuid": "109aa291-f49b-4811-887f-c1501dd543be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847580, "uuid": "c4b1f027-696a-480b-9891-efcabb1fe28b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15223d1b-6239-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780813273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780813273, "uuid": "424333c0-feb2-435b-8776-be2889e12898", "comment": "Malware payload (Prometei)", "value": "9a5ed9fc7ec798ece13b8e5565a35e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780813273, "uuid": "6032582c-8da5-42ab-b0fd-abe4d7d8bce3", "comment": "Malware payload (Prometei)", "value": "d166541ec5b322c7bafea156ef89a99f7255c78da2c2fc5e6ef0546892e692b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780813273, "uuid": "aba17940-694f-4eee-b1e1-1ac6bf17a9e6", "comment": "Malware payload (Prometei)", "value": "0f1a2f175621dee6e8428f527223efe5984d5dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780813273, "uuid": "cd6957af-5ce0-47d8-875a-d73ec511531c", "comment": "Malware payload (Prometei)", "value": "c988f906b89c2756274d3afa53c3ceccd14e76c80965412e267d885369982a970bb0677f5d0680c5e2aa6be8ade23cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780813273, "uuid": "55879a62-fb86-454d-9b5a-196aee898461", "value": "T13B57CF7792167CEDE9B98CB4D01025816DA878874778E3C7BAC470E666EB6D08D3DB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780813273, "uuid": "ccad6a2b-d189-48d7-9b28-b96beab3b14d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780813273, "uuid": "462bc78a-33d9-4741-87dd-4a71c8f168f8", "value": 28147712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780813273, "uuid": "da71c703-5ac0-438d-bacf-1b83488c4394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780813273, "uuid": "a8527f01-32f1-44ca-be39-d6fade0138d0", "value": "d166541ec5b322c7bafea156ef89a99f7255c78da2c2fc5e6ef0546892e692b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba071646-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859076, "uuid": "3be18681-b817-4968-9818-b2a1f114def6", "comment": "Malware payload", "value": "ca765a495d4ed06164877e99b96bd9f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859076, "uuid": "0789d2af-f6ff-4c36-89c3-fda5bec664a6", "comment": "Malware payload", "value": "d1b293b4a1509a456bfad72e53828701fd19a7cab1e14b569dcdc1d45cd167fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859076, "uuid": "cdfc6474-bf78-40a5-b739-81bb22c25ed4", "comment": "Malware payload", "value": "db660a08cbab5a419aebfeca643bc48900df9de9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859076, "uuid": "59098460-8983-40e6-88da-90d7c586c226", "comment": "Malware payload", "value": "082bb913cbaf2d76ff9c6588ce4c22ca4f472da1cf23afe6a3ff8b4e150ca193c66d6bc7bc5c166fd5d8ece2feed86db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859076, "uuid": "ca5eacbf-bcd3-49a1-950c-96431b49abe7", "value": "T1F9567B81FB48A226DA5A0F324CB30B60B3516D46C2E8CD6B5309F76F15B15F66A4FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859076, "uuid": "01fcdf21-fa5b-4e47-866b-d71fa0ef8607", "value": "98304:09invr0lNg1P5oam1OpOgbboJc3FWrbAqnEjEN:z/J0gvoJc3FqlnfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859076, "uuid": "87451b56-c84f-4c47-aac6-bf3af9a775d8", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859076, "uuid": "3727ca88-21e4-498e-b8ca-8d0e325c7dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859076, "uuid": "751cc67b-a8a5-4d64-a063-c42418bba611", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18592ef7-626e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780836041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836041, "uuid": "cbf5a8e5-92c4-41ef-9eda-74610fe87dd4", "comment": "Malware payload (RemusStealer)", "value": "ed08dd295882f09dac97b14a78e9cc0f", "object_relation": "md5", "Tag": [ { "name": "ablackb-shop", "colour": "#7226BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836041, "uuid": "6e83b105-31bb-4505-adc3-9b6e77ee3558", "comment": "Malware payload (RemusStealer)", "value": "d577265f773987649e03c911e95cab0705107db54808e03ae250fb7697b79428", "object_relation": "sha256", "Tag": [ { "name": "ablackb-shop", "colour": "#7226BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836041, "uuid": "80bc7b8e-ba8c-456e-87f8-c6e4f69e245a", "comment": "Malware payload (RemusStealer)", "value": "5c40ceee2cf57280021d476bd87806636fdf8246", "object_relation": "sha1", "Tag": [ { "name": "ablackb-shop", "colour": "#7226BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836041, "uuid": "cb36224f-af87-41ee-b593-db4f1cc9fd67", "comment": "Malware payload (RemusStealer)", "value": "347705da4dfe974acdaa7577f5069506ef8de8f3758343a24b5be22cb66c9f2319ca123dd7b297bbdc85679e4eca6eea", "object_relation": "sha3-384", "Tag": [ { "name": "ablackb-shop", "colour": "#7226BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836041, "uuid": "a5c24983-c0c4-4718-9de8-af4e51e03930", "value": "T1CCD4748F50A4D0C7D4E5E27F80ABAB0D4A27BCE5535051CF1612F338E9787B8AD26636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836041, "uuid": "1a8cc1cf-ec2c-4b99-be32-fa09f7fc350b", "value": "12288:RYhomaKlvZJ5t53TnRpZVdt9JqV8wDaKoWCvEaNZiuv30Kju6yYT0Nl7G1/GhSPV:RYhom3lvZrt5DnRpZVdt9JqV8wDaKoWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836041, "uuid": "ca8dde20-e15e-4ef3-8f94-1fd050d9aa5c", "value": 640536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836041, "uuid": "f5241e16-a7b8-4395-8bab-41a98c63c0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836041, "uuid": "3be5f3f1-12b0-4034-9a38-162530b6cc57", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9de818e-62b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780865116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865116, "uuid": "5f90523e-d65e-4ebf-8bf3-38e863ca8c85", "comment": "Malware payload (Mirai)", "value": "e158b61493dcaac17a6bc527d388d6ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865116, "uuid": "0b7f3245-0763-431b-aabd-70e2be5bca83", "comment": "Malware payload (Mirai)", "value": "d6ab287c3f6dfca32c759e095457164f7792e310af1e4697e137669fa3e2991e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865116, "uuid": "f4d52777-ee06-46e3-8415-bcf8d1618ebc", "comment": "Malware payload (Mirai)", "value": "6cded8b6fbb74daf63d317b34a7d64a91ac3356e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780865116, "uuid": "e05fdcf2-2117-4ad5-99f6-259ccad2e53b", "comment": "Malware payload (Mirai)", "value": "93c57ad908afa62a032ca65a6c58865983c882b3d345c8f321351690b6cccc2a2082726357f25714442ff18f6cd6e96a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780865116, "uuid": "51d7746f-cfe3-4a14-9422-9671f27f468c", "value": "T158D3190ABF711EFBD4AFDD3302A90709299C594621A43B793674D81CF65B64F4AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780865116, "uuid": "fca9adf2-b93d-4496-97c0-e15b8f29de86", "value": "1536:ucgzh/YLB6xAp9LD6BoByGe6WXxTAiQhyofDd8b8ImL5fMoO95aqyhAex25M0dcj:upzmxByGehNAh8cxlJsqQr9a2IsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780865116, "uuid": "b8656db7-20a3-4cf8-8d4a-c51164bbd99e", "value": 134644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780865116, "uuid": "a1405dc8-e3c4-4bf3-abdc-8a4ad6b0d3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780865116, "uuid": "7b6e63fb-7ea3-4f23-85d5-22f287e3d57d", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad752c1f-6257-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780826413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826413, "uuid": "d49e480d-b26b-4261-9cdd-575782cf7482", "comment": "Malware payload", "value": "aa2923c85d6d2d8011a24e35be97c440", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826413, "uuid": "98e993d7-6466-46db-860b-0d831689249b", "comment": "Malware payload", "value": "d72ba68f966a169fe907287c610d0b66714cbb3bd719224acc8925a4e717c728", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826413, "uuid": "2d87b544-5209-4e4a-8cb9-16ab4d27718c", "comment": "Malware payload", "value": "b3530614b70be325e0bd795eb2098ac0fb8d9112", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780826413, "uuid": "03592a24-2653-4ade-87cc-424a1eedd91a", "comment": "Malware payload", "value": "e9347e809d0adf731315b0beafd3d4396c50cc61a41e2de3d674849efe08455bdcdd2518115f8326a0b5790b5a8eefb5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826413, "uuid": "7e3e64f1-8b97-4a7d-9535-a56c07e2b486", "value": "T12184238A2E806AA447A8E4CA57646C1815ECE534DF377D8CDEC11CC97227E27C1CD2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826413, "uuid": "d4c200a0-f9ab-42bf-89ef-17d320d338da", "value": "6144:v7lQRaj30gcNbrlFZxd/YVvFJAc9Yq+UzCUSTqaNf3eFeyh825fXlWMi1hDM+w:j+ajEJnjwVvPZ9YqLbWq6258q1ilw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780826413, "uuid": "9fd17dfd-83b9-4662-95f3-658c9e49ede4", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780826413, "uuid": "496a95da-06ca-4b20-b3b9-9a66df6e8075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780826413, "uuid": "8ba704b6-9294-488c-a389-401c5f8f7907", "value": "d72ba68f966a169fe907287c610d0b66714cbb3bd719224acc8925a4e717c728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45472dc0-6213-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780797033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780797033, "uuid": "f8712783-7a4a-41b0-9b94-834a61e22a58", "comment": "Malware payload", "value": "766320542b37f25c61d4c1b3a54fb2e2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780797033, "uuid": "591c651a-47f2-411c-b10a-382a3ffb8188", "comment": "Malware payload", "value": "d8cac69542cd5cbd7ca34ee30d313fc2a9db755e64598b59439982f3971bfb34", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780797033, "uuid": "77f880b5-6bef-423d-a542-f439d48b6e45", "comment": "Malware payload", "value": "d217b17e912b6b0f1eecb47ea83d4616ba2bd39f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780797033, "uuid": "028998ea-b5a5-4246-bde9-cbf766feb167", "comment": "Malware payload", "value": "479b3a754512cce908e331775fd7a47619be633ebd6d92c606db0f035db8d77c8c1d9228b3fbb09fcf0a7db6e1da31d1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780797033, "uuid": "83c9f81b-765b-47c5-aaf3-25ff7ede8ab2", "value": "T13F01CCCF8005C71094C6E89E22E72084F811C3CB39418BB6BE6C683DAFE5A587015E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780797033, "uuid": "71da19ae-836e-4062-9403-8ff46255b799", "value": "24:kXCKysE2hi0ziQvZohaHiGeZZE1U4z+kX:e9Qp+MsHPeZSr+kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780797033, "uuid": "b680e5d0-4734-45e1-8e25-75ed9166da2b", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780797033, "uuid": "74defc72-2d23-4f00-a481-a8af07e43fef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780797033, "uuid": "9e25e5fb-b875-4ed6-ad7c-8707b2082d02", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a51c2de-626f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780836582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836582, "uuid": "cfb31412-126a-406d-bc39-184791b9f3c5", "comment": "Malware payload (Vidar)", "value": "4bc6a8e2b2542d8094464873482a586b", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836582, "uuid": "f26611ae-b21d-4277-98af-dc3053f5dce0", "comment": "Malware payload (Vidar)", "value": "d9a473b50763e0ea450ff2ab42f70acd389394380c430487bb0a19eb3f6132f8", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836582, "uuid": "b7723353-a057-4460-8ba4-95c2e6b25175", "comment": "Malware payload (Vidar)", "value": "eff09301aded482f22d940d77afbf51dda32d89a", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836582, "uuid": "1d6f7e14-b3da-424f-a34c-0a4686b9cef8", "comment": "Malware payload (Vidar)", "value": "9138a37d3750f0904026f1cd38c42392040444d78d285f407fc7e89bb239bda9c8e9530bfac2e5187788d05e407642fe", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836582, "uuid": "1818eb42-227e-4956-834f-e5e66c9d6ab1", "value": "T125E68C4B7CD424B6D6BA93324CB25291BB31F8890B3167C73B55A2B82E377D80E75394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836582, "uuid": "bcb0b7cb-278e-4213-accb-7b9015435a9e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836582, "uuid": "b709aa14-4534-4c42-bd60-f9920be426f5", "value": "24576:MZEpXAy0kZYYHrGPqgR/gZ3IoLntVpuruaoIt/OHkb0chlILRNIUJheSgk0HDsie:MZIX/0kZlCR/fovna8ClI5OSgk07ID1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836582, "uuid": "fe080855-6475-4fb6-81d5-7495999af643", "value": 14876872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836582, "uuid": "e1b4e71b-55ab-4525-be58-2b8934508243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836582, "uuid": "a2a9da5d-5851-481e-ae09-bfe3b0e1ba1b", "value": "Release_v2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a1475a-6251-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780823558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823558, "uuid": "300db17d-1574-4ae7-a5bc-9b7d09598dd7", "comment": "Malware payload (SalatStealer)", "value": "6a3560686bfdcc88e2d0f1ccd57ea4f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalwareX", "colour": "#4B99CD", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823558, "uuid": "197463a7-e0d5-42be-9fbd-c99e4b7c5737", "comment": "Malware payload (SalatStealer)", "value": "d9c92563080056480c3afa2a0ecedab16bc2f480358329f65c3ceb4cead2ae06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalwareX", "colour": "#4B99CD", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823558, "uuid": "f68d6a69-7124-47f0-8713-74d87faac54c", "comment": "Malware payload (SalatStealer)", "value": "d1f69ec8670efb27bf084985383a59dd48873360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalwareX", "colour": "#4B99CD", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780823558, "uuid": "403f7b3a-5c2a-474c-9ac8-2c9873de01a6", "comment": "Malware payload (SalatStealer)", "value": "dd6a94508879be39e56cfbfb74f0a596612503d5997eecc28ab2f41e68cd8b2968c723c0028008b16300853597e3fbc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalwareX", "colour": "#4B99CD", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823558, "uuid": "6c548973-2c99-40f0-a0a5-b910a81fdf41", "value": "T19537332A376912F6D4F35074C884C536E7B178254B309F9F72DC0E6B6E830911ABA7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823558, "uuid": "bdd6d8e0-265e-44b1-a184-a4812b787a0c", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823558, "uuid": "85a66673-2f34-4a95-8ccd-368c0e223ccf", "value": "393216:Mi9l4G1o/ns3jdk9UwMa64Vw7d2auz989XMCHWUjxOrPwE0mC:5vKnszaYGVOXuh89XMb8xEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780823558, "uuid": "4419fe47-441e-45ce-82a6-d9ee69bbb52b", "value": 22588859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780823558, "uuid": "b7b6a5c6-902f-445c-9ecb-087a315a0e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780823558, "uuid": "15c22307-cee3-42ec-bf3b-3f092e0217ca", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1815888-6244-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780818367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818367, "uuid": "8fb89a86-a1f5-4313-ba3d-2763b59629a8", "comment": "Malware payload (Prometei)", "value": "5889a605f00d2172b0034bf8cbadebb6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818367, "uuid": "aa61af30-2be8-4347-b286-a1aad5d89e70", "comment": "Malware payload (Prometei)", "value": "da885760aaf9f56c93709a0aef58473618b2e60c69b5f5aea24e9bd1f3ddd950", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818367, "uuid": "c873d4e2-3177-47ab-bdb2-50734a3da0ad", "comment": "Malware payload (Prometei)", "value": "1959564f871a5e562f5b5643112e46b1ca9bc679", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780818367, "uuid": "d92bb05a-d428-4752-bf32-1d12c4545d0f", "comment": "Malware payload (Prometei)", "value": "f60d86aafe5ac1a07c5d48f307bcea635e154d94b9a521da5b22230154f0f0c2a71937d81c2ba0c5c0a6c749b76e288b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818367, "uuid": "a7f4ca49-ec32-40a6-80e2-5375eac063bb", "value": "T1F0453365C3F5F63133252674A26469FCE45CA98AD101BAB0DF3870DFAFD62C0992E613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818367, "uuid": "4239c025-dc0d-449f-a8e6-46aa8f534456", "value": "24576:bmz2yI9om3DOVKjryxYJY8WM8hczQbDYAAQSml27vhs9QJghsv0bj:iz27BA6yxiY8j8cw/oh+s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780818367, "uuid": "94033dce-a252-41db-ad5a-e7b283d65511", "value": 1200000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780818367, "uuid": "54f50040-f802-4372-a154-4a7f214bacd2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780818367, "uuid": "175340cc-8fa1-4e65-a375-53e2756e2c04", "value": "da885760aaf9f56c93709a0aef58473618b2e60c69b5f5aea24e9bd1f3ddd950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05da9e0-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859087, "uuid": "22501fdd-5a78-4249-a909-14afd05a45a4", "comment": "Malware payload", "value": "ab075525cae0cf1e14b4ed8cc671720f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859087, "uuid": "46989aa1-5f62-4222-be44-222aa8c780b9", "comment": "Malware payload", "value": "db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859087, "uuid": "d476da8a-821e-4043-b66d-41f07195300f", "comment": "Malware payload", "value": "4aaa37bf609a35c50c5eb942122a1ba9fbe7ed5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859087, "uuid": "5e76272a-fe00-49c0-8a8e-8325a65a2319", "comment": "Malware payload", "value": "bef99981376ed534e5f8aa7c62607735f2be635525cb6882f282bca9c51e075ac8ec77c4823b80ae28b69be66c56ef14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859087, "uuid": "6ecc3a7f-77df-4f08-bd17-7d031071f9bd", "value": "T1D0F0ACE711B0DC3175B4C92DFD9782E0104B18272829250A709F7E00BB2C98CF286655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859087, "uuid": "f5fe23a1-5b1a-42dc-a1c5-d028a2d12ef3", "value": "12:Zx80LXalokLeHt4ayzKuPfFFHshByuFNkjXfahx:gAal2Ht4aIpnF1/ihx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859087, "uuid": "6c201109-4a79-4dbd-b54e-134fb7b2e787", "value": 622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859087, "uuid": "d9383a46-8c15-4a5e-8dc7-6d1b80175adf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859087, "uuid": "2c50131e-9b15-4579-af50-d9ba2230b67f", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056ea330-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "255b0f6b-4f2a-49a9-b4da-39b71c92f832", "comment": "Malware payload (Mirai)", "value": "e88857558128e1dacb8174cd3c744cef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "6400f9ce-805d-48e4-bf65-57824ecd7ea2", "comment": "Malware payload (Mirai)", "value": "db643607eb610ecabf6867963d5c3cf994002d374bed24cd036c5293d90f04ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "943f0f21-fee2-4656-b700-e9606186b815", "comment": "Malware payload (Mirai)", "value": "1377f7f9b7e0431801ff0a33998fb2a9e76fbd70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859203, "uuid": "3142b7ca-82f8-40d8-bdbe-0a79408fad99", "comment": "Malware payload (Mirai)", "value": "d665ac6d316a3fe30e21a2ede5fad021aa93356d78e564a29621b263d89fe9838f5593279f4f17886104be5e9538d7a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "191eca5d-dd1a-4c45-baea-de49781b41c1", "value": "T180D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "a908d4b9-ff85-43ff-807c-b8e77acd1e35", "value": "3072:oWGIf1/UwfhJdU80rRtbYUaDGMsMA9TK9t:oWxN/UUDGvbYUaiMsMApK9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859203, "uuid": "3df12192-ea78-4ee0-b767-498f27fcf7f4", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859203, "uuid": "2d6714f6-d6dd-49a0-8300-3a6e70ff205d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859203, "uuid": "54a3a05e-e4db-4bf1-b805-ada4f9246d9e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1228467d-6271-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780837320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837320, "uuid": "2f3610b6-81c2-4d1f-b898-ba9b18dbb781", "comment": "Malware payload", "value": "70ac9d18d3086efa8ea9ebd72ada1702", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837320, "uuid": "3dfbad58-2e47-4c4b-969d-058ecad6204b", "comment": "Malware payload", "value": "dc3ee7ccb1e112b3e79be51fad77cc287f60004f6f44601af896a5eedbef62b7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837320, "uuid": "321cb4b0-e47f-48e3-9564-62b2204c439a", "comment": "Malware payload", "value": "f2653e11013b1d908844a4560c30851e40168810", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837320, "uuid": "f45b4733-af47-4de7-814e-48cf8ee4d9e3", "comment": "Malware payload", "value": "3b39f9e9180a1b03225386ed22dfd0b5c268d8d08eadee5b12f480caef81cbb77e5c3edfd56c4bf10213cce2083b06f5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837320, "uuid": "8dc7f133-b91f-45c1-99a3-6b5913dafb49", "value": "T150D633E783A6B6932B55DE1E795ACCC44CCF81369641F262DB0DEDE236343F206D4A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837320, "uuid": "ac58a82d-872a-4dcd-86d9-089180a1885e", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837320, "uuid": "5866fba7-e9f9-49cf-8bb1-054b3030a775", "value": "196608:+5J4EsphLsZmOv+dqFOy5bdyBLkYQWnJ58VBy3kgYRJggFHpN3FnHn:+0By/vF50VNJyjyZYRK8/Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780837320, "uuid": "f8b23d42-d6f1-4876-b9f3-f9f94cbc88c9", "value": 13150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780837320, "uuid": "c28b4791-58d1-4ad9-9dad-b12b41a99075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837320, "uuid": "09645d93-91d6-4b92-b198-5fb5f7f4d29a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335ae6df-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845965, "uuid": "61ac21c1-813a-441a-8656-fc00b3f09540", "comment": "Malware payload (Mirai)", "value": "88d775a6ae3b1f493c676571fa837017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845965, "uuid": "967f266c-231d-4c13-b99e-084ff02a3288", "comment": "Malware payload (Mirai)", "value": "ddc6bea0d36922789306d51b5d65223aff023fd8f3a030750f25b93f9ffb5c11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845965, "uuid": "511d8538-cd5a-4295-9b2c-cd66c3250eb1", "comment": "Malware payload (Mirai)", "value": "aba2d65ce6048da0aa271812ee9136836cd25259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845965, "uuid": "2680669b-fbbe-4f3e-9d65-fd7633bb0900", "comment": "Malware payload (Mirai)", "value": "437f4282facb84bc6642dd7e1ef2451b99fd91f70c5fd80bdf1cdf1ed20ed0ac26c10c6104a28e47d396010df8a10a50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845965, "uuid": "a7edd9f6-cf87-4cc6-91e0-9bc0642c339c", "value": "T1BB23F19DEC3CB6F6CD8C8C3D91491BB2CB69A0D032396ADC83014DDEE58625A607797D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845965, "uuid": "8061fac3-c4bf-4818-8f2d-01c67ca3004f", "value": "768:9RpAPHcr1znPLPlL5x4kyy1O7otJmap9nJ7TnBqb/WA71+HWB:9MvchTPLPR5Skbcamap9nJnnzeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845965, "uuid": "0a6dc0c0-517a-4c3d-a49a-393c91011022", "value": 48120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845965, "uuid": "a41bccb0-d43e-48ec-af10-2e3ca3d32535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845965, "uuid": "ab723391-bba7-45b7-b92c-c3e1963b32d4", "value": "Mystic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d266459-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817125, "uuid": "e961cb54-a3e6-4dd3-8b7a-48447d5fbe5a", "comment": "Malware payload", "value": "37e6c03e3ede8a1f75a3d7d541387b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817125, "uuid": "481da60d-a7f8-4418-8782-0a92afe01cef", "comment": "Malware payload", "value": "ddc736831492d88d8c5ee2358ea2f95d4dcebf0321a7b6fd91c4dc93842ec4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817125, "uuid": "0d8e1879-3309-4ce7-8c6d-7bd2b34dfc41", "comment": "Malware payload", "value": "0665073d4c6fb0f2f5ad174379ec0ecef6e2dc91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817125, "uuid": "aae9b185-5100-4499-8faa-87d714b613b7", "comment": "Malware payload", "value": "f69c7d99095a1272349af2f5e1d26d73e6322b00f7ce39eaa306a184ae2c9fffba985981376949a4157eb6864fda33ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817125, "uuid": "0008b6ae-0277-4fd4-85ea-4019338b8d54", "value": "T1AD059D56FB08AE67C596027E889B83042335DD892B839B476B6CF27CBC77238DF06545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817125, "uuid": "9dfff52d-f123-4bc0-8d10-8a8fe1f18187", "value": "12288:CwOQcnVoniocgZi3ZqM1UAlJHpgMlXbs0VKWh7e+QbGPt05XcRyXcqq:Cq0Lt3g2lXbs0VKWkXcIXcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817125, "uuid": "57195380-8c54-4464-a221-fff9b0715e9c", "value": 821696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817125, "uuid": "a8476c6b-cf15-4f11-ad4a-c4ebcb032d5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817125, "uuid": "1c8f384d-530b-4b26-b29a-f80bf77f01d5", "value": "bot_arm_fresh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c66578d-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817124, "uuid": "042a63ad-3189-4dd7-9820-c5a0fedfa202", "comment": "Malware payload", "value": "509282b867b8dd107dceb0cd54156d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817124, "uuid": "60d1b4a8-2790-4164-a007-288c3a94b381", "comment": "Malware payload", "value": "de5f438c4d7ca4c153f0ca389f00b1e5f814ccec9bc3b9f6cfab4bef013bbdfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817124, "uuid": "2b5cb2c6-3fb0-43bd-a9af-9ea763f5ddc7", "comment": "Malware payload", "value": "02f43292ae11cfe042dc94174005456a9ced9c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817124, "uuid": "a3cc6078-f1a5-4c9a-83d5-52a334d3a6ee", "comment": "Malware payload", "value": "5b91f0aa89d5ee0daeb960e8f31741c1b1078eebac3b0553c02478a17dbdf3f8786088a4aa197cf1a08f7ef1488315a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817124, "uuid": "02781e52-b944-4eb9-9f87-d3abb25cdbb9", "value": "T19D459D267710CF66D324C27145F3836557B12DA31BC2055B6278F338EA7269CBE1BAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817124, "uuid": "ebee948c-c96d-4e75-88ec-5685b7809dd8", "value": "24576:cE/khZvLhtFZhTyNDT5zugvBlW7I+1EQKPCfcNTmeuZkJDZo64o/dE+5lN0+4:XkvLhTAzugvBlW7I+1EQKHNqZyj5p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817124, "uuid": "f09bcb97-fec0-4d12-9047-6399190daf61", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817124, "uuid": "c1034d51-57bd-4e6f-ae7f-2cb5ba0f73c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817124, "uuid": "2686f71e-be9c-49c6-be32-c8c199cb7cbc", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f75fc5-624e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780822612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822612, "uuid": "a86f58fe-2b81-4e97-a48e-5f543d607e2c", "comment": "Malware payload", "value": "0c071d21b283728585ede6bf16f7b8c1", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822612, "uuid": "df4bc200-12b8-476a-a207-b3b40bf6bba5", "comment": "Malware payload", "value": "dee51b0ba6d0bb5fddbc9ab68b2d90a860cf8f1bdd721bd382ff50409645731a", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822612, "uuid": "ee688b4f-5c4b-4d0c-a5b5-c63befd222e8", "comment": "Malware payload", "value": "77e46b73ce9130d954b0b3193d03733cf65454dd", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780822612, "uuid": "39e7d4b4-c238-464a-8b8c-887994d64b06", "comment": "Malware payload", "value": "d861224803a3136e555e00b48e7efa46318cb33aaa5d00a573022887fccd57982ad199843a8d4fec60843f3a698c2532", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822612, "uuid": "515f487e-626f-4e30-9373-cbe2edb47854", "value": "T12EA63315601705E3D190B833EF3FC2A5EB36B768915A368EE52D923B7F812C16E38572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822612, "uuid": "34b54e8a-4739-41b4-a1ec-04c5188b151b", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822612, "uuid": "4269781e-982a-498f-8d25-8717eef7ae3d", "value": "196608:dWhdj3IIK+xZbXsdhHl8X88kGettSfUQHPJjSiKbUj3jI2kflfT:omILxZbXsDFpaXvPjjI2mdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780822612, "uuid": "de2fbd05-a321-4477-a8ed-8606d9fa206e", "value": 9885377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780822612, "uuid": "6a5ed3fe-aac9-4065-91e4-c2ddb68cf641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780822612, "uuid": "940fec78-dffb-4b54-9995-be00482e4c57", "value": "DSFIX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6cbcdd-6270-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780837042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837042, "uuid": "b71d29f2-7655-4f4e-8ac4-e4679c0c1e1a", "comment": "Malware payload (ACRStealer)", "value": "5814e782497bfa006f379f4b13f04502", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837042, "uuid": "67c89884-3730-4b48-8e0a-4eb960a61183", "comment": "Malware payload (ACRStealer)", "value": "e0646d7307c96469bb0cdd2a8b46c674c9445c889e60361364deb31d0b8b6529", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837042, "uuid": "f6d12459-9e50-4e2c-a4d1-36a386ef5a05", "comment": "Malware payload (ACRStealer)", "value": "b74bc318764b46289dd238f5009a0d8b9cd9fe35", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780837042, "uuid": "544e5211-2b9a-4326-87a7-12f8b9ae437d", "comment": "Malware payload (ACRStealer)", "value": "5764adf6ca5436b7a443920cc0fa098ef3b298a8f3017539f459a14af493019cfde6d33db9622efd57d3536c7389e329", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837042, "uuid": "3eaf4002-72b7-46ad-8d0a-5fb98f2d39fb", "value": "T1FBA5231EB8032F09C325D97F1ECB89243D9241BF5E939F17B46679A38FC098AB02555B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837042, "uuid": "63f24692-59eb-4789-88e4-350dae9439c9", "value": "24576:g4hU/5tOCaBTiaFsg3tEmtMkNqMYWRzwl+xVXbQeBBRjEKZqXflNw5Qnx4iUs+HM:g4vgaXyWxRFx9se8m55RckcQY2UYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780837042, "uuid": "ff2da906-4cfd-49f9-a7f6-66be794bd47e", "value": 2254109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780837042, "uuid": "60cf5053-1d50-4bf5-b8f6-520fbffcfa7f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780837042, "uuid": "c3eff6fa-5d55-43a7-8e5f-424e8ca77408", "value": "LcMgr.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffe4d27-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858952, "uuid": "449b7c5a-048b-4936-9b29-0b6744143d15", "comment": "Malware payload (Mirai)", "value": "74c0f5a2a4bdfe82b36aca968de26003", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858952, "uuid": "c0f1b9a3-cc9c-4790-8c5c-ad216f8c70e6", "comment": "Malware payload (Mirai)", "value": "e2a4438cef6f08b706d3fde8d0b90cb5febd57a002ab850e980e51d8fe5b8f8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858952, "uuid": "d94aaabf-7414-4628-ab44-763753a4a843", "comment": "Malware payload (Mirai)", "value": "2dd1f53cd55b07f7993dc2c352a9c09be6615d48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858952, "uuid": "2b87ce3c-f218-4538-bdaa-5e70a7cca206", "comment": "Malware payload (Mirai)", "value": "53c3517d51ad46f21fc523c00eb4c67e7f4e1b1ead0fea720441231ca2348eb38cd80d2e62da6d92c311bd0e18f4f2ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858952, "uuid": "8a6ce6bd-bc74-4ca2-84ce-6954882f94f8", "value": "T1FE330138BB66B033C4A18EF059FD8F8B15E8953BC4E5643107CC96AE986949647F344F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858952, "uuid": "515f4fec-abae-477f-b130-41c56d49d372", "value": "768:BSWF6Nb/1bw+xAsIgN7FhTsM9rgf/RpOVNI+Llm3ZYnshQrTqp+t0VpWs3pNp9qw:BtF6Nb/j2UAM9MfJpYOKoQrTsWsfcL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858952, "uuid": "ca43dcc3-3a83-4e85-9da3-9321b0589b3a", "value": 53424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858952, "uuid": "d8479afe-261f-41e1-8ef4-7624fe94967e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858952, "uuid": "a88e06fd-4c74-451d-b5bc-1f29f5dcf758", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e46ca2f-623c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780814711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814711, "uuid": "330cd7fc-7a42-4a7c-84a5-bdb64f1f88a7", "comment": "Malware payload (RemcosRAT)", "value": "bb1561fd6988cb117bd57827dd74f8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814711, "uuid": "87dfd33b-80bb-4bf2-b0b9-6b3c833ef20d", "comment": "Malware payload (RemcosRAT)", "value": "e36506611eae772d25b84fa97fba9f173f8b9b984b0906a29ebd8ac537dedce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814711, "uuid": "29e761cd-a971-4c88-b274-4029c9ff3763", "comment": "Malware payload (RemcosRAT)", "value": "a69f8b05915cc38e3d7fce8bbf935a0ff828cabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780814711, "uuid": "c34309ac-fe32-437c-85cc-da7e1e3b8e62", "comment": "Malware payload (RemcosRAT)", "value": "3738386f06995295a9005f34bbc81cc607b49a3a998881a096f0f4e263178af8a22a2f6ed9e0d7cce0f62abed7b5367d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814711, "uuid": "097010c0-8ee7-402c-acfb-0854a549023a", "value": "T11A3402843990D6B3EA7217301DBA7F6B6EF9DE4F2991670B734177187883382510A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814711, "uuid": "4a60e2cd-1d19-4895-ad8a-44656e46e826", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814711, "uuid": "dbabf0d7-e59c-4263-8f8f-8e65526b23c6", "value": "6144:OIw3nyamvHVHwuxy0yF6VxorgaACD9kZtDx6ZvBdG:MmtHw8y0ydstucDyfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780814711, "uuid": "47318a42-830c-48c8-b719-8ac8363ecb4e", "value": 250896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780814711, "uuid": "b8974368-1b68-40c1-ac70-e0fec4283d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780814711, "uuid": "2a314526-23b1-40cd-a4ea-4274b1af7801", "value": "BB1561FD6988CB117BD57827DD74F8DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f93be5-627a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780841547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841547, "uuid": "8a5d1f0a-5b92-4ea7-b3bb-f8b2e90b1d09", "comment": "Malware payload (Vidar)", "value": "22ddffd520b0c4fa023db780d47bb6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softmix-online", "colour": "#18A18F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841547, "uuid": "38c98ada-7e09-4eec-b55d-f4d1a1bf1051", "comment": "Malware payload (Vidar)", "value": "e39f78c229d6e7ea422e31529155b6da4c09020c0094810b4f0915c699c7cce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softmix-online", "colour": "#18A18F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841547, "uuid": "ae7e502e-f0c1-4e08-af7f-484f35956573", "comment": "Malware payload (Vidar)", "value": "857d77bd60352d64fd736562dc9f0aaceadefb23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softmix-online", "colour": "#18A18F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780841547, "uuid": "156b3c8f-450d-40f9-826f-b3e89bfaf8f3", "comment": "Malware payload (Vidar)", "value": "8ac6443387b2fdf870aaf2fda001ebc7cf687c60c701c27bed1e730085f5cbdb6702bffaa698a1dd0e3894f8b126c129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "softmix-online", "colour": "#18A18F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841547, "uuid": "365df980-f96f-490a-a976-15423c8df80d", "value": "T11AA59C0BBCD418B6D5FA93328AB511A17731F84A0B3227C72A15B2B93EB73D44E75394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841547, "uuid": "ac72e1a0-d707-4029-9890-5c630e8ae6c9", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841547, "uuid": "d7f99dd6-2fb9-4821-9fbb-db2afc606420", "value": "49152:yxWtryV94c+GGfKIE+9FrUiK/PiMZgT0Wr:P494clGu+vLK/Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780841547, "uuid": "45df2d64-1e58-4b9f-9cb0-918114882848", "value": 2077824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780841547, "uuid": "9dc46e1a-1664-4b6b-8aa0-2f2c576c7f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780841547, "uuid": "9fd52840-225d-45cb-b16e-4d3031ca90a8", "value": "Release_x64_v2.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8787e39-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780859073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859073, "uuid": "11565d7f-1e9f-44b6-b5a1-a83cfced4f84", "comment": "Malware payload", "value": "12e4ff70e933413da788dfb4c517d9f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859073, "uuid": "c61d49f5-ee05-4fa7-9a2c-d176e61befda", "comment": "Malware payload", "value": "e3ae0fba35622e9ffa4506efd2176d2ce2a8f163b58cb2cf2a2417aa5ada3eaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859073, "uuid": "4bf17737-1c04-45e7-85cb-34eea998aabd", "comment": "Malware payload", "value": "f0825b1393f55db3fe92889d740219e1a4126e93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859073, "uuid": "e59bbbf2-3a28-4b34-860a-156752a76440", "comment": "Malware payload", "value": "476b29474ea43264562db3194c1325b5160a4a53f88f5346d6576cd5152e528c55d6f13a2b74fbb4418d103fb3b8ec97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859073, "uuid": "0405f976-9ac9-416a-b098-3a8def05ab8d", "value": "T1F466F819AC843BAAC46C4B7554FAC95A23B05D140AF14A3626A4FFEDBC762747F07C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859073, "uuid": "7fb673bc-6178-4287-8b4b-e06ecec5bd71", "value": "49152:jjb6TLoUc6j/ih+cVPG4VE+SWt4dxa+f05Ef:SiYcVMWM5fGEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859073, "uuid": "1818a28d-6b18-4804-bcbd-3c2c03fc45cd", "value": 6619351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859073, "uuid": "7334230c-ca56-4342-9148-ceb24fd4fc21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859073, "uuid": "1ec21366-8396-4f3e-9fc3-fee619d16bda", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43df31b-62a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780861187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861187, "uuid": "f93e672e-259d-4e83-bb74-0aef9441ab63", "comment": "Malware payload (Gafgyt)", "value": "52fe69341465ce0d87890af290ec402a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861187, "uuid": "27c98756-3a7b-41c6-9d53-97e9c8b44450", "comment": "Malware payload (Gafgyt)", "value": "e450e0355bedbe26aa6a14fc19f12c52a1a0ab1e7d25c07046545c8380558d25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861187, "uuid": "f31b5912-ca16-4f8f-8d11-d5340050545b", "comment": "Malware payload (Gafgyt)", "value": "b03cb772f442b308087c95f8a33707deeb5522bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780861187, "uuid": "d654a4ea-7456-4894-a4a8-e23870d2e589", "comment": "Malware payload (Gafgyt)", "value": "ca45468bc1ea926bd6c9917437d33a010e4af49ef4d517885801ac840b57f5300f88cde80523356e1f6a40efd71aae8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861187, "uuid": "72271a94-a696-41a5-bb86-5c172fe4352f", "value": "T10FC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861187, "uuid": "3408f57f-b58c-4156-b77c-9c53cadf096b", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Ep3+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EJ+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780861187, "uuid": "39ce8491-6e94-49ce-b17b-76321156ec0c", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780861187, "uuid": "98216f55-7e69-4d0f-b608-bfaa851ebd63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780861187, "uuid": "344fa2fd-82d2-4e99-9ae9-1c0e1a3d280c", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adac055-6242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817121, "uuid": "e9140b25-02ab-401d-a88f-c81c8546249b", "comment": "Malware payload", "value": "4e5d345f60d0bf46acf4960a934bedb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817121, "uuid": "697540bd-4013-46c1-b00f-4fcfd89c681f", "comment": "Malware payload", "value": "e4800ac8bab20c7d811a3af3dc5085112585485d72f867db56b70a5b1e3cd848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817121, "uuid": "36462420-0c05-4347-8b00-48187636d6d4", "comment": "Malware payload", "value": "373444d6a6183545e05b5717b7715b6730ee10d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817121, "uuid": "0d1cb1a4-35f5-4cfb-b727-983946bfc73f", "comment": "Malware payload", "value": "d2c8cd6c536651a90952b1f672e0df4caac42449c53bf935043bb6413d10b684efbcf1939fa4f476922788b5358539a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817121, "uuid": "35b6f780-a1a6-4264-a144-f9b57ef6aa06", "value": "T1A8159E46FB08AE67C596037E88EB43146325DD853B868F076B28F27C6C77738EE06645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817121, "uuid": "cdfaae65-a146-473e-bd9a-8108fb176d8c", "value": "12288:5ev4cNKlRYU2TVWx93tl3MZuAsHpfIm/EECltf9rnqJRwF/YT79HcH:5Jtlgmw2wF/e79Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817121, "uuid": "c77e0e26-88fd-4842-820b-98655efbac28", "value": 912928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817121, "uuid": "aeead5f1-d182-40b6-be94-35accf5a548e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817121, "uuid": "d6eb6990-4653-44e4-9c9a-c4d36e4a5512", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68a2745-6242-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1780817409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817409, "uuid": "59183f09-13e8-4137-aaea-933126bee076", "comment": "Malware payload (RatonRAT)", "value": "2b2cd2ff8e20e001c83b70ab267f9725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817409, "uuid": "313cab59-c5db-4430-8a94-c290730ce4b1", "comment": "Malware payload (RatonRAT)", "value": "e5a30896b5d6bcc2817ebf28e15604d1294aa088c8e4e0d306e2c3b9609ea2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817409, "uuid": "4a3aae47-78c1-43b2-8251-c56f5d508a56", "comment": "Malware payload (RatonRAT)", "value": "907736f466cb068be6335abdfe728eb2455dc4a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817409, "uuid": "4a93ef18-309a-4bc8-a0a9-a80b7b0e1e5c", "comment": "Malware payload (RatonRAT)", "value": "c1e89855558c83547d94a365100647728f0c3ff2104ef0b8737d61bcd931d8d5b598bd0f5d53651e4c223e590fe3e0f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817409, "uuid": "637a0afe-4038-40dc-8cd6-8f0b49f3eb0c", "value": "T1E4062333EF3248BEC18E52B4B3BECDA035703C6555B4B55E17AA1241332FA901B6E6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817409, "uuid": "c8eb1f29-de9b-439c-8a43-1510ea42bd9f", "value": "fb223eaf1ed96a3356d4553d8300bca8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817409, "uuid": "c0a9c290-ab96-4a4d-8030-cc84aa5afabe", "value": "49152:OH8RGMO+KEz71TGuXgFfo7pB3dKHrcY5G5M0BXsHIMgxPSmbohVgklf:2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817409, "uuid": "45a5b8c8-4bf0-4395-9b4f-fc9e8a2715b6", "value": 3657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817409, "uuid": "969b4828-c8c7-47cf-b0a9-e8a8ad0b8eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817409, "uuid": "75611411-45f6-461f-b64f-de559033fbc2", "value": "gfdcrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed46cd-6282-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780844600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844600, "uuid": "07a2d1fe-8a2d-4308-a185-c61b49b40e39", "comment": "Malware payload (ACRStealer)", "value": "e484e5b26147f279d0aba354e74c581d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844600, "uuid": "ac578186-2130-4411-9418-0b4c1ae544ad", "comment": "Malware payload (ACRStealer)", "value": "e657b297cdd67488a7736b2a087731d3a5455258816db21e88c453ff273f316c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844600, "uuid": "03df96dc-ea30-466a-8bcf-ce0de2447486", "comment": "Malware payload (ACRStealer)", "value": "56d485fdea875081cda2654379a42d343a01cebc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844600, "uuid": "a203e2f1-2de4-4b86-acbb-40c51abfab0d", "comment": "Malware payload (ACRStealer)", "value": "fa4ff4052e1e751f3876a9d6e953f4db1d4b998360412fdad88783004d1df7229f1d20a5bfbb7824105c38b165684d30", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844600, "uuid": "642a4e62-e5e1-45f4-ba72-2dd7c991bdb8", "value": "T1D526CF16B7C8431ACA6F96BD85238112E6F1B82303A2C5CF4920EE691F677C19F35767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844600, "uuid": "d62a1277-222d-4ef4-b156-433d0784c139", "value": "fa2d3f2c3658fc64307d42f5908e7b3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844600, "uuid": "6bd1da2b-e6b3-4423-8095-1068687581c8", "value": "49152:NlQ736nzihUpT1vh/4lCHc1te5qEe18SlN97q8K+sb8VI5fCImJ1lxOouLsD2DLk:NlQ73UzXBvhglTe5qE8XAy6PPSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780844600, "uuid": "c60851d5-5449-4736-811f-bb1ba59a6232", "value": 4657152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780844600, "uuid": "f4fa4c16-e757-4661-ad97-f8e33a66916b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844600, "uuid": "84351bbe-ba10-4306-a183-913dbfd448a4", "value": "LcMgr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d9b1bf-6243-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780817539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817539, "uuid": "c50e2b6c-d5a3-440b-b9e9-e713ffec2832", "comment": "Malware payload", "value": "998ce5a1b4b57e14ebf66faee0406717", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817539, "uuid": "f6be5202-7d62-491a-9326-927d7ae2be21", "comment": "Malware payload", "value": "e9ff1fa9ea783daafb73b5bdeffe5a5a1b44b4344c6d9d7f93a88b27aef37322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817539, "uuid": "655618ee-2e51-426e-8e38-913f189de48d", "comment": "Malware payload", "value": "1d050ff5f4dff018bebc056a66f8070d09105245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780817539, "uuid": "70f9b81d-3e70-4673-98dd-dae32a6e1a0a", "comment": "Malware payload", "value": "fb41b20f220dedddfb8f3752613a4e69c0161efa5a6c803edd6ad35bc90eddad3fa5c35de2d6da704ed6222808d1c115", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817539, "uuid": "a252fcd3-7e61-4102-a6df-5330add0d228", "value": "T1DD732A1ABC41AF05D5D525BAFE1E134A3393679CE3EB7102FE116B1C278AD1B0F2A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817539, "uuid": "761c61ee-5bac-4aba-af2e-3d70d9caafcb", "value": "1536:x7nRfA079ENabyko5zQyRJlGzjWzoMY9lQkiWT2gNsc+/k0:IYENeyko5zQynlGzjWzlAT2g25/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780817539, "uuid": "d8be20dc-ea85-4a98-b4f7-05e205134f37", "value": 80612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780817539, "uuid": "67a716fa-81a3-42bd-8b82-b7c6ab82e7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780817539, "uuid": "528ec3df-ea57-4c20-ae49-16490d494e8b", "value": "4qo5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cba5d8-6297-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780853672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853672, "uuid": "22050e7d-ac5a-4636-a19d-b26e69407c93", "comment": "Malware payload", "value": "4c87478a242d55050308e401c1b07ef5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853672, "uuid": "1b3b1530-642b-424f-8caf-7f9ac2d74421", "comment": "Malware payload", "value": "ec84793bd45337c9b305760c6b9b451809f40dee4af917487a4dd22282266d49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853672, "uuid": "a15ea4be-2248-4f73-a1d3-f86ee454265f", "comment": "Malware payload", "value": "79a383eb76bccf8a6e16adcca7d2959409045749", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780853672, "uuid": "18933604-bad0-4f3d-981b-c81e60609f44", "comment": "Malware payload", "value": "a30b2b72015a8ef4e7761d90f0eade8e64aedabd14a96993de5322d0ddc32e8b4334bcc4a20f13e596c82a1893d64383", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853672, "uuid": "1b3a63ff-0cf2-49a7-a6f3-6602aee36737", "value": "T1BFE52959A524C1B5FA668821526C4F21E8F537EC89F197F2211B9B72584A3C2CFCB373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853672, "uuid": "b5876712-bd39-4f8d-9e54-c2da35fa52e3", "value": "ec4c491da37e3d5f47ce24f0a75ff4b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853672, "uuid": "15fd8a87-60f1-4616-9f26-c90b47a2f9ff", "value": "49152:/Cst+cwdYtVEX5I1EdE3FPD3bru4IapL0OyO0fW0j7nGPXl9:/5B3brrma0+03m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780853672, "uuid": "1a2fb8d7-3a85-4c5a-afdb-ce43615585cc", "value": 3236520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780853672, "uuid": "55f88581-e44a-4093-867a-b95585429880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780853672, "uuid": "84f7d2c4-6381-4096-a4f6-f5551bbfc78e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36607598-6278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780840387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840387, "uuid": "18e8066d-277e-4899-8b7b-38e0dce733bc", "comment": "Malware payload", "value": "b12782a5431c30260a8e708c4697837e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840387, "uuid": "395b4176-474e-43db-89d9-723b244a2b83", "comment": "Malware payload", "value": "ecb432b0f7344e66dbdb68d21819284264db3707941f0c8ea95db0abcb26e595", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840387, "uuid": "dbb3248e-0291-435a-9037-9061c12330de", "comment": "Malware payload", "value": "ca76507c8f067a22aa1fa25bd298ea288ab8bdb9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780840387, "uuid": "30ee1e7f-402f-44fa-9120-e754da84549d", "comment": "Malware payload", "value": "f7059c622f6f9fc856693ca5294999ca52d0c972e502f4a3d312547f2e6cc7ec618734d99f14e066b68dad751dba8131", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840387, "uuid": "1b45d3f9-a99d-4a8e-8a46-79afb9ffb20b", "value": "T15D01C2CEC015DB9050C5E89D36A75144F810C3CB26568F7CBE5C583E8B75B487056F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840387, "uuid": "c5c8abf8-865c-4f1f-ba54-662a9819a6d2", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkarIO4FxIDsjIckxg/XITVzDI7nIX:kXCKysE2hi0ziQvZohar+j/Xi5AIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780840387, "uuid": "de056cc3-b195-43f1-ac00-059a5f81fefe", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780840387, "uuid": "f7379a4a-05c3-437f-8950-5436fff48d35", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780840387, "uuid": "aca8a9b1-be8e-44a3-99e4-09aab71c3db6", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f5805a-6254-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780825162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825162, "uuid": "3b6e8fc2-da31-4862-a929-a80de3c44cc4", "comment": "Malware payload (Vidar)", "value": "35ea7609e3560501ed929c8eaf5d1501", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825162, "uuid": "bd75b4d8-d770-4372-85d1-f40002c8a8ef", "comment": "Malware payload (Vidar)", "value": "ed1b452a655df5f0ba19fd3a945f5079091d7472f0821eeb0f25d0a32f4481ec", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825162, "uuid": "8e85457d-f451-434e-a7bf-0a8125af46f6", "comment": "Malware payload (Vidar)", "value": "dbf99cd74c61f09e147af8ec42a4648cc2cee25f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780825162, "uuid": "fc69c880-d095-4e29-935d-38e8995e939f", "comment": "Malware payload (Vidar)", "value": "5adefc34f336118eedd680c6476a9bac69497d748a28a92f95a825e8e74a1bb6d8648ffdab313d187176fca7be2f9c40", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825162, "uuid": "199639cc-11ed-42f7-ab53-829ff83c5649", "value": "T136E59E07BCD14AF9D0AAB23988B65151BB35BC100B3A27D76E91B3792F36BE05D34394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825162, "uuid": "530ce4f3-96e5-429f-b605-7474b62cde2f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825162, "uuid": "f004828c-ca4f-47dd-81b8-79278964bea0", "value": "49152:peC1eJ/9Elyw+sVllaeNG4cN6iZWtRGDkcbcCiO:pi7NviG4S6hnjEjiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780825162, "uuid": "e3071814-dd18-489c-85f3-2faad521f8c4", "value": 3099824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780825162, "uuid": "4f31eb5b-88e3-4fe3-8c89-e060e5aef730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780825162, "uuid": "64f6a728-8e87-4e5e-90ab-1736fbffa9f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1915f519-624b-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1780821010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821010, "uuid": "58bcc722-a797-44b0-9b67-f71c79377de2", "comment": "Malware payload (RatonRAT)", "value": "06683790d0c0912b4c4a472b6de2943d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821010, "uuid": "404e4ed9-56f4-4df0-9ee5-e770f64a508d", "comment": "Malware payload (RatonRAT)", "value": "ed283ab1c43e7b91771c546ef818dde5d8c493099d3cae9423d5838c2675d97d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821010, "uuid": "af0be1ee-d9c3-420f-ab06-f8ad49e25b56", "comment": "Malware payload (RatonRAT)", "value": "31e037dc0f5742775ef86be84e8e96750bc40ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780821010, "uuid": "4699b663-ee91-4236-963a-feda16791890", "comment": "Malware payload (RatonRAT)", "value": "9b69a05b8e670795d993f2ab485c28f00bd249d01e4fd5ccf9cb74453ab1cf2c1c7b695e64feb589f0360694f8e2ea1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821010, "uuid": "37d5ef9f-a612-47cb-bbdc-03f28ddd2c94", "value": "T1FE062333EF319CFDC18791B8B3AE8B9135607E54D46AA19E0BD50282371FB906F6E185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821010, "uuid": "6f5a1857-a46c-476d-9e88-96dcac6ad67d", "value": "fb2078755202545d828dd507f121dc01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821010, "uuid": "674c9217-2780-48d8-adcc-96d8ae05baa5", "value": "49152:WNhqGUmq22kHxaei+eXJ2wJIJuJkjX5gYeM53787XH4:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780821010, "uuid": "74f1c8ac-d963-44c4-8319-a477610c9c94", "value": 3664384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780821010, "uuid": "780a3553-6f2e-4ff5-a296-19c016b95f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780821010, "uuid": "789e0cef-a816-4c64-9b01-02df0cfb4217", "value": "gfdcrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f5cd70-6280-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1780844139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844139, "uuid": "1a9b8523-e1d3-44e8-befe-73cb1ac412b9", "comment": "Malware payload (GCleaner)", "value": "fe82881652a59f6e56ef81f96676af69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844139, "uuid": "03512dd2-da05-4087-8a69-4e192f8c0dd4", "comment": "Malware payload (GCleaner)", "value": "edf375394bb78cd0020f1d278896f19a87e6544bcd5d90f953acee256a4180f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844139, "uuid": "d92c94d8-1f1f-4d5d-93e9-459f7975a964", "comment": "Malware payload (GCleaner)", "value": "4f20d4bbd58670618da5058fb5d22e72674bf83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780844139, "uuid": "df4a6e8c-d554-4f83-83ce-ba9c1d22b88d", "comment": "Malware payload (GCleaner)", "value": "a3a95846708bb69742f755601f68f9327682c9722867b0ae3cf211752d6efe65dfe47609c161f16ac86b5594e3e37151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844139, "uuid": "e831cd76-e654-4506-b0bd-8af7d028f4a0", "value": "T183059E22E1F84833F1672A3D4C1B927B99257E45E93A5D462BE41C4A5F3D6983C233B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844139, "uuid": "e97abaa5-b75e-4563-9a24-305dd1b65e46", "value": "12605bfd2420d54934c7f62d2c8fe776", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844139, "uuid": "254d2370-dffc-4dd5-8b23-e04915db8196", "value": "12288:4hJmfwWG9NJrkJWVytpPce+p4XZhLR4YKcp2eyt39hsB7EuHG:Q0vGTJrN4rP5+p4XZhR4YFoeyzhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780844139, "uuid": "4c35859b-0c65-4dbf-89bd-2295cc82c591", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780844139, "uuid": "65e0b0c1-e1b5-4d68-b6e6-868491ad63de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780844139, "uuid": "ab1f847c-6443-4d33-b967-1ae4606434f4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73448dc7-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858957, "uuid": "311e6a06-f8cd-472d-9542-0ca91d29de73", "comment": "Malware payload (Mirai)", "value": "5614e1bdd50ee4b4690484869703e28b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858957, "uuid": "385afdbe-aae3-4fed-bc45-8087bdf5d98e", "comment": "Malware payload (Mirai)", "value": "ee0135b131c627010f7d75721080aec98846da00655a26ef0e2ae856cf7ee77b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858957, "uuid": "f2111d07-538c-4d0d-b72d-e5689c949bb2", "comment": "Malware payload (Mirai)", "value": "bddd9b1a3b1383f70eef88db3be90702dfd89c48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858957, "uuid": "c5aa3ee7-2c01-493b-a2c8-d42e9fdafb05", "comment": "Malware payload (Mirai)", "value": "0224cde5a96ab9e624e2f9a79c20c3406a491b8b0b9fd8bcc438dd2b9721871feb02f5c4af0fafa05bfeaaeb55b213db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858957, "uuid": "f9d3d27f-91a3-4db9-8047-40830499fa55", "value": "T13D33F1E683DAE3F7CA05807917BB2180D22BDF02E3061EB54CE4C3A8AD2526C2C25F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858957, "uuid": "d4dba2d8-a889-46e6-a1a9-c31c278b3c5e", "value": "768:bhE+ahwSpW2RREQ/sIoVuzNkN2zIKWrDtS+IxtUGSVgoJJFk44WejYfzLWSSX2G:dau4BB/sMzmN2zIKwtOUGAgoJ6kPWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858957, "uuid": "d2b844d3-ba8a-4484-b495-5ca29b050ce4", "value": 55132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858957, "uuid": "35437fac-6d03-441d-909f-dfe5ace83d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858957, "uuid": "733682fd-f578-4cbb-abef-75860cc064e5", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29973497-6276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780839506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839506, "uuid": "ccfe3212-38c7-49f5-848f-94cb414560ef", "comment": "Malware payload", "value": "7f30b5594a90cf0762b1c88c8c6f1202", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839506, "uuid": "acfcd21f-17d5-40a5-b665-2a60f0f043e2", "comment": "Malware payload", "value": "ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839506, "uuid": "2b658b7a-958f-4b39-878c-a2527a9d7578", "comment": "Malware payload", "value": "45f2a9678d069a52694af2bdca4134106eeab0a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780839506, "uuid": "ee0624a1-cb59-42ce-b5d2-c223a276de92", "comment": "Malware payload", "value": "052f421fd7de9abc09eda30a9ce8eb98cbe42f92cab0f7b8055c93305778ba97e24b5d6dfb22652bce6a0f343e47d305", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839506, "uuid": "35735ee0-a65b-491c-b0a0-0f7adb448fd5", "value": "T1CB01C2DEC111DBA040C5E89E26A75290B810C3CB16564FBC7F8C443E9B79748B156F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839506, "uuid": "4c62e0ff-5df7-4497-89c2-05298a84cb2f", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkarIO4BxIxhsjIckDs/XITV/DI7kauD:kXCKysE2hi0ziQvZoharcuCEkXitAk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780839506, "uuid": "4af26063-17b3-499c-9092-87fced4e7b5c", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780839506, "uuid": "839de9e0-19b3-41c8-81b9-e37c068d4f17", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780839506, "uuid": "d9a50d77-a599-421d-a70c-368ae403a41b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931dd8c7-626e-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780836247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836247, "uuid": "ba029d8e-3aed-4e69-b1f0-6a47ba99104b", "comment": "Malware payload (LummaStealer)", "value": "85aaf746fc369632fe94c7ef722cd861", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836247, "uuid": "ebdb1fa5-3564-434d-b11a-be9a1a9a3570", "comment": "Malware payload (LummaStealer)", "value": "f04032b30bc54a3a01b2c013edeeca79e26337c95721f88cf3305f99626a6d0e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836247, "uuid": "b0dd867b-e422-48cc-9cd0-3fb7d83036db", "comment": "Malware payload (LummaStealer)", "value": "18dadb96436397984db7c3c80aaac41481d0c9e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780836247, "uuid": "e77f1ac9-6e00-4051-8078-84e0ec654922", "comment": "Malware payload (LummaStealer)", "value": "272d9c784d768f360103c2b2281bdeb27205d8f93811188e9e9b6df0fa99c4b89a1bd7690bfe5aa37b996c0a4d4cdf30", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836247, "uuid": "35a5a75b-889d-4561-b970-fa95c5d3060e", "value": "T111854A00FDD788F6E402563289EB72AF2735AC050F329B97EA44367DB97B2D50C26359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836247, "uuid": "f18dd35d-b27a-4c1b-a7b9-e6c4aaf1e7fd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836247, "uuid": "52dcc4c2-ed69-4a4a-9df7-f5d6f45510a0", "value": "24576:PQLVPAYgayJg/LdrJMeShWMCFPLj+CoTBS5nDK5iYyIICsWhqrukCBvb3cGIdVa:P+PT9SGFbIkkqrdKbsGIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780836247, "uuid": "cb4e55f9-2b4b-4ac4-bc79-47947b3bd6e7", "value": 1779848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780836247, "uuid": "fcfee7cb-a198-4f10-8c90-47ccc3f15d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780836247, "uuid": "4309cd8b-2c7e-465b-b2e3-a5896b987be9", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a83f1a6-628e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780849923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780849923, "uuid": "e5afeb8b-f787-47e3-8092-233f2ed95189", "comment": "Malware payload", "value": "2080e153c496fa91ead4686a4d44c632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780849923, "uuid": "06e0d5b6-1a15-4852-a615-c0135140ecc3", "comment": "Malware payload", "value": "f066d63e657d08a4df142b4815570c92963326da8a8f4e58c5964279ce6aa674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780849923, "uuid": "85dbd7a0-afac-4c38-b033-75d55cf21935", "comment": "Malware payload", "value": "9739f761d5cb0f1cedd06f0e3d46be0daa41b4c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780849923, "uuid": "794c9477-73a7-407b-b202-3a1aa80064d1", "comment": "Malware payload", "value": "8ccb67c57be5655305603b3ffed5987635e1a256668f21e59eae9bb884e72d7d99d93b831d0abee20ca2d50883d4a0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780849923, "uuid": "0277b4b4-e900-4b2d-a988-aa5f4253a904", "value": "T1A8A68CB3905324D8E1A989B4D11416527DBC3C8B5738A3C7BAC471F65BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780849923, "uuid": "857900df-f107-4ad9-82f2-012095f603f0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQA:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780849923, "uuid": "fdcda0a5-9275-4be2-b96f-0518990bd2ed", "value": 10223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780849923, "uuid": "eff8141f-8c91-49e1-a7a0-3eea1c733833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780849923, "uuid": "f166e2f6-d98c-4e9a-b534-d94ad66c4b74", "value": "f066d63e657d08a4df142b4815570c92963326da8a8f4e58c5964279ce6aa674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7e8b70-6288-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780847427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847427, "uuid": "3301c4ab-ff89-42a1-acc6-5124286978ee", "comment": "Malware payload (Mirai)", "value": "cb803a30a36be27bacb788160fbb966a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847427, "uuid": "c0ae6c55-8dd1-4c90-8301-b5b277771a71", "comment": "Malware payload (Mirai)", "value": "f188a78202626243c40841543b2f280cf1f183371bfca353eb99f3423a23c18d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847427, "uuid": "f076d644-f0f8-4c29-afcc-5599e56a042d", "comment": "Malware payload (Mirai)", "value": "2baab673ddf15665b431ddd420bae7bf0ed3c3c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780847427, "uuid": "3541eafa-4f1e-4610-87ed-ba5049718c2b", "comment": "Malware payload (Mirai)", "value": "8c74710839f10361e8677c7cd92e3dc6f01dce8a03eb7dccc782f0409ab9a92a798519e5773f6eec77442d1426c022ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847427, "uuid": "febdfc5b-292a-457d-aa30-d88bf496ad20", "value": "T1CFF3A91E6E228FAEF268C73447F78D25A76823C622E1D644D1ACD1145F6039E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847427, "uuid": "bbec61ab-cfac-4ed3-a626-5c8350b67d58", "value": "1536:rxLIZsOhLzVi3N7u3z1KCEniQ3QekrlZHMEhT9c9fvsO8L+Q+J+IdsgV:usOl5L3z1KCEniyMrl1c9Hsvva+IXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780847427, "uuid": "9120b9b4-5d16-4f47-918e-d8497a04a9a4", "value": 161144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780847427, "uuid": "a37acdb4-6ccb-45f8-8eda-1dbe5476b123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780847427, "uuid": "91ddac8b-2d9f-428f-995f-8bcbacd1cc11", "value": "CRY.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0e503f-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780858918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858918, "uuid": "b30b233b-b3b8-42ca-90e6-6f5575ff8f5e", "comment": "Malware payload (Gafgyt)", "value": "2b9a19a5c643b6808498d3a2c4bf89d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858918, "uuid": "51475449-5ddf-47cc-8162-ffa67fc4628d", "comment": "Malware payload (Gafgyt)", "value": "f3290f34f0c1be1322c3f31392633528c7c6c2de4903cbdac2a61ac7af36f5d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858918, "uuid": "183ab048-54ac-495c-814f-a8abfb070dd5", "comment": "Malware payload (Gafgyt)", "value": "d3988583c7a39d6a17f6dfdf06881c284413f759", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858918, "uuid": "848f7dc6-7d90-4036-83a5-4798d1448033", "comment": "Malware payload (Gafgyt)", "value": "1d3c475a61d0e8f9af44f04048b7e31fdd01fb71d2c612f87ef564f2c5224c8234795e64b08ab145940d87c095d63dc2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858918, "uuid": "8800f830-e308-4eae-92b7-3ee543d3d3d0", "value": "T1C84176E750E50AF22C90D83373694880B5E5A2A695C69F0B3CDC3CE448BEDED65886C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858918, "uuid": "c1a25bc4-30b4-4dd2-b680-deea56575189", "value": "48:BPd8j4RttQdMZYCR27TT63C5IwL1S5N5IAxpT:BPd8jyttQdMZYCR27TT63C5IwBS5N5Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858918, "uuid": "1368bc02-f9d5-407a-8569-b54b01e30218", "value": 2113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858918, "uuid": "82d58f64-d077-4144-b912-ee537ee2458e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858918, "uuid": "431bf304-3a6c-4474-87f8-4d66282c1604", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c7ee0d-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "e6eeed5f-1bc3-41b0-b3d8-64f5bc8faa3a", "comment": "Malware payload (Mirai)", "value": "bfaeb8513f32061b2a55251a3312c619", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "4566097f-bab2-4102-9772-4d792beb3341", "comment": "Malware payload (Mirai)", "value": "f46e715111c893301e57fe5e0bce542895d1b4bd8f74dfa5388aac76fb88cae8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "8c4c40a5-13ae-48e5-a6fe-75bd0d4a784e", "comment": "Malware payload (Mirai)", "value": "a57fd8ebed094fb7258845f9a15a3c8faaf7c8a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859072, "uuid": "d4d6271f-ea57-44ae-9938-2ee26b5dca2b", "comment": "Malware payload (Mirai)", "value": "279f29e9c84fac39cbd7e4d6d2035d22df4e97adaa805538b0967e88b8c7ac0dc472b52493ad561516b4fb6792b2c57b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859072, "uuid": "789eaedb-4c0d-461f-a9f3-c1122ebbf711", "value": "T12E463911FECB10F6E5030A3155BBA26F67315D058F24DBE7EA507F2AFA3B6910932249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859072, "uuid": "542e2ed8-66d7-4c3b-92af-7de55db1d75c", "value": "49152:KuRoD5emWSrifqHTrpghph/NqoZ+gH2ZQv8TBe4LCBTvree5E1:biD5WIiy+ph/NqoZfMNgS0E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859072, "uuid": "3816f1fd-0135-4641-9444-b6725c97c62a", "value": 5849272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859072, "uuid": "48caef57-26ed-4a11-97f4-8d47b471231d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859072, "uuid": "ca871049-0943-4d14-8360-52f41fe8d58a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb68223a-621a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780800264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800264, "uuid": "6da699f5-877d-40ef-a93c-f8ed378c5823", "comment": "Malware payload", "value": "d3bf11fdd27aca925078e13339a9c899", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800264, "uuid": "790b33aa-7eb1-43f7-a1b3-1374713502c7", "comment": "Malware payload", "value": "faccc7751be9fba6dbb999e62d6cd650d98d6c4e76b646f7b445d1881555b606", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800264, "uuid": "029f2091-693a-45e4-8431-65fed145b5ea", "comment": "Malware payload", "value": "d0d4da6ac45b2da56e9b6452df2fbf8e07c13ac5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780800264, "uuid": "c70b467a-a07e-4558-aaac-c6cbbf3ce19c", "comment": "Malware payload", "value": "c319e7c6760387cd2bc69cc0620edcebd56caad6294ddbde8c9e1b74634e3d410ce0c00f4fb3bae6f4ab3eb8dffb0e5e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800264, "uuid": "e2d83579-ac24-4005-9f8c-78857e9b9d25", "value": "T14F0188CF8101C7608486E89F66E761C0B411C3DB29464BB87E9C983DFFE97597015EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800264, "uuid": "e67d5750-b410-449a-92ff-aa9c9246c1e2", "value": "24:kXCKysE2hi0ziQvZohaHiCe7ZI1U4t9+CN7:e9Qp+MsHVe7u19+g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780800264, "uuid": "f53e010d-9838-4398-893d-9df498a726fd", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780800264, "uuid": "1609e51a-a9f4-40d1-9928-8de29b69e9bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780800264, "uuid": "ea666f06-f82c-4ea2-af4a-d6f6dfca2f3b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721db06d-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "38a615f2-e2b9-44a9-8eb7-4a7757786de3", "comment": "Malware payload (Mirai)", "value": "04c6ed88c948b5258d911fc6a17d93b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "61fc7b38-cb15-4fba-a02a-a1d23e7df484", "comment": "Malware payload (Mirai)", "value": "fb6e12247658e9a7f10d1feced8c91a0da6259e1e0644288e35d3a89a5294188", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "dac90340-2a1a-4992-a420-31500592ef94", "comment": "Malware payload (Mirai)", "value": "0330776d93317ae3e17baaaa4c90353d559f720e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "a6bcf5f2-4efb-4ba7-ba17-5764797b284e", "comment": "Malware payload (Mirai)", "value": "341b50b9fe28e66158e2d88baafcb35d2bd071c2be4956bcaab7d1f80c0ef680da9929cad33c804c3a663368be4fdeb3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858955, "uuid": "dda582c0-4a8e-441f-84bc-3a3e42490075", "value": "T130434B2250BC2F07D1D0B63B12778792B2E53B5E1A949B8EBD6A0E4FFF3125449271B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858955, "uuid": "53438327-54d4-43ed-8347-74b626cdefa5", "value": "1536:/+ttxz/KRSA2fIHdpUv+Ed5lcyrwoXzpfWIOE:mtnL+EdDcmX6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858955, "uuid": "c5502389-c16f-4365-9ab6-091ca66ca658", "value": 59592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858955, "uuid": "3dac7e9d-7673-4f0a-8c87-d53775a3fef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858955, "uuid": "2fde3b1a-6363-41fc-a43c-b84ae77b9c18", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d43217c-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780846009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846009, "uuid": "0ef4a25e-893f-47fd-8ff6-b1bd3e3cb270", "comment": "Malware payload (Mirai)", "value": "53569b007426385bf0bbb2079db9fec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846009, "uuid": "a32ab513-6bda-4eab-a36a-99b1df26c843", "comment": "Malware payload (Mirai)", "value": "fbc4e0d53b279408df9874e5b63dfd025b47d9e3cc546f0d7a39cf9eef5d6aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846009, "uuid": "6c8bfd2c-60ac-4360-a03b-3251dc31cf07", "comment": "Malware payload (Mirai)", "value": "9a471694d47a64cccfca0b66c2979ea1b8b14e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780846009, "uuid": "f066393b-7f63-47ae-b265-c8781d981ada", "comment": "Malware payload (Mirai)", "value": "b37e2939b9544978470545d426b424aa87234cd89ad63fdff5020faa8bece2e8c224f2777a1dcf6449ca7c7dcd57e21d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846009, "uuid": "8ff229c6-8f15-41e5-bf52-99aed2d88313", "value": "T1F8A34CC5F683E8F9D95601742132FF37DE72E6BA1139CA43C7E85A32ACA2601D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846009, "uuid": "c2675f42-1ef9-4c38-b742-40d6f1985f31", "value": "3072:vUr8lQ2Fis9Fif+3pxEH02Rm7FArS/PxJEH9PusQ:9lQ2Fis9cf+3H202o7FAPpusQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780846009, "uuid": "99dada57-cf59-45fa-883c-e6e352afdaed", "value": 99892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780846009, "uuid": "bf1e40fb-57fb-41a4-ae27-72e18b375bb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780846009, "uuid": "c97587bc-12ac-4d77-b7ab-ea973a32c022", "value": "Mystic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95096d1a-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859014, "uuid": "db79a544-6a66-445a-8d8b-f14c17c2972e", "comment": "Malware payload (Mirai)", "value": "9cbdcfcaeccfc9800ffd11aac92966a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859014, "uuid": "be489e43-fa39-4634-a844-8a9e1eb8c6d7", "comment": "Malware payload (Mirai)", "value": "fc74fc407d553540027a406ab52440447d3b033ef844a4853ff9226edbc8f4dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859014, "uuid": "cd794c0a-1f5b-447a-987b-d9cf3ccf4180", "comment": "Malware payload (Mirai)", "value": "ba7a3af76be8dbbf7065207a03c8e3cfe0a42912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859014, "uuid": "ca02a28e-0674-426e-a56e-4041dfb1fa54", "comment": "Malware payload (Mirai)", "value": "788869a577e2160a74be0b61ef131727543f52dcb1857c4911e9ffb2bf3c3a5aa0504483597110ac09e064723c83fcbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859014, "uuid": "2e211702-4c27-431d-899e-d334fa865cc5", "value": "T1E4D30749ED819B11D4DA22FAFA5E028D335357BCE3EAB102DE145B2133CAA1B0F77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859014, "uuid": "b2b8bac6-b7cd-45dc-8ea2-855af6fa9d41", "value": "3072:M9XxZB3oLmpMguHcUlVUHalw7WEuH00sfCJjxFadq/1EEsaf3+TLyWXFaY4verMo:M9XxroLmpMguHcUlVUHalw7WEuH00sfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859014, "uuid": "0725678e-4ff8-46df-967b-6ccb3b4054ce", "value": 132572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859014, "uuid": "e0fb03bc-9906-4b3d-aca6-97ad08f5b24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859014, "uuid": "1aa9e35b-997c-4896-90ab-55781618ddaa", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a64106-62a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780859200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "008bec8a-c2a0-4d7d-a86f-e52391c3adc7", "comment": "Malware payload (Mirai)", "value": "37fa46d25dab4c9d884676edea103802", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "ed105267-de32-44a1-bc2e-10a52df99212", "comment": "Malware payload (Mirai)", "value": "fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "a9a04dce-77c9-4499-9066-b65904230cdf", "comment": "Malware payload (Mirai)", "value": "94443a0e636a3d06a9b193913d1c5784b9a65d06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780859200, "uuid": "bbf2a89a-94e7-4f0f-828d-a3ffd774fa97", "comment": "Malware payload (Mirai)", "value": "931f5b1398b59d71eff9e1ab0ada5cde1d3f40c58e156623425a9901da4be7d3883054cbaac8bd7749d33eec4cef627e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "0c49a852-0424-4624-a070-873e61fd0451", "value": "T14521E0CD11E1B017C5E8DE48B9A1C754E400B6D7A4FF2E0CEFC5682AD8D96487235B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "e5135b36-42cc-4124-b2bf-3056f1177ce2", "value": "24:qMNEmRXErtAVeNIxEgnLEIKj4VJtvvxo5A9xhNpTXDU5t5JK5G5f0At5P+1C:qMNEmRXERAVVEgnLEIu4VJtvvxYA9xh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780859200, "uuid": "a8c89069-43a0-49b0-b090-f68e67f072bd", "value": 1298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780859200, "uuid": "27ae58ed-3e3d-4ce0-b104-04e73eaa36ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780859200, "uuid": "5b74eafd-a6c3-43bb-bd69-b9a702337bf4", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394e439f-625f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780829654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829654, "uuid": "f417d378-f3cd-47ff-9e86-2323858d2f44", "comment": "Malware payload (Mirai)", "value": "dde7c8cdd8d9f98031bfc08d79a396b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829654, "uuid": "7d815bec-b474-42a9-8b5c-4d7d0394de82", "comment": "Malware payload (Mirai)", "value": "fd367e537ed82b0e1d65ba6321af5f40dc979e33ff61a517bf8db63888b1180a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829654, "uuid": "871fe856-3ce1-4aff-91f7-9c89feae66a7", "comment": "Malware payload (Mirai)", "value": "7b515a84dfdea3c99837c1b7dee1004cf30aa6f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780829654, "uuid": "36c7986c-2fd0-4fa1-9c84-2dc7f6c988b7", "comment": "Malware payload (Mirai)", "value": "205436853cbff038fa8aa6d011d53d908a5f85f375cb39700eff917ca8cd4037f4601963ddd1cd87cabfaff1499418b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829654, "uuid": "2c438e97-dd90-49bc-9307-74d253f09894", "value": "T1A8A31942BD41DA23C6C11776FAAF419D3720B798D3DB3342AD156FB43E8AA4E0D2A351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829654, "uuid": "c781e0db-c599-408a-a4cb-d62a96e3dd93", "value": "1536:iHtczv1KeyHD4wZ9QiN5pMd54VAM1vATOB8t46Vz3s6J7vPB/yFEaDtJ:WidKFn4TMFMO84Cz86JLxyFEaZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780829654, "uuid": "1e5d3281-ba48-4dcc-bbbf-592ffeb5d88f", "value": 105364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780829654, "uuid": "fda66c0e-634e-4472-b45f-93459e536e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780829654, "uuid": "a69e93c7-a046-4c0e-9769-a5aaff53b3e2", "value": "nullnet_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b947b73-6285-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780845979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845979, "uuid": "c8f6bf76-6824-4df2-addd-4a7181f2d570", "comment": "Malware payload (Mirai)", "value": "ededc9112ee37c125d2805a56e997d3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845979, "uuid": "f9986452-28b4-4668-bd64-863f516257ff", "comment": "Malware payload (Mirai)", "value": "fe5480174c2a1bfcd677bc7c27f8918fdb700d5deac3319f4924dea1ea2ef344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845979, "uuid": "95c1143e-92a0-4c07-9e1f-b279dfb8c4a2", "comment": "Malware payload (Mirai)", "value": "17509d52b9fb0ea63df15e4bae5624cd2d2d41ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780845979, "uuid": "0e88b16f-5cb2-401e-a11d-db18a80b4008", "comment": "Malware payload (Mirai)", "value": "7e5089ff72d647bc7a272fb3435d334a3d7196b8ba1900447d0c1bb061815879a74923004f57c33541f5deb716816ba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845979, "uuid": "272ac6b2-45d1-49be-ae8f-df6c71e7a7bd", "value": "T1FB230275352164BAEC0191B2C266072A0D132BA75443EC4BDA75F397DCE3270EA53BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845979, "uuid": "2009cb40-3ffd-4b29-b7a7-55d226604d0b", "value": "768:w59Ni5hSfAkdEc30/rVb73n/DSkzcWXpuhLjsJJVbDeJQSogZh5fKvcAFJgGlzDs:6qfIEck/97PekRs/W/6oYLGVJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780845979, "uuid": "d6ab4e81-51fe-47bf-b9af-ce14da1df863", "value": 46652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780845979, "uuid": "c2e29f82-0411-49ba-ab60-8ee5967c4057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780845979, "uuid": "c42f380d-8051-4118-ae95-0d10b2718f5f", "value": "Mystic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f7ffa3-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "ca00ff27-4cec-4466-97e7-6967fe9f0acc", "comment": "Malware payload (Mirai)", "value": "7a52dc207ee764effb7566e9563b4522", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "a6a8fb80-ba9f-40ca-afa5-6c723b201265", "comment": "Malware payload (Mirai)", "value": "fe5f0469f75966c32d7ce67181ea81321a4a6e7b68b843da79930ffec9d9883c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "8b54cdd2-5254-4b64-9985-4efb6cc73a87", "comment": "Malware payload (Mirai)", "value": "a78aee793c2210d179374d8f980e56ef8163fe31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858953, "uuid": "078ed407-c98f-4454-b57a-10d7823c4275", "comment": "Malware payload (Mirai)", "value": "7313386aba9698b7c7ca69f5150b852c2714c224c05f2d61afae45023022f5ed74d9e53e74db5da5ce4ecf7c4a62010a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858953, "uuid": "a396abf2-6284-4134-ae45-d5364152db91", "value": "T1FB43F1BCF218599DCC28447CA1A502E785A1F07075AF56EC8316CDCD9E39B8FB6601BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858953, "uuid": "d082678f-a8f0-4506-b7e6-bbc9dfc827bf", "value": "768:FWZDtJb/DUTD8BswocKEHYESZvX2ERzHeQLvEqt0u4ebmpaj/kBGOQky2kFLaUyE:FatJG8BsaN4ESdX2EbLvb0EOQkAaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858953, "uuid": "17a2a312-e7b1-450b-abf7-dfd44237ffa7", "value": 57652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858953, "uuid": "ed64aa9d-b54c-4a68-93b2-c4ff9ebcaf0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858953, "uuid": "93e1c5ea-4caf-482b-9f33-1258cf27dc61", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f366ea-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "d03a279f-53c9-4026-875d-59a52e972f20", "comment": "Malware payload (Mirai)", "value": "fe72a99fc1f4e142335f0624ae433272", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "836984f4-1d69-4d7b-a56e-d80411ff43dc", "comment": "Malware payload (Mirai)", "value": "ff665cca180266989960b332e8098b577b2d69e7e60b73f66002f857e33993ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "6d81b144-a9d3-43b7-af87-3acac77a1573", "comment": "Malware payload (Mirai)", "value": "44ad4eb0b944aa955e1249e75a29c31ff18e239d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858955, "uuid": "06f129dd-d413-4fd8-838a-ff820592254d", "comment": "Malware payload (Mirai)", "value": "62fa0ed804e4ef7034b2963339c98a574562b77b52ac5d40be79ede95e27053e19534fbe33d68139621aadf253e150f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858955, "uuid": "b7d5ece3-4f70-48e7-bfaa-a036ab1376d7", "value": "T1A1D37C73C869AE98C624D5B8F1618E392F63A42891475FFA58A7C3B49047ECCF5053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858955, "uuid": "36b27b9d-8a37-4253-9af6-b54cfa193bc0", "value": "3072:AKDKTnuN6XbTO2wK/K95sdbRGfHlXLabYWrTTWhlI:AKDguN6rTO29u5sdbROX2bBrTahlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858955, "uuid": "d98dbb3b-2732-4194-84bb-4add8c0564ef", "value": 132268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858955, "uuid": "173170b5-e7de-4f5b-ad60-04f406a34c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858955, "uuid": "7edb2cb3-98bb-4661-b484-e75b5398ce72", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72563dc9-62a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780858956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858956, "uuid": "ee0626c5-c278-4b47-bef0-3faf7d11edf7", "comment": "Malware payload (Mirai)", "value": "e31642d3e604f156542442fa9b1e4502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858956, "uuid": "a3574957-29a2-4d18-b7fc-5bf393344dce", "comment": "Malware payload (Mirai)", "value": "ffa0f364fb17329cdc65037dc91ddef11e52aedc50608f49e9cd74b3a66f019a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858956, "uuid": "bc296673-7f8a-42e0-93d3-d142b1e5bf24", "comment": "Malware payload (Mirai)", "value": "1c9bdd556e4f548d2e097ec9b57489782dc35dd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780858956, "uuid": "d00400c7-b679-4a50-8421-049b7b7c2301", "comment": "Malware payload (Mirai)", "value": "dd7b8a4aa1d2e7a6b44dcc0500073f269629b16f1455ab1093335ae52540e2ed722655fcd7e1194c1893188bf88a30c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858956, "uuid": "d41f4e5a-4ded-43dd-b8d9-058eda4015d7", "value": "T13BE32945FC805A17CAD612BBFB9E42CD372617A9D3EE72038D115F21378A95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858956, "uuid": "96ad5d96-89d5-4bcd-b000-1541a8d4f6c6", "value": "3072:os6iykikge0tJ3pa5WTnA47JOwocR6ibI:os6NI0t3I4nA4lOwngibI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780858956, "uuid": "79be97ab-0eaa-43ef-8508-b5a55c279ea3", "value": 149868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780858956, "uuid": "aeca19ce-9c34-4ca1-a593-d30d997995e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780858956, "uuid": "decbe334-bfc8-4d49-8832-32e532ed8267", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }